bd3f2933ad2912b9f77b2500a40eac1b5796df786cf7b7987573a1df870ba11e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vpsetup.exe
Size 8.5MB
Sample260814-c1lr4sshme
SHA256 bd3f2933ad2912b9f77b2500a40eac1b5796df786cf7b7987573a1df870ba11e
MD5 434fe4343d440e347c8f501709ea6e76
SHA1 e858ef4623d8e026385ec5e9d736b9ffa57bf4eb
SHA512 24ed9f767eadddce83fb0e2e1f15419865e4a7182dab1ae121ff7b52181edd2f990ccd77443d74c9959ffba358889d034fd70d1fc28b510796cfb024c2cb0628
SSDEEP 196608:SEh/ZIfi65Zhxx/jvFYuxtkSrA8tR/2mjr9iVNJhxoAluuHWmj0fTaYl:SGIK65vDjdRiSD52mPuNriAP0fWS
TLSH
T14A96337836DAA16BE16285F8AC774E199108539845EB463FBBF48AD44B302CD34F583F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\VideoPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpsetup.exe"	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\VideoPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoPad-3472-1\\Installer.exe"	nchsetup.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	5984	nchsetup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3460_1819692618\manifest.json	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
5984	nchsetup.exe
4624	nchsetup.exe
3316	Installer.exe
4392	nchsetup.exe
4380	Installer.exe
3808	nchsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1424	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311484317338018"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F3E74779-9E79-4995-B6CE-E559510B4C8B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5984	nchsetup.exe
3460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 5984	1196	vpsetup.exe	89
PID 1960 wrote to memory of 4624	1960	vpsetup.exe	92
PID 5984 wrote to memory of 3316	5984	nchsetup.exe	94
PID 3316 wrote to memory of 4392	3316	Installer.exe	95
PID 4380 wrote to memory of 3808	4380	Installer.exe	98
PID 4392 wrote to memory of 3460	4392	nchsetup.exe	99
PID 3460 wrote to memory of 2848	3460	msedge.exe	100
PID 3460 wrote to memory of 3400	3460	msedge.exe	103
PID 3460 wrote to memory of 1424	3460	msedge.exe	102
PID 3460 wrote to memory of 3400	3460	msedge.exe	103
PID 3460 wrote to memory of 3400	3460	msedge.exe	103
PID 3460 wrote to memory of 2228	3460	msedge.exe	104
PID 3460 wrote to memory of 2228	3460	msedge.exe	104
PID 3460 wrote to memory of 200	3460	msedge.exe	105
PID 3460 wrote to memory of 200	3460	msedge.exe	105
PID 3460 wrote to memory of 200	3460	msedge.exe	105
PID 3460 wrote to memory of 5300	3460	msedge.exe	106
PID 3460 wrote to memory of 5300	3460	msedge.exe	106
PID 3460 wrote to memory of 5300	3460	msedge.exe	106
PID 3460 wrote to memory of 4224	3460	msedge.exe	107
PID 3460 wrote to memory of 4224	3460	msedge.exe	107
PID 3460 wrote to memory of 4224	3460	msedge.exe	107
PID 3460 wrote to memory of 3764	3460	msedge.exe	108
PID 3460 wrote to memory of 3764	3460	msedge.exe	108
PID 3460 wrote to memory of 3764	3460	msedge.exe	108
PID 3460 wrote to memory of 5968	3460	msedge.exe	110
PID 3460 wrote to memory of 5968	3460	msedge.exe	110
PID 3460 wrote to memory of 3436	3460	msedge.exe	111
PID 3460 wrote to memory of 3660	3460	msedge.exe	112
PID 3460 wrote to memory of 3436	3460	msedge.exe	111
PID 3460 wrote to memory of 3660	3460	msedge.exe	112
PID 3460 wrote to memory of 3092	3460	msedge.exe	114
PID 3460 wrote to memory of 3824	3460	msedge.exe	115
PID 3460 wrote to memory of 3824	3460	msedge.exe	115
PID 3460 wrote to memory of 4216	3460	msedge.exe	116
PID 3460 wrote to memory of 4216	3460	msedge.exe	116
PID 4392 wrote to memory of 3892	4392	nchsetup.exe	120
PID 3460 wrote to memory of 2776	3460	msedge.exe	121
PID 3460 wrote to memory of 2776	3460	msedge.exe	121
PID 3460 wrote to memory of 2776	3460	msedge.exe	121
PID 4392 wrote to memory of 200	4392	nchsetup.exe	122
PID 3460 wrote to memory of 1856	3460	msedge.exe	123
PID 3460 wrote to memory of 1856	3460	msedge.exe	123
PID 3460 wrote to memory of 1856	3460	msedge.exe	123
PID 4392 wrote to memory of 4828	4392	nchsetup.exe	124
PID 3460 wrote to memory of 944	3460	msedge.exe	125
PID 3460 wrote to memory of 944	3460	msedge.exe	125
PID 3460 wrote to memory of 944	3460	msedge.exe	125
PID 4392 wrote to memory of 3456	4392	nchsetup.exe	126
PID 3460 wrote to memory of 3216	3460	msedge.exe	127
PID 3460 wrote to memory of 3216	3460	msedge.exe	127
PID 3460 wrote to memory of 3216	3460	msedge.exe	127
PID 3460 wrote to memory of 792	3460	msedge.exe	128
PID 3460 wrote to memory of 2204	3460	msedge.exe	129
PID 3460 wrote to memory of 4564	3460	msedge.exe	130
PID 4392 wrote to memory of 912	4392	nchsetup.exe	131
PID 3460 wrote to memory of 5748	3460	msedge.exe	132
PID 3460 wrote to memory of 5748	3460	msedge.exe	132
PID 3460 wrote to memory of 5748	3460	msedge.exe	132
PID 4392 wrote to memory of 5628	4392	nchsetup.exe	133
PID 3460 wrote to memory of 4240	3460	msedge.exe	134
PID 3460 wrote to memory of 4240	3460	msedge.exe	134
PID 3460 wrote to memory of 4240	3460	msedge.exe	134
PID 4392 wrote to memory of 4768	4392	nchsetup.exe	135

