hxxps://openmacro[.]net/api/v1/swift/download

Analysis

user interaction
yes
max time kernel
313s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://openmacro.net/api/v1/swift/download
Sample260816-se18ns1amd

Score

8^/10

discovery execution installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	2296	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
4120	Swift-Setup.exe
1352	Swift-Setup.tmp
3284	Swift-ManifestVerifier.exe
3584	Launcher.exe
4032	Swift.exe

Loads dropped DLL 3 IoCs

pid	Process
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
137	discord.com
138	discord.com
140	discord.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4812	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2432	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift-Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift-Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2296	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0002000000023225-162.dat	innosetup
behavioral1/memory/4120-173-0x0000000000720000-0x0000000000806000-memory.dmp	innosetup
behavioral1/memory/4120-223-0x0000000000720000-0x0000000000806000-memory.dmp	innosetup
behavioral1/memory/4120-296-0x0000000000720000-0x0000000000806000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Swift.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Swift.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Swift.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Swift.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313661986187603"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{F2BE7EE9-A96D-4C19-ADF2-885982DA838D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{92F7CBA8-477C-42A9-ACCF-A50E17CF0DF5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1352	Swift-Setup.tmp
1352	Swift-Setup.tmp
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	3584	Launcher.exe
Token: SeDebugPrivilege	4032	Swift.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
1352	Swift-Setup.tmp
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe
4032	Swift.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	Swift.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4464	4492	msedge.exe	85
PID 4492 wrote to memory of 4420	4492	msedge.exe	87
PID 4492 wrote to memory of 2296	4492	msedge.exe	88
PID 4492 wrote to memory of 4420	4492	msedge.exe	87
PID 4492 wrote to memory of 4420	4492	msedge.exe	87
PID 4492 wrote to memory of 2696	4492	msedge.exe	89
PID 4492 wrote to memory of 2696	4492	msedge.exe	89
PID 4492 wrote to memory of 3252	4492	msedge.exe	90
PID 4492 wrote to memory of 3252	4492	msedge.exe	90
PID 4492 wrote to memory of 3252	4492	msedge.exe	90
PID 4492 wrote to memory of 2608	4492	msedge.exe	91
PID 4492 wrote to memory of 2608	4492	msedge.exe	91
PID 4492 wrote to memory of 2608	4492	msedge.exe	91
PID 4492 wrote to memory of 4944	4492	msedge.exe	92
PID 4492 wrote to memory of 4944	4492	msedge.exe	92
PID 4492 wrote to memory of 4944	4492	msedge.exe	92
PID 4492 wrote to memory of 3584	4492	msedge.exe	93
PID 4492 wrote to memory of 3584	4492	msedge.exe	93
PID 4492 wrote to memory of 3584	4492	msedge.exe	93
PID 4492 wrote to memory of 1196	4492	msedge.exe	96
PID 4492 wrote to memory of 4764	4492	msedge.exe	97
PID 4492 wrote to memory of 1196	4492	msedge.exe	96
PID 4492 wrote to memory of 4764	4492	msedge.exe	97
PID 4492 wrote to memory of 1448	4492	msedge.exe	98
PID 4492 wrote to memory of 4284	4492	msedge.exe	99
PID 4492 wrote to memory of 1448	4492	msedge.exe	98
PID 4492 wrote to memory of 1448	4492	msedge.exe	98
PID 4492 wrote to memory of 4284	4492	msedge.exe	99
PID 4492 wrote to memory of 3720	4492	msedge.exe	100
PID 4492 wrote to memory of 4940	4492	msedge.exe	103
PID 4492 wrote to memory of 4120	4492	msedge.exe	104
PID 4120 wrote to memory of 1352	4120	Swift-Setup.exe	106
PID 1352 wrote to memory of 388	1352	Swift-Setup.tmp	109
PID 388 wrote to memory of 4812	388	cmd.exe	111
PID 388 wrote to memory of 3384	388	cmd.exe	112
PID 1352 wrote to memory of 3284	1352	Swift-Setup.tmp	116
PID 1352 wrote to memory of 2432	1352	Swift-Setup.tmp	118