C:\Users\Admin\AppData\Local\Temp\vpsetup.exe
"C:\Users\Admin\AppData\Local\Temp\vpsetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\vpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe
    C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd0940c188,0x7ffd0940c194,0x7ffd0940c1a0
        6⤵
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,4866762200431342923,3382060565098771972,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:1424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,3488590338672091490,4599102376560092943,262144 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
        6⤵
        
        PID:3400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,8689930217589717275,15041308019134487732,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
        6⤵
        
        PID:2228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6242224036157819453,1484672770290527457,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
        6⤵
        
        PID:200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,13712258270132877295,16595387789163917518,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        6⤵
        
        PID:5300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8317088369537047631,10997817512084285750,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
        6⤵
        
        PID:4224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12616116455089307019,3806977074784862707,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
        6⤵
        
        PID:3764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,2412799961626686827,14284072792971672164,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        6⤵
        
        PID:5968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4039658581374594482,11106454998106213427,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        6⤵
        
        PID:3436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9679846440428548053,12408225223513748478,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
        6⤵
        
        PID:3660
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13358250967237734276,16052502134592738294,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13358250967237734276,16052502134592738294,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,2963384832422134709,12314787786779998426,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
        6⤵
        
        PID:3824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,9345366179127930985,5378929433924686106,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
        6⤵
        
        PID:4216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6692,i,17475456253786269568,5973783467168840469,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
        6⤵
        
        PID:2776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6440,i,1967828199835669160,2921091411179236420,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
        6⤵
        
        PID:1856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4232,i,7405339818800907183,6706369089232068336,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
        6⤵
        
        PID:944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4536,i,8191764830965410467,1001401079313225817,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
        6⤵
        
        PID:3216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,6073780420818453986,3768131280220375991,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:14
        6⤵
        
        PID:792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,13459102836426478557,10469543090628359008,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
        6⤵
        
        PID:2204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,6748415330951033528,15563560309619974086,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
        6⤵
        
        PID:4564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7132,i,11566116949995226213,6288415448271976285,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
        6⤵
        
        PID:5748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=1504,i,1976358912291324064,15615375728955628603,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
        6⤵
        
        PID:4240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7420,i,5195317195059239780,3120156732171693309,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
        6⤵
        
        PID:4664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7572,i,18313464881246211062,5321729472519584049,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
        6⤵
        
        PID:5192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7524,i,15064200613102383755,10001745126527506953,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
        6⤵
        
        PID:5920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,6135508460588333105,4924404572017211284,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
        6⤵
        
        PID:3788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8160,i,127135792494473103,8851829732835805351,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8424,i,10090266074877513069,11732612684823001956,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
        6⤵
        
        PID:5604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,235208742781121096,8580529810489294920,524288 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:14
        6⤵
        
        PID:5268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8636,i,14767010797964310865,12450234200773369167,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
        6⤵
        