PID 1352 wrote to memory of 3584	1352	Swift-Setup.tmp	121
PID 3584 wrote to memory of 4032	3584	Launcher.exe	122
PID 4492 wrote to memory of 2680	4492	msedge.exe	123
PID 4492 wrote to memory of 5116	4492	msedge.exe	124
PID 4492 wrote to memory of 1916	4492	msedge.exe	125
PID 4492 wrote to memory of 5968	4492	msedge.exe	139
PID 4492 wrote to memory of 5968	4492	msedge.exe	139
PID 4492 wrote to memory of 6076	4492	msedge.exe	140
PID 4492 wrote to memory of 6076	4492	msedge.exe	140
PID 4492 wrote to memory of 1820	4492	msedge.exe	143
PID 4492 wrote to memory of 1820	4492	msedge.exe	143
PID 4032 wrote to memory of 680	4032	Swift.exe	144
PID 680 wrote to memory of 1568	680	msedge.exe	145
PID 4492 wrote to memory of 5708	4492	msedge.exe	146
PID 4492 wrote to memory of 5708	4492	msedge.exe	146
PID 4492 wrote to memory of 5708	4492	msedge.exe	146
PID 4492 wrote to memory of 5868	4492	msedge.exe	147
PID 4492 wrote to memory of 5868	4492	msedge.exe	147
PID 4492 wrote to memory of 5868	4492	msedge.exe	147
PID 4492 wrote to memory of 5924	4492	msedge.exe	148
PID 4492 wrote to memory of 5220	4492	msedge.exe	149
PID 4492 wrote to memory of 5220	4492	msedge.exe	149
PID 4492 wrote to memory of 6460	4492	msedge.exe	155
PID 4492 wrote to memory of 7056	4492	msedge.exe	159
PID 4492 wrote to memory of 7056	4492	msedge.exe	159
PID 4492 wrote to memory of 7056	4492	msedge.exe	159
PID 4492 wrote to memory of 1248	4492	msedge.exe	160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://openmacro.net/api/v1/swift/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff929a2c188,0x7ff929a2c194,0x7ff929a2c1a0
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,15144925274792761114,9883292228724959309,262144 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1884,i,6494282801011156199,12571940480770581929,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2336,i,13698598349298692741,14955607418948344002,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17525124204404761418,6245213673255039424,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13943775199942875934,9662057311868435112,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,15242310309288391671,11963009754801426987,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14533926139038702249,14886897116810309577,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3596,i,11964674536257220970,13559340101820844360,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5076,i,10309226425869718791,14422011121414663463,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5596,i,9940558674750635283,17856731190596171089,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5452,i,15384617131504704429,8295476319935348939,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5080,i,2336792327718977576,17986302404480901354,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6216,i,5696062271003645123,7675315919982517245,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6216,i,5696062271003645123,7675315919982517245,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4940
- C:\Users\Admin\Downloads\Swift-Setup.exe
  "C:\Users\Admin\Downloads\Swift-Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\is-S4547TIJE7.tmp\Swift-Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-S4547TIJE7.tmp\Swift-Setup.tmp" /SL5="$E0230,1426477,883712,C:\Users\Admin\Downloads\Swift-Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tasklist /FI "IMAGENAME eq Launcher.exe" /NH 2>nul | findstr /I /C:"Launcher.exe" >nul 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Launcher.exe" /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
    - - C:\Windows\system32\findstr.exe
        
        findstr /I /C:"Launcher.exe"
        5⤵
        
        PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\Swift-ManifestVerifier.exe
      "C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\Swift-ManifestVerifier.exe" "C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\manifest.json" "C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\manifest.sig"
      4⤵
      Executes dropped EXE
      PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\full.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Swift' -Force -ErrorAction Stop; exit 0 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2432
  - - C:\Users\Admin\AppData\Local\Swift\Launcher.exe
      "C:\Users\Admin\AppData\Local\Swift\Launcher.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Users\Admin\AppData\Local\Swift\Swift.exe
        
        "C:\Users\Admin\AppData\Local\Swift\Swift.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://openmacro.net/api/v2/swift/auth/discord
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://openmacro.net/api/v2/swift/auth/discord
        7⤵
        
        PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=760,i,17754783696682663389,4323283254919694441,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=756,i,6965351771642806720,4867164031650325675,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3640,i,1790091358287468156,5232636660016953418,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5360,i,10136988868027546584,362937510644894177,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6444,i,7079971091723497484,14733243973728004072,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4176,i,6601452705683638083,2766124282047723298,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6544,i,9541511952396222851,6740189313660550576,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4376,i,15611852171235467511,17024597311729991654,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5780,i,14314703158632755208,9024190444771840046,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5796,i,2705999662042002111,15218246708946063248,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7652,i,7738569561819957416,1038439258340708122,262144 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:8
  2⤵
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7076,i,12965080423124358664,11041619074441215485,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7040,i,16806053782039337216,8241977551186002229,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5520,i,1305487755459895080,880420347613013300,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5252,i,2656396491237896606,8414780321384866467,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7760,i,7131348932857493924,14831224644061930497,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4340,i,8678226152236296040,9040453218149014851,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:6796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7668,i,9516063778683934762,17169383049945502111,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:6928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3480,i,11966201521111012452,7235155843509464874,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7288,i,5214936661010178868,6208979172427190196,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3496,i,10208415972180568344,1448920375320075386,2097152 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5244,i,13839000528728293439,11799550962859032735,524288 --field-trial-handle=2644,i,16367986685344238951,10335286502474994716,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7fea608921203501a32578700c621171014c39e7f04c689721b0273231fb7a5f
MD5 4e09ea0f719ca97c7b586b8e5f4d33a6
SHA1 41cd00b43529d6db5a55ee3d9c51701969b4ae7f
SHA512 959b767f8802a57cc6718b453cfb6eeafdf5379bee04e4db88bc742c90eecbc3233883deaccfe96dc2c0e83d6dbcb393b791c5666948b6c327c2f22803e8fa66
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 22d17d539d115717ac62debea332727f584f000b9f1b8aae8455135af8d6e2fd
MD5 0600bbd991166e421d9c642661582bf5
SHA1 0a72a84074ec4fc353d603c7bc8fe752af92a116
SHA512 eee80414099ff09c2d72ab84c82feda9f7cebe9a50d20cadbae76eb2800417f25c7893619442ba52ca445beb1a6d9f86102e13d566bcacf1a7ed787430d89cdc
TLSH
T1BBE020555EC2E7560F5F96C7A0C8B3B7419D7346F66CE45D33447146DC449008346481
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d64ed63ac83d1eecc8ef06cb28622e4ee10d814fba12056285396ece4afd8201