        PID:3724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8720,i,3477795440868225780,15005893983476403337,2097152 --field-trial-handle=2528,i,7882396142696535284,16018359737045872317,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:1
        6⤵
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:3892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:3364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=VideoPad&appname=VideoPad&version=18.42&bootstrap=false&installer=https%3A%2F%2Fwww.nchsoftware.com%2Fvideopad%2Fvpsetup.exe
        5⤵
        
        PID:5148

C:\Users\Admin\AppData\Local\Temp\vpsetup.exe
C:\Users\Admin\AppData\Local\Temp\vpsetup.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\vpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624

C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe
C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 130KB
SHA256 c1f60c984f74e602ade4d8ba0c00fc29c6a7d9c9c1cd9991d78122dadbddc670
MD5 5e35b564230b069a3c1fadbd8703232e
SHA1 bff8a3d7884f5d3122d76618fad27c6730668775
SHA512 a34d0d2ca421fffd4f3ea5b2b83b1a92581d125f9bc095fd75dabe385bd144cdf63cae89d2c845428c329c95769b91828b1e62cd7169cf497ad3f63972204a84
SSDEEP 3072:yX9Cm4AHM0f2nyU9gZ1e/GKlFN0FA43wdKnI/3KTGLngDnJ5QScuH:ytCxA3fVQce/WA2dK3KTVJK0
TLSH
T181D31274D6AED402FAEB959C55F0C0796985652D57BFC2E434FDAC0CE289AF072CC920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 179KB
SHA256 611bdfacdb514f38840dc2ab1a6005c1713cf82d7e03f2b167cd41acae73b8a1
MD5 c061922afcb8b40186e94fc141b139fa
SHA1 cd09132b7952183983203ba2645d63a56571dea8
SHA512 078bc87d75fee9a8f765e463d3fc442804531e598386a86afde346cc184e92ac2fd9c1fc34b34883c0c1965953906a1f926567f7e0570bccc5644a55d46e032c
SSDEEP 3072:c6wSknz8svqWWn9yHVHRTt39J2UyBajOOLX0d4I/hEyhaaqi/J01IUwZjcFhnCAd:c6wSQzXvGn9mVDNcsOxdIyhaaTekjYso
TLSH
T1830412382FFE34EA6F8B9B5F5A52653CAB0855516A12804D320352FFF53B3278FA5120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24b6fbd0b47d8255_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24b6fbd0b47d8255_0
Size 260B
SHA256 a7e04579c8340e629f06ce251550109baa2082d779d70b1a8ca64cc650e58a38
MD5 73b1ab2d487130f107f76fecc6080b5f
SHA1 290d8bae7ae1c34c42ed341568674091bbc77179
SHA512 f122efe463ae952f52494a160964289acdf503a81b6bef202783483bf07ad965f42bd9453d56c7509563f62d073cd6744e1b65d3982f2edcc2c9767677616276
TLSH
T19ED09773C8202210DE0A82F1FF6EAF4BEF038014149FE3D0420904380B234AADA48181
MD5 SHA1 SHA512 TLSH

Submit Download

2d351e8a190c5317_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d351e8a190c5317_0
Size 3KB
SHA256 b3b9b5d4d0ed596bca58a91ea88b389ea92d14a41d059d3119c0042719882b53
MD5 c61f17baba0ba76e9beedb712ac97a4c
SHA1 9d7cd852ff179e6e0fc2aef3ea0ad205f77eabfc
SHA512 28e24bb979e3059eaf53ef94b930fad42b8feefde60be79da973ec6c6191b865bf4e3fe82f3410554f862f630fa6d675220e53270f2efd66567ac6e160295a86
TLSH
T17071E722D284240EC111A1F9ADA3CF2A3211B05E9BFAC67B202136725C592E64FA754A
MD5 SHA1 SHA512 TLSH

Submit Download

6411216df07126e7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6411216df07126e7_0
Size 250B
SHA256 340ccb8307d40cdb27739591cfa4ad021e3535e93a2bf0c34cb22b399fd529b0
MD5 289eb8ed0e6492d637416ddd8f668406
SHA1 3f3e2be685cbfe6a4768815f18bbb2b442239ff1
SHA512 67b3bf637afc794bb1d5b3d9404f4fe9b78aa1a5882bf239c0289be74e721e0fdf27727723694427ae868a22014a882737f2021a8e716562f402d55a7c344211
TLSH
T1DAD0979380311943CE12A1B18B66EA08F3230B3825C8D0E2402816B12300CE28A2B046
MD5 SHA1 SHA512 TLSH