MD5 7bdf20dbc7ad12c0cddb28e865d7f41c
SHA1 17fbf63a1c5932037a4f4152a35e6dd5ed63363f
SHA512 7ceedf8362081fd4f39e30f5769423746810155277347f413f154d6f9c0b50a8f775c6a15f98d850784f82dd90c53e32241a88f0691a3a535b6e8238ded84339
TLSH
T18EE07DC404CACAAE9B90A6C7D17C534DD381370EFACAFA3A1708A4C4F405A40A3EF5D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cf92d2dfd2a40c99d3eb54f1e09f1af0e7977b102e934584e8c0f40b4f8f8466
MD5 d2a07b5807660331b39df84f3cfe57d0
SHA1 8acf3c964242ca12b9f03c5ed0515709bddbf3fe
SHA512 c42b11801269db452d55afe4ec73c5fd8d767bba282f50f6455e30cb81b60ddb9c01abb817800711f7c6efad1685eb673d778db39940f331a7d50523233d515d
TLSH
T1F5E020C405C6C25DD96475CB6278574C41803B0BE2C4B9F527008D44F141D40E3D35F4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 86705732eb740c5f8645ab99a6d130a4566e1a7572afb53315810b35d2d666e0
MD5 5791298fcd6799421a2647daff4ba492
SHA1 3a9867630d5740e0a1df72467885e856ef82c4f3
SHA512 024111995c848dd600b7404e8c3c9568f62a4acb5f623fdafad4d521159204ef684cefc7fb5870f04e03622a642a321bb109c5370ea4bdb1aa4caf7b549aa4ad
SSDEEP 192:ekgO1zSlApq0yIi5zxaP+w/OA7kaF2N4XoVGhVQ+:1gO1jbyIihxsCkF2NQyUV
TLSH
T1730279821F4B3C72FF8F19F4E8C9B615B4B98A5129472F823708ACBD40EB7D2645650B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78d37ccfcba32676a70e791abef93cfc496b9dca201a9be6f0374dbf6ad45092
MD5 30fe2f81d0d964c34ac56e11e1bb4c93
SHA1 436319e487aacafb41c7f3cf127ab9dd14f7313b
SHA512 5eafe84ab0d4c837b5e93fbe3f4ff9912b31c8d737c774330215959a0a54f7daa8fe5eadbcd9c62b88c1d8cbcc25febb54d5c536f385a73bab6be4fb9469862e
TLSH
T1D1714C4211567C77EBDA0AF1F4CD4209B8F1CEA50E531FD5155CB8BD9827B63809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 ccf24576f43544897f5219bed2f5c0c8a8ea6187c83c627fd09516265304dbb9
MD5 51516a8c4d347c378bcf90533f0b9c37
SHA1 8359a9f9a52e028e4619701a8fbfababed104b8e
SHA512 bce0a3b1701c0f82a77b9d101f3f0899468e73f268e3c19a10ab5c609983a6fd1a1514011a45f505042e8c754140c2b39d33e6ee06596c83224232c47b9a34a1
SSDEEP 192:Ukgg1zSlAuq0yIi5zxaP+w/OA7kaFhYlGHQc:3gg1jMyIihxsCkFc8
TLSH
T16C0269825F5B3872FF8F19F5E8C9B615B4B88A5129872F81370CACBD40EB7D2605650B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 bdf4106544a3a6bd4f5871988951cf2a5f0e08963795d93f21d754e61fa4ae05
MD5 3e8922d7c2222b9c756c403c055eb123
SHA1 9fec9acac3f9091400a50849ea169e91f628a1fd
SHA512 f3c6d9491b05f76f694a851859fd546db7d09177ea2a1c9f9fc1ad1df69fbbfc282925e2d78e30ef27d902c07e793c8da9db2296ff43e03b148c61fc09ae70b2
SSDEEP 192:wkgO1zSlApq0yIk5zxaP+w/OA7kaF26XoVGhVQE:jgO1jbyIkhxsCkF22yUL
TLSH
T1AB027A825F4B3872FF8F19F4E8C9B615B4B98A5129872F82370CACBD40EB7D2545650B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 9d5609183308fb8954482c37f08f72bf10b1bb2b1f679172d1bb9b14047892cd
MD5 6c70bc0ed674a6a53febff58bb8844e2
SHA1 4b9059b59fd970de3a770fb2ce787e4aaef0e9fe
SHA512 4de57ea3b09f16eda1e40c9e114cdcb10a14dfa278f1706cf1410931e67be5f975cd824ed4a92e2cb41c648e13d841dd3a0ab77a288ad9b1c11e0c44a676979b
SSDEEP 192:79tAdgWbqFV/q0/jimAxRCs7dX3OJ7faOskG9CRQG:HAdgWOj/jiFxb78wO/GEt
TLSH
T10012AB831F0B78F2FFDA2AB0E8D8A245B4F58967195B2F81334C6C7C50977D2648252B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ffe7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ffe7.TMP
Size 3KB
SHA256 02cc5596b049388a117e80e7f70d2bfe056c2f352ba0d0ba26041aa4fdae0ccc
MD5 eb5e1defb6697cb0e391150b6b30b108
SHA1 d5e163949a1f1ca545619ac7e2c1ed50c31c8d21
SHA512 2419b94008cab2b8d974babe279b43f5859737eda13e53c7b6bfa26f25c17d1d6063860d513bfc253af6db9113bb47648af412a266df154d14b28f4354729abf
TLSH
T15D714C4611567C77EBDA0AF1F4CD4209B8F1CEA50E531FD6155CB8BD9827B23809A60B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5f75e7dd7f1d079ca3d55e068019fc499f8afcd96aa56bc81ab1a50429432532
MD5 3bb00900d5577a11c930ef1f5382e157
SHA1 215f7a52a5b4127610271aa500207a6e05758bc5
SHA512 26a1aa7d0845316a663c2d8ad068fdd10fd7334744d9d218c43bcceeee34eaa61ff5a2ac0aaf56cedc9b391940718f60920b52ec84b845babdc376b55df074d5
TLSH
T15A215AF2C7E58A6EC9111AF05A24AE2BCE1D0A0542283C16D9D8FF5BD3E3476E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fa65a1f5b151111977eca273936d5c3fe2822595c71a40c9417692ea30de178f