Submit Download

896846343fb215f9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\896846343fb215f9_0
Size 923B
SHA256 d8d466859cfacae8214689c748303d8b5f9cdfd9228005dbb87df1f76d8f3061
MD5 b674329e52e135e642056ac2fd3b92d9
SHA1 1be58927b9ddc2631b833e86c3b655f79fe08af0
SHA512 b7a40b4a249ecfd6318730edc1be11f82aef9595ad7e875309a9e7af4ab0b0b278cd9f7667287eb0ef75e85311d57662bcdbcc4ca6cfc23f871f1b49b99c074b
TLSH
T1CC11CE6B8742B895C62827F2A1EA8716E73351CAAE9BC70A8261063E1C161BA6D34002
MD5 SHA1 SHA512 TLSH

Submit Download

8b9ef02fd95bea5f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b9ef02fd95bea5f_0
Size 840KB
SHA256 c609b2c5b1025e6bbd68ba13c3d24d65add834daf343e2174770eff199927137
MD5 20d626fc45efdfb47c444b1a2a4d3dee
SHA1 843fc6917928aadcf60b3206d7ec8440b6d8e6e5
SHA512 f09f927d49a88ce8ee1aeb7f51d8f13202e385dba56dca06c827ae4113f58d64dec7c20106e82c3df1a868e864b51679a259b854b7a9ff8d21062567df05411c
SSDEEP 12288:3YtGIrWDdU5H0LIMF2hcOm02xxndvVTt7gGDy25W3:3pBdUUOc50qt7py2
TLSH
T113058300DF807F35CBB657B142E3D57A6139424B2EA291439270BA2A6C1D2D76EDBC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd8028aaf0debe86_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd8028aaf0debe86_0
Size 5KB
SHA256 5940cc98601ce21be7bc9f94f57badee37cfe9f24b1c7bfd5d24ddac41e3cb74
MD5 4fef75cb1da3bec796d65da38ea6e5fa
SHA1 6dad6e4df50cfc2d9087cb8b43b2820063de0340
SHA512 3f7a66e7ea9f54e211dc5933be4948a1d9799978c31eec55c53e02ba0a616320aa8039d2e886ae0b401870d14a5d119dbd483e99861ffe3e5e2bab75852469ea
SSDEEP 96:zl0kLjRqAkkN5i4zLcXvb9Jd/YnlH+L+aRLcK6jn8iQZyFeMjq:JjEAZ5iLvb9/2lO6jn8iQ4eMj
TLSH
T123B1B742FB56E25DC5272FFD1097DB66AB31D5087A83826B20F05F292C0A1F3CA99846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5f170971b8ac48e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5f170971b8ac48e_0
Size 237B
SHA256 138b2049c6c9ed4e7130c4e3b03dda5013e3843ae74820bfae9f8d9a96bc69ea
MD5 1f44515dd1e7dbb818748beddd0912d2
SHA1 f9b06e1d3964fa56184c3c4698328228bc26af35
SHA512 252008e5a356e2daf77d1d90c7c0fa4c635cb3a87d1ebdaf7cbe057efeaa02240f8110c38b348989d4b965cb758ef3ebd0d227eebedfd8589515cf1c84a41b5f
TLSH
T1B3D022C3AA384D11C69A86F2AB7B6509E183E09A554ED0848598D83B23582F6FB404C1
MD5 SHA1 SHA512 TLSH

Submit Download

d5f170971b8ac48e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5f170971b8ac48e_0
Size 277B
SHA256 0260cb70007f7195a35ba02cd9edc640c05340e5871fa582a678c71477393f38
MD5 3d2166b574ca84228ff71e84223ccae2
SHA1 47e110883e169314080173b67233ccd28a30a734
SHA512 8df3c8a5952159fc0445b566b13752c828c8d1b9d4f132d64523e02fa38a42e844cc4d63b568e10d9423c7656bf1c05535368d218f7e6558bf6ffe39e8627033
TLSH
T11AD0958351348C24D70185F5D7F35209F2D7D49C906DD0E4410A58373346193F5544E0
MD5 SHA1 SHA512 TLSH

Submit Download

e9ae91b521ffc207_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9ae91b521ffc207_0
Size 78KB
SHA256 56c88b973ab3ecadbc2fb500a96526b81917fd2fd28c633a120e7f24c5773339
MD5 7586d89d81379cd109fabe6c55d2f81d
SHA1 235b1c2d4953383f766a8bfdf14139c477bcccdc
SHA512 5616562dfce757c64988c978cc96f80b3054d22dfa931018e2da1151ae79d52094b609f46b410a6e2961943b6c88b21e3dcd0e13b082054b8c09d43045510c51
SSDEEP 1536:toU71Ux5XWY9hL9kMW6NhuAjp1fyffhQq1RcJs+DTXXm:tr1O5m8sd6Nhuof+5Qq7cFm
TLSH
T1DB7307142751B97ACF2783B5A6768817723602CD3EE7D20617E0B2353C662E65E8EC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f75ba2584516bfb8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f75ba2584516bfb8_0
Size 406KB
SHA256 7490f0917644b5a98ed3873b59f537890bfdca8a880370be21b112ca3e52b3c6
MD5 7b67f8ee27a659537cfd2663b2f02c79
SHA1 d77626e0d45b68e87d436028ca5d0dc4248f5094
SHA512 49ee912d205ad8fd53db70a5cfe53c615fdef3f813f3e997185c779c88c4f910a352613104e9f2dd61db6937fa23046eeaa455ef84a5fd41ff3514b570a71bc4
SSDEEP 6144:2SrcfJAvM8UNW2GeD0DDh7EiBB17P3Rp/PFwy7dRTwCQu4:2SWYL2rD4DhvTfSy7r4
TLSH
T1BE94A655EB80BFA5CBF253F50293D5627232809D2ED3920323A0AF292C1E1D95E97D5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 860ef67470148125f31ea95c97e102bd158db73298bea0f667b2484f7df74275
MD5 cc84a59790ff73367a2d3975a8bb3d79
SHA1 8029c73a48a735bb775c28c8ed21f5f3a64a1992
SHA512 38fbb3f27212c4d034fad5fcb1aaf4710fd70a981e4d6b96b4865c476570d39d78b735bff1e269f2c131b55da3a88f4b155376f3a7a9478af7d5260bbc71513b
TLSH
T13171CDF383E4852DC91296F4AB14BF1BCE2D0924432C3D6AC8E4AE1B93E2471E14079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8168132d1af34096fbdbafb341ed3ba5d4036343516364eb002a1c7c78929c41
MD5 ffed3127ba43f49dee773f73af0f8fb2
SHA1 9da9aa6972472251f550a7f4e28c39ad569b0db5
SHA512 823eb32b83ae4037271806839c54f26d83f50c8ef3adef2ea86996f8939a5399cd7ca85472b73de4fc24fa68838ee9d981b5415217b8c62270dbd75cf11ef3a2
SSDEEP 192:sxRCRkrCre/f70sZ75Z1f0pzoA8peE/g6+WNPUEfYoX07Y62GlIgVNJ:sxRte6/fgsZ7X13z/5bf4lt
TLSH
T18B42B7166D68A93B9CC7E24DBA15BF53D3F91072A1D15E48FAFC861C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ac0390aac54c6be24524500ea611e355d474860e873b48c6b29f32ec6f55a222
MD5 c20a6e6b4b219dd0a63ee281bf54e5d7
SHA1 10bf07b60fd0ae240d460ae71f4c2049a4928a4a
SHA512 a951a767eddb500d2593dd091e15bb73f1576f01c5848712036d3e59da4b7bb6a647790151ba62a67a0eaa2427968ac1288f7eacc122c121b3698d7b9f03f515
SSDEEP 192:sxRCskrCre/f70sdh5Z1fZpzoA8pep/g6+WNPYohatAy0Vo+a7Y62GlIgDsNJ:sxRWe6/fgsdhX12G/5nhYl+
TLSH
T1DE42C756A928693B9CC7E25DBA15BF53D3F91076A0D15E48FBFC861C00EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 26ad498cc1afbff532bd7c0fe76be035cb409ec91d0b9d844ef0cef2f3aff6c5
MD5 cede3b4d984d4ce462b7fca4ac460d58