MD5 c3950b0e77f0b4fb6b07d500df58ba8d
SHA1 c509a0ca8929f73bb3f19c50e4058b4464f49a47
SHA512 c59982b4698f12040b82e708874964e3f14f801fc9cc27d5ba806691fbfe46643d4579e5b2f3801a6ef3b601ae7689a818c8e9d0ecf51a7f01df780f7049efda
SSDEEP 96:DA7cbOutuYuEuuuwuyudzBwVA7SIWuFoulju6Xuz1uCKGuyubud:DlCEjNvBbi1MvIWuoKjReQGvM+
TLSH
T19DA198F3C7D8836DD91116F45A287E1ECE2D1D5443283C2AC9D9EF4B97E2172E181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73da0d4dca908860d9cdf14c39164d742304116af0f3eb57418bce2659adc6af
MD5 4f60d02b8dac30f6baaa60fa13a57fca
SHA1 67c35ab19740e9224ff3a79adbb15f24c9daf829
SHA512 9a89f2ea5643eb5e0fbed00b006622075cc28ff45e4c07ad9c5d433b9296f97f1410543c6c1e0fe267aedbaa16a7158cc2365d9db8cfd83bd49c2ec998d716eb
TLSH
T1214179F3C7E4866DC91156F09A24AE2FCE1D095543283C2AC9D8EF5B93E3472E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3ab11943450356f74a2f1a9899a715f6962884c1af29c408ea46519cb3ddbb1f
MD5 8854eeb220ef5f8edb9c94e02d1d269c
SHA1 865c45d74c31a78f3309914570059af08f1f7c35
SHA512 464ce963e5821d832a73f7db755041fc5a342c53f581967454b04f8370b67d652503aa36af93c25d878563eeb3fd8e4d311abdd1f4dfaf9c3270c24a624bd24f
SSDEEP 192:sxZgWRmyM/jK1Ml8M9K/fSsNtOurIdpJHW6+WNGY4k5RD6IgrJ:sxZzk1K/fSsNYu0JHbGA+9
TLSH
T16F42E711AA346977CCDBD209FA55BF53D6F81473A2900D54ADFCDA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10cb9faa3fc8255780c3a2b9671d91f8e3c1e3e97850a9d9bb6437f2964aec95
MD5 d3499051daa81993d51235d2aea95284
SHA1 233b53c4ca0cdd63dfd58be93f6f001c38b2af66
SHA512 b8d6a7aa0a740f670313f97c3233fecc1e5abc59bf97dd346dbc1d6ffba8da4b29ae774f510f64ab9474ce4367e4a70b324b625bd97be8dc2fe9dc643557f649
SSDEEP 192:sxZgWRmyM/jK1Ml8M9K/fSsotO6GIdp+FHW6+WNz/E/Y4YZRD6Ig5GJ:sxZzU1K/fSsoY6nuHbw/I+0
TLSH
T10852E852AA345AB7DCDBE209F951BF53D6F51472D2900E44AEFCCA1C04E6ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09044a4dc5354fcc9951d3c9fd46cbf866fca826bc3e1eb710865f995fe34779
MD5 7143009af58ef2d987fde288865901ac
SHA1 54c269bf06031554f2b76c8e54d179900d5a05b2
SHA512 a77f44c1f84d07bca6d9776651711e73973c769527bb454926e80d955e591ca08a802d821b86af6803a9104a87a10a37b0a45581a270d4e0f9cafa30a99696b5
SSDEEP 192:sxZgWRmyMojK1Ml8UQh9K/fSsotO6GIdp+FHW6+WNz1zZY46ZRD6Ig5GJ:sxZzTqjK/fSsoY6nuHbtZa+0
TLSH
T14152E952AA345977DCDBE209F991BF53D6F4147292900E44AEFCDA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a89a298cf2d728b6a3d7f261b1d5813afef4447aab79c129f1a01229e2c0f91e
MD5 baf6bc7d4fe4f730f2c72b275df72e34
SHA1 2211322cc52d391abb6eb32aaa5400284ebf6ff0
SHA512 3fa0a4b40a2b30fb23ea7c3b36c18ebdd9f6bcfc16e796d3cd3e29a3a502b40f84e6d7e1b7eedd481cb61878675d01a8471075d4b826f0a86ded24a846203e42
SSDEEP 192:sxZgARmyMojK1Ml8UQh9K/fSsotO6GIdp+FHW6+WNzB5TY4ysRD6Ig5GJ:sxZFTqjK/fSsoY6nuHbvTR+0
TLSH
T11E52E852AA345AB7DCDBE20DF995BF53D6F4147292900D44AEFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6353caaba9ee61ac2db7449f2f645f00c8f16cdbf59ae93df9fe149465314a17
MD5 d1f3a7b0b2d1375778c78c9416e7d042
SHA1 ef6733f70a4749e58f13afde7191dfbcc7f07a10
SHA512 fd97c0c59a54db6a4f3799a1d015b6eb3c93ec2eb11ff768d7a0a1a70195c0cfe073c71316abc640bd4192f7120e387dc147865b02e12a8301c7cd43ec61e05f
SSDEEP 192:sxZgCRmyMojK1Ml8UQh9K/fSsotO1GIdpRFHW6+WNz+61Y4UsRD6Ig5GJ:sxZzTqjK/fSsoY1nHHbr1z+0
TLSH
T16852D752AA345977DCDBE20DB981BF53D6F8147292900E44AEFCDA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 15a29c26659e4dd4efc468bb9cfb9fc1aca04a1539b4dc5f1199f0add307730a
MD5 134af8307c28610050e9c1a1a6214e1e
SHA1 479ccd03e8369343b61d46297c5f419701f8ec20
SHA512 f5f091820a3447558d124b1c02acf7a6e789589488177b989a86724e2ba9671b3e9ccdb7aea4c08dc68467bd8347ed0257b98bd7abab1f5912a22485f5ec1981
SSDEEP 768:MW8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdzroWkGUnz:MW8iJPNWvx76ru1jahALocdA4Uz
TLSH
T1B4D20A3B680CCB7E4F844E9CEC266F966ED801CB5B944D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\38a01118-19cd-45b5-9bda-fdf25d94d4d8\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 2c6dbafaefb0b72742045092d1c6b02e0387fe5d9ea63be5852736b002e6c74d
MD5 6fa3d0f5d94927982556e68df5be857b
SHA1 7e2fe179272aae889ac613741711105310d8e0cf
SHA512 8c1d31ddd0919378d01b466d4e993679b5c680b78bf4e91bae5f51edf6b3ebbe222eaa66a6def99f8ee37204098291723bfbeff95adc1e2a973a2b35db750c46
TLSH
T11FD0A7BFE0560864E777DBA2C56A529D87236C8825AD9449E102292E18B0A43E623F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 e50a770536cb81b4e56d9d86af9b17e767bcd6c3de9448289caa36043cd83c71
MD5 21c33579fd6da8a9ea1331bceca16feb
SHA1 994f704fdedf096d01107364547e1e10eb03d8cd
SHA512 319fd40a357074bbc852b294f18e5e60eb89dcc23a2b9b4f3a9a2565b80e3d73bfe6ada53d466f0ea99e264ba8f583396ff541c0970646547ff3b2097bd2d6cb
TLSH
T1BAD0A7BFE0590964A77BDFA1C55A53AD87236C8820BD9449A142092E4880A53A613F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a3588.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a3588.TMP
Size 138B
SHA256 25f4dc6915f7aadb342cf8837aa3f2e652508cb6bfa9145fd09f371ce9958620
MD5 9c692bd9311b03bd31f87dd018a3b042
SHA1 c0af6030e2fda1eccc7b788e6d82b54f0dcdb2fd
SHA512 3da20113a014301d0822f0322ea80a1c248f510af186483c4a419490026bd2be7629cb5ef1db0f918eada394d7fc7abe85f3c9857e21ee6fae0214e64e4e32d2
TLSH
T14CC08CF3F10408148719DB52822A518D47032CCC58C9C84AB102311824B0A13B202EA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 16529cb145eb81145296e88ae2c76adc1e48750f88f93b61a6474a082605d7c9
MD5 873d941d9dab5fcda33a36d47fbcf144
SHA1 2e90659a19b93031315a9aa8112926ec76511f2e
SHA512 8499700d6d485c5846807d2512183c17ed13bd23fb488e751b8eddb2aa87c98079d46a56209f704774684f13a3ffa7aa9b50721272362504b4490ddafb6d6510
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdG2kAKhSqmz:DvmbPVddItkfvvLFRU3v8B/fpGnW
TLSH
T19A91854236BF02822D7F2508D1998B67A79235733024E52F37AE01715EA6E250DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 1b11ee0be66705bde7b205c97bd9b1632dcd95ddb688744291b4a60e6f011b63
MD5 f22761bd0de3a22fe7bbd272ca8cf249
SHA1 8103c187cceda8710145922b5e1d56260e07f827
SHA512 e39d3606f1685cba05363f6ff76cb0b67ec928af17b2c0bb274e964e1f73652da49b5709967bf172383fd24cda51d75d0bd2d2b1dff19169b2970df65db2a6ba
TLSH
T11CC08C7790A985E53FB924EB114632C8CA3A7FDC9CC0EB4C88223028323087B5104A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b52a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5b52a1.TMP
Size 178B
SHA256 9fb88c46236de2ec0e6d8432cd90d3c8d228bec883752bfdac1cf7af9ffe83e3
MD5 45d31b6d6d69e0e4510aad74bba4624f
SHA1 f93f62ce6235c08ba758049acc4ff1aab5271203
SHA512 f65b508a64ba3318c2f17079cdd932c6965946cd568c783c7eaa1880bdda67f5b556824bc60ca3cb8c57390cddd38cb917159d74359791bba8a45509a5b16a8f
TLSH
T156C012770092AAE12E6528FA115632DCCAA63FC84D889A4C442230892A348AF2500960
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599bf8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599bf8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 18d22e3dacd84b82c8fbc472c84b956b7eb02f5e7525d5e03d9d07a391ef57cd
MD5 ef61156b3d2d581272aaec37fed3ea56
SHA1 8607b1267425110fa6b60b1e651d6ef70b66e8a0
SHA512 3a53c1a22d6679a1a4341a892a7438dc39a7bc9c250057517e8742382c38c7e2e73149cfed61b1276710fdc95bcd895878c7dcc97bbb8819c3958a66cf2a0d37
SSDEEP 384:DZcI/sNhQoky6ik9ukBgklBOOPrXLpe8C/btU:b/NBtBOi9PutU
TLSH
T1C3929E71AC782C677DE7EA45F48337175EF49167F3C82B9495ECAB0C05DA268030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 88e9445c4a6baeaf639ef212ef4f04837f4694c318c2b3462560ead07d90c063
MD5 188b6258208e258a85dca2427287f138
SHA1 e36f6e377529e591978c7636c6ea7fb8d5c4c360
SHA512 c79519c4e548a5c732493c70abf08abc8108a663ff6cf5576ec17f655358e26a56d63ef5a28f8fd9751a9cb733f943224e5482efc4005bfd288d43c13e5a3ac5
SSDEEP 384:FZcIysNhsoky6Gk9ukBgkMBOOPrXLpe8C/btU:9yNVkBOi9PutU
TLSH
T10E928E71AC782C677DE7EA45F48737179EF49163F7C82B9495ECAB0C05DA268030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8694b8db84109ff3e5fc29344c5e2af7298de043280111532f29cb7a8ed22389
MD5 0cc11a5beac2a10fd4c2f3a2b250ab48
SHA1 53973ae0e2c65c9cc0d10188334b690c937c84db
SHA512 2e2a0ee6b3028852e3906645ff136f2e08312247546fe462c445f8701f12968e8e3bdbbc080794c1f2696bd96e7a2b4fddcc7cba84b56f5415ec3108b882e653
SSDEEP 384:rZcI/sNhsoky6ik9ukBgklBOOPrXLpe8C/btU:z/NBtBOi9PutU