SHA1 2039f1a5c5fa7e7603446a717b2161bd0e9aa31c
SHA512 2ba4bd983547dfc0d6482cd640b68c56bdb6759ec357a4c475fd0d45bad7fd790c52cb72b891e8d07254beb4efe2e9c48682ae98297ab3f973ee6b845b21049c
SSDEEP 192:sxRCskrCre/f70sd75Z1fKpzoA8pel/g6+WNPLxZYok07Y62GlIgD2NJ:sxRWe6/fgsd7X1FW/5tZhlg
TLSH
T1D542C8166D28A93B5CC7E24DBA55BF93D3F91076A0D15E48EAFC861C04EBBDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4068a29bda165288dfb8d4be0649b011e9045df273d4335b7d060c1c1e90fc49
MD5 94180c68a994b508b9f1e9aad70a10ad
SHA1 1d2d65f1daedf45d6559af730ae830867386c04f
SHA512 579b959dcbcd2ea004f0e346cf485a42ff976410aef098d548f1cf9a5b0f064cea101b7f01b5c827c8518a5ad767e75c874ef6b14b1c9562376bc8fc0dcc21a7
SSDEEP 192:sxRCskrCre/f70sdh5Z1fwpzoA8pet/g6+WNPBvpYoLa7Y62GlIgDsNJ:sxRWe6/fgsdhX1ru/5dpOl+
TLSH
T14442B7166928693B9CC7E24DBA15BF53D3F91076A0D15E48EAFC861C00EBBDD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7ed39649c67462080455ee1d1056377402fbdd552461b81f1938d1f054333d67
MD5 6f4ffc9cc937eba4993261c1daa92590
SHA1 345ce0e9fd972f5ac3a01144812cfdf7eaf2abcf
SHA512 dc9208f5c5946a89bac34b01c080837aeef4f41bfa9c43b524b070d9f87a418ed609fddad089d44d5aba61dfadbd397ba6fe7c829cfa083da6d761083d4ce48a
SSDEEP 768:j26HNo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVF3BVuwFro9re0U:j26HNUE7MRWgs2f02u1jaS3B4w+in
TLSH
T132D2DB7B640DCABF4F800ADDDC197E9F6D6802CB9698CD8047FA951C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 96320989bc052d33e2f7c840aec640f9ab6dbc78349c53aefa4043b783b733de
MD5 871cb4ed776bb0b49562450c3c43716b
SHA1 6ffea223edffd93d612eefef7f726daac6d632c0
SHA512 a5f26f16f0afac5e50df159f0e97b188611ef3d83b047f20149e2d1b2078b4b167df258b1a48a10522e7ba4cb876b35e1c5b57e5f658182ef678424feb157f0e
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyL6:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgI4
TLSH
T139910321337B13803C7EA58D91B9A41BD2C171A23215B52B37A803665F27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5bcb0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5bcb0d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 42c105ebe14f4d0d36c7b7f00fea70b217db45e858f0605d867c878d34c40fb9
MD5 66108631ac47bbe5f74ac56142a380ba
SHA1 51ec51674de1206a74033b79079f4ed404aeb73a
SHA512 798f2693623a85e3e2e39015c321c2cac2a62a8ea21dcd2e4f8696ec89638d9fb091c8f3587f6ee6e58a89db3ef3e3d1f3f44c2350a5ae3f18e78f6a03c7cbb3
SSDEEP 768:hrv+4UNbdz3Cs+/TBOW7734ONXyer1IRCzniBKeVH1SK7:hbsbV3CmSIqn1EH1l
TLSH
T1D103BF36E4A89E338CE2A3C5B14776437FB85057D6840790EDEE2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 324e13fe4cda2d69700b42d28d609673cd8dfc5fb9ae4b93a1feb78ca7b941d1
MD5 73a146056924e5136eda3be84eeca980
SHA1 954ccf08b8942ce84ed47f9a287d846a2ee23de2
SHA512 1c43bfbfade8345a8dc6c44e52ddf4ce7c2bc241dcac82a542b3bdeff2be8c7502d1b9bbf40242964561522ec3dc5de69ab234c876e577791667504729db33a9
SSDEEP 768:Hrv+4UNbdz3Ef+/TBOW773njtvONXyer1IRCzniwLeVH1SK7:HbsbV39LSIqnHEH1l
TLSH
T18C03BF31A0989E334DE2A395B14773837FB820A7C5804B90EDEA2F4E059B59E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 d36a9d09b91018f45d7cc69934472f864f0df20a0b0cb4addf34d335281369fe
MD5 bfdb9915b4fe1395f37591b5955f708b
SHA1 ae01b02c4e0124f4ccda1161624d77d069410bc8
SHA512 254710959475626164ffc7c5cffd5289e894b8906dd3c5d551e624d5f37bf71dcfe8ea524aeda6c5615be66361774a5594569e86eeb91c13ce59c77c67313a4f
SSDEEP 768:PFQx3lwgDwD/xsOW773njtNkONXyer1IRCzni9LPi9PG:Sx3voakSIqn8PB
TLSH
T17D1327F194D79A37D8AE9787A33D2E429EBCD063B4848590BBD55E0CCC8257FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c4b8804c578d54e6c10d8937f9078a2cae40b3ba858a4444eb69e420bad820b9
MD5 9ec005a8baeb0390e402a233505598fc
SHA1 409155cdd0a057406fa63e8335efaa7da6630665
SHA512 c5d96fe11a440c303f199b9a9bb356e416bf8d01e1928054fa096d5b856899afa4e8d0de81e8256aa26cb831f51c4110aa1b2158a7d5a09bdba119b1244754b2
SSDEEP 768:frv+4UNbdy39fM/TBOW773njtSONXyer1IRCzni9LeVH1SK3:fbsb03aOSIqn8EH1R
TLSH
T10F13BF31A4A9DE334CE2A3D5B14777837FB820A7C5844B90E9E61F4D099B99E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0a3ab41b416d674ea066d0fbe641d03181c0371262ca384bcc4bac7d4c7f2a33
MD5 7cebfac284a445c637d77aa21b151597
SHA1 1e9da4be9ca44e6e5e5d2b47ae64c1031abdbab5
SHA512 a9b9bae6ddb00bd41650dc64b34af044e9b75f4580fe2a19a25355778eb7fb3a9dd11f800f1ae443d59ac0809f199f650885818e1247b35706b3bdb553edbdb1
SSDEEP 768:erv+4UNbd53hHM/TBOW773njtSONXyer1IRCzni9LeVH1SK3:ebsbX3eOSIqn8EH1R
TLSH
T1D713BF31A4A9DE334CE2A3D5B14777837FB820A7C5844B50E9E61F4E099B99E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df2e87dddeec4c7f0bbd53e37e945bd8c09b710ed1c0e1c858a838f0f5f03950
MD5 b4b2743b231ca2b9f263627f9d0f7675
SHA1 486cc64b96318dfd5bd433b221a44d57524eb874
SHA512 3d8eb888b39d8f7dc1df41eb30f231c440779acf5c87f06fcbb1963744872442102532c5e0b005efd6a5b3495d4bb2ccb88557ba8dffb9ecc947ff357eb81ba5
SSDEEP 768:yX3p/M/TBOW773njtSONXyer1IRCzni9LPi9PG:yX32OSIqn8PB
TLSH
T1B3F2AF30A4959E234CE6F7D6B6463743BEF820A7E4C44A50EAE99B0D05C795E170F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e2eceb1b8f81f1fb4bc306b2fc73fd0ba7a4733bf890164e6322f4de62b3222
MD5 9f748da37898ddd5b282ed20d0a4daad
SHA1 e28931ef5f79545f7a80ab33bd3c6ed488e56a0c
SHA512 af896770c54b4e2c81387f47231f5e76acc774735d25519d7aa8d37bfde562e57e43db5f9ded85192a2d6b2d8d4c13aea252da4f72d2e9213515a1b19275629d
SSDEEP 768:yc3b7M/TBOW773njtSONXyer1IRCzni9LPi9PG:yc38OSIqn8PB
TLSH
T19FF2AF30A4959E234CE6F7D6B6463743BEF810A7E4C44A50EAE99B0D05C795E170F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