TLSH
T1EF929E71ACB82C677DE7EA45F48333179EF49167F7C82B9495ECAB0C05DA258030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a2853ea34f9f4c510743d209d2ebc8b35400ad33a340302dbf7b0707e9fb4c97
MD5 2a04393cdb8d400856fee8fdcf0dde1f
SHA1 29cb9b67f5d1b920836fd7a77d419de77e3cf97c
SHA512 e337472bb824b51a9b1764c3a3ed2403e3177a96c6e44576660090e48168b15a8470d753eed2933756dcf65d30db4248a3af636b6afe2d9595acd1dca88ee42f
SSDEEP 384:NiFPZcIXsNE8TUNTUlIlsoky6B/9P2kBgkDBOOPrXLpe8C/btU:EFHXrwgQ1pxBOi9PutU
TLSH
T1FFB27D729CA8996BBEB7DF45F58632178EF44163D6C4ABA4E6DC9A0C01D719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5cbb7bd33e142262039e3af5c90f29cd05a490a035e7c3465680374c5e734f1
MD5 c3d17e32397b99872c65a43f75bae947
SHA1 fb46da843974ed65ae875d49e4cac909f6693760
SHA512 5935f5c13b9dc9db78c16e4450403967f14539b92015c0eb0f7130322c5ef440f1935142c8553ea6bb08d90ebe9db45fcf89bfae941770f156fe913e31f311c5
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop515DhBhPwivh50xy0SFYK+AxADqQc:gONS6kDfQmiUyHXZ903SQiRFjU6
TLSH
T16802E9356C782CAB9EA3AE45F48737275FE5212BEAC52F94D9E81A1C40D724C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e5165ac295f4d317b7637a628e8549648739e7458e7e03c8c1ca2a4890ed84a5
MD5 30e2e98ebdb252893ba0099940c40f6e
SHA1 76b596c3c688b709ef506988495adcea96f5b6f9
SHA512 4634c956facb2542328c54b4515862105426aa62f4f64e4e137d0e99395ed2484176fe5cd92eadc8e17372cf7009441946f00d384176da4304fb9ac2488893fe
SSDEEP 384:NiFDZcIXsNE8TUNTUlIlsoky6V/9P2kBgkKBOOPrXLpe8C/btU:EFbXrwgQZpMBOi9PutU
TLSH
T158B27D729CA8996BBEF7DF45F58632178EF44163D6C4ABA4E6DC9A0C01D719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d0745afe7f1218d6a23e18250a6d904a4e6745e8fd0d2612e3a6c1358c6d97dc
MD5 73ad249ff6098c3599af310ae1b6451a
SHA1 a29b9f459d86a24663e42b80ccfb8762f235bdfc
SHA512 9be72c54041f9e9720874ff64026f5d7d8b99f261e83c1d5dd492c57cdc9c0fdfa1853450665962487c241368d47d0a84adece784fe5b21df828331cd02ba4de
SSDEEP 384:rZcIUsNhsoky6Gk9ukBgkMBOOPrXLpe8C/btU:zUNVkBOi9PutU
TLSH
T10F929E71AC782C677DE7EA45F48733079EF49123F7C82B9495ECAB0C05DA268030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 686ef1f22413a70d57737d26314cb196eb0ea737c5bea89c1425432bc00a78a0
MD5 13a23fcc1e157c184c61ccde33aa0cb9
SHA1 4aa9e49a0d1f86b593d96e99078559f5c08834fb
SHA512 425390a9b087b70d0ecc10c9ca2171c6185088fb65e83f80459eb4d8ea89f0c56abf405dbf28b5bb6fe040973aabbca0663b6e0b4cbeec0932500487175c575e
SSDEEP 96:8qONk8QsjpfmUTZK5ih/cIPURHl8h4otop51qDhBuPwivh50xy0SFYK+AxADERxp:nONM6kkQmiUyeXo903M6NkUcReqtU6
TLSH
T1B7123B3268B86C6B6DE3A951F08732175EA59227EBCD7F94D9DC2A1C04EF25C130B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 75c773bdda9e2cd2f30b57a28329d7cbb43a1a8b04011af3cf0da64eb06ebd55
MD5 2a3a972882fd128cdd2d4ddfdb2b484c
SHA1 c25fd38d86959fb8a0cf4a45e2740a781892dd25
SHA512 aa1c32be2ed044efb167a879d2dfb5f7fa3161804db7a163e118fad72d33b082088a548ff7049f1195a60fa098606910e27e278c2d0c1a29b88edfd932d049c2
SSDEEP 384:NiFFZcIUsNz8TUNTUlIlsoky6Gk9ukBgkJBOOPrXLpe8C/btU:EF9UuwgQVhBOi9PutU
TLSH
T1F5B27D729CA8996BBEB7DF45F58632078EF44163D6C4AB94E6DC9A0C01D719C030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 16af19737c2e5995c73f73038428196a3ab3c104b1f31b5d1bd21b33e0a375e2
MD5 cfc97da93ac517e7faddb53458e97e65
SHA1 3b9f20d63d4e3bdeadbfbf1284be356f8c9838b0
SHA512 16e8a0f3a3b163e101c1d44b26e44ee81527967c608737f3fb30dbdfb8c17739a8a0c4a193e7f75a49342ab30580c1bf15878bd443af1f461979dd95419aef43
TLSH
T154E00203D11400D5C01C1334018316A036E3801442B78255D95101643C137205D60B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d99d9769adac247fa9bf347edb454137e2573288a1da23083f3704d9c51b5aa
MD5 89e07e35cd93291dd9ad1c110101dd75
SHA1 5923b57fb7a61dd1222464c400b3a8650d8a251d
SHA512 d0a08e7845be733f2fb16a13f6382a5a45034b2d836aaaab37f575f22b50c29356ef4f6fa07d69dbf0695d5d05cbb173dce1872424d677770a5e175b6dc6fb76
TLSH
T1C9E00103D31400D5C05C133401871BA06AE3802442B682659A61056C3C637606D60B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 117509d3d884755badfecec128fb5533db0e29df36d0deb5bf094fb957291fee
MD5 c81f6f70b2fe6b225420b672a220ebac
SHA1 77096e1852838774e4e6ca8f16eafeb40728265b
SHA512 a8ab13b7dc0912d4429d5d438e4caacbc01e9e768741762b7d0498fdd8cb5b00f6086c245f14837e41b5c6c9cb999d092b3ad9bc92e87ab54c69413974de8860
TLSH
T10BE00403D31400C0C00C13340143175037D3C01441774355DD5101543C137305C10700
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a8241.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a8241.TMP
Size 392B
SHA256 f0f16df86b3a4febf66dbd241b056fee3ec0da1c503a956307da85ed989e0efa
MD5 6ef29c4a3511906c02118fe1f6af1d26
SHA1 b1fbccb11604bd6ef16305516091642d6c0d18fd
SHA512 9e0676601fa641ad84df4aeed8203e849d7e58f0b5c2328cd788691bbde66ce671afa3ce522a9e08f01958e9cd15dfbaff6def00476b8d547f269187eb8adc57
MD5 SHA1 SHA512

Submit Download

89fc11e6-3f29-4f1a-8cba-09505d66111d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89fc11e6-3f29-4f1a-8cba-09505d66111d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef0eb4b2ef1d2326a434fb675bca8b441b3cd6b4025e02bfea6f08abed441b25
MD5 bc1cd9dbcc1862897d445c3c7e0e7222
SHA1 e0b460d63cd11d9c4f3919b6121c9826e3dd6a4b
SHA512 8521c8f35a21cf09653802654da02602d4ec2fb5e7d0eec50b3309a71c35256bbadbe151ef49acd0dece60cf88a08b8249248f315497ec44dd31edf5531b6a13
TLSH
T11041175CA6F91148F3B77E5AABF6A9AD447FBC772F06919E00150D4F0A26A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Swift\Launcher.exe
Size 6.8MB
SHA256 beeb2a279722d6f1bbbce1a740c5121ab482c7a390f9c90d677a9d2f5ea8fb1f
MD5 d1f45e9f7b6db38195fea2392b03be8b
SHA1 ef0bc00f1477d41a3ec32c2c9070a5b3208630a5
SHA512 da5681b75a41b27b9eb659d646eb951eaae2ad4bb2d66376fb06863139b44ee61de51520078d839a2299d888e4726720fd7c3caee7ea4bf39e5e3c548c7e1611
SSDEEP 98304:4uifLZePoXy50k6WLlOJ6XD7pRDYBLMxw:4RfRXy504rD7pRDDxw
TLSH
T135769D15A3E900A9E52BDB34CA65C333DAB17C925735D64F0958F64A1F33A908F2F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swift.exe

Path C:\Users\Admin\AppData\Local\Swift\Swift.exe
Size 30.4MB
SHA256 aa666fd253ec416f4c9ed2f873fd32cc5ac4bcb6312c94eb196cc02d52d8bfec
MD5 1346de000d917d2e90a5ce63e1e752fc
SHA1 6a32fb6af5af8cf72b79f3472535b40ab20167cd
SHA512 ae3df46948bda2e6d2989cac24a163f6a44b9ec261be73df745ae81e5e2d2408031062478188e2253d66850107e87443d6761945548c61a1cb6c8f80fa3eada2
SSDEEP 393216:9BnCcmY63uCpgBjODqZJk3RrsNHxVmVw5Q4LCZlp/7tnDIXDVHP:DnEJOZZLCZlp/J8Bv
TLSH
T10367BF19A3E50971D42BEB38C611C333DAB0BCA65236C10F2D5DF54A1F77A614B6FA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Swift\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Swift\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
MD5 fdfc5facbb8d7ed52bcfeda911586cd6
SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
TLSH
T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Swift\libSkiaSharp.dll
Size 11.1MB
SHA256 6d6eca64ec333daed78858a637b54c545aa01558204b8e2ae8870692acada127
MD5 9f1deaee40e34c7c08952a3e5ebb3ca6
SHA1 36f50165a5688289bb3877b8f29a354c4d5fd458
SHA512 a5c9178ac02cda3feee7f8e1f26dce5cae247e6bb38ba596fc843d985636dc53a08cf20c9e3f4a8c542864f9dbb1d1d9f02cb7b9e879bbbd622219962df60a53
SSDEEP 98304:61DvlpF6Tf9V805SPZYjyPytfdn93P8bZaFcbNB/ezHL84dYTFffN6G:61DATjy6d38ZaFcbMn6TFfff
TLSH
T114C64B067A5A54ADC48AC4B4934B4967AD2034CB0B35BCEF41C596393FBABF42F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\Swift\logs\client.log
Size 881B
SHA256 e1a5cc452619f67634f652efbe95a57969875b56eb1dedec6d70986b1480c22f
MD5 66ae8756f4fd91b34341e322c114171c
SHA1 f32996c26061fc88e37a6ca6db6c0b97765da59d
SHA512 e45a78ffe328ff31fcf4ae8203078e193920f2cdba84ff5b9a83bdaffcc31e0b089535400d6644cd947dd86cf5c9862d5b8f712f098eba8c396d107569efd8bb
TLSH
T1E6113D041FAB6111CD5BCD46B5AC3B737452F162A20FE8BC2FA03C45CAC654B567D211
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\Swift\logs\client.log
Size 2KB
SHA256 b8659cd03d91d83563bb5bb40475b04c019a8256667388940291d6f014c1d956
MD5 37a55b12c0e1af68ef2de6eff91173bc
SHA1 10677abf8cf033df2b58515ad4f112134f2cad27
SHA512 926343cd75b7f43677e72220e400be98073b37af713011764f7794fa90cd338781cfa3407752dfda3b5689e64f4ba72201a896a5f11aea2210cb3288129ca973
TLSH
T1304161141FD750518DA78B89F0682B5375A3F152A21F98BC2BB02D45DACAE4B9E3E201