72a37f31-f7f7-4891-b57d-8dced029aef2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\72a37f31-f7f7-4891-b57d-8dced029aef2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\VideoPad-3472-1\Installer.exe
Size 7.1MB
SHA256 aea4e5627c5b45d0c28a02e40028e6322903f0ec44d5027e15c2ccfacd0825ea
MD5 6346c191386f4c7a0ade367cd9a6ac4d
SHA1 4d335344973b21f1a3a9f6dd2f379d03e075942c
SHA512 9a7f2306235e3c5bb7b2e86ce709db6438d2c524e891020e7ca0b35c688107b23bb919118777e08945168d138ee0107e45dd8f7b67e2962f9cb9202b012ea1a1
SSDEEP 196608:vjTcbOCByeLG9xCZLoilDr5B/TSkUDGunA426T+lzlk8m:vj2hLLEAdDfsDGunE6iZlLm
TLSH
T1A9763338E18D8A8EFEB9CA32EAD74ED6CC6ABC6945E7B5D77900981C36C4708441C71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.cab
Size 506KB
SHA256 ed50d8428808e95b008f54e53247325dc5a4b2af338ba971997364ea2c391c49
MD5 7defff3fbd8f63c8a522b8c680475390
SHA1 d03f7cb06c1ed72694a2fcfe3d462170ab7d71bc
SHA512 1645be18ee30d89399831517b933b75727b73df0fd36af3a7a8802de45b5026a7fd2ff1c2714076be22261fb595b79c879262e91b1ae0e0dc6e6b2695f0aca3f
SSDEEP 12288:+PGAJmyq283lJ07wMk1v8LResLI1j0DJiM50Y17GvSXFsSUu9yvABXcNOdVXtud:++AJmvJ08Mk1v8LR/88iy0eUSVsQoIB6
TLSH
T15EB42336C58C399FD6E78934F057EAF749A07439437A3512ABC27592DBE2460387E288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.cab
Size 6.6MB
SHA256 1031c86b92dba83b803aee4fc432686eddedb6753a6c7996d07072f231c4e3bc
MD5 532d313115ed3e9f6a239a5d504d0c83
SHA1 9993996e36e6e6eaa2cbf1c4003952b4bbce93b7
SHA512 45701f9eacb467b4730a98e3e28fd41ddba2c04a33e9e1495663ea8626ee1a22af14e6af698ae2572f6f4a6aac40fa37f1d0cc3a1f4181c336d7b19b36c8ade8
SSDEEP 196608:4OCByeLG9xCZLoilDr5B/TSkUDGunA426T+lzlk8L:4hLLEAdDfsDGunE6iZlLL
TLSH
T1A7663338B18E878AFE78DA33DAD70EC9CC6AAE9945E775D76C00982C35C4749841C71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
Size 16.7MB
SHA256 0a9e55a67af125cd841828f258db6aa42484cee620de0d0590f4e77489406577
MD5 5f2372d220cd9c1ace2d49416b91bd49
SHA1 77aed2d5af74904c716d3db1b473452a1d1fb71f
SHA512 885002f56689f7fee6fc520ee3f919cf7b6ee7e6b4b23588b8585cb27140cf878b3679d073347076734d495a42193c0373e202ea7f2cd1cac63352ef655fdb47
SSDEEP 196608:Lr9aEW1kbwrmE8pLIzcAUbY5JsSwrRv5W9j4yvTFm9BluFBJt:LRxbBoTMvRvQF4ZB4jJt
TLSH
T1EF078B02FB869175C89F16B088AB7265A336BD0547F142F3E7683E1BE935BC32835395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.cab
Size 506KB
SHA256 9a471fad0f0b5b644a810f5f164d9276ca15788cf5d9f40a32f23eec7f40bdda
MD5 2df4984bd4a3848ddf5a9b6106521a09
SHA1 c46e97641c0f7d73248308df77676a62278f9785
SHA512 625bf2af35c3016f179ae79171c874c7721d11765e2960594c72848506be60e4e18afaac592b14939aaa32f9043bed5d9ca76c260cd1a7a60f267ba78702c273
SSDEEP 12288:mKEoXtarhwKBk3DJGM50Y1vgmmM3fbyvABXhNOIC/6i/:rEoXtarfBkFGy0OrmMeIBhMII
TLSH
T19BB4231BC04E611BF65D9E0598BBD1F93180243C91EF6605BAC17ABE976607730BB32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.cab
Size 8.0MB
SHA256 bbac0e7fbde253718e57825be02a13c12dde558697b5365d7fc3d6059429c725
MD5 9615945415723c66c56b03c884f8f36c
SHA1 e6169e246c0eaea22684338703f1c8d985bda355
SHA512 ca010ed4660d39fb7695faf4bbc445c0adeb4e9eb4db078bc2df7a46efbd4e5c348457e1fbcef9cc5888b01a415f02857b3a0ff0ed3ba7c20133dd4793ddb2c1
SSDEEP 196608:KZIfi65Zhxx/jvFYuxtkSrA8tR/2mjr9iVNJhxoAluuHWmj0fTaYE:8IK65vDjdRiSD52mPuNriAP0fWd
TLSH
T1CC8633B837E6A56FE16240FDAD664E15D10C439949EA163FBFF886D44A202CC25F1C3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
Size 15.1MB
SHA256 d9361e74948ae8c1c66a8756182c27404cb516820bad9e02256a29a7491d81c4
MD5 59511757f0ea09b5c9987da30dc6986d
SHA1 a1bd434bd3bcdbed3cb1447f26f63fcefd4a8f04
SHA512 28c8c7e154fca9b13ccdfdbc4fba0f6269f27bfb93b49eeb544224151aa23c9e4ade2eac1aee331e03de0f083689a99a6b9a3088fd899fb08c21de35dabfec2f
SSDEEP 196608:PAUSd7P2dGBSjc0qDjOxnkKPEw9usSwrJMjcO4oTDDEDa6FA:PGdmc/O9PEaJMYEHD+a6u
TLSH
T1B0F67B02FBC58175D8AF26B048AB7269A235BD0087F582F7D7643D1BED74BC26834396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3460_1120458300\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads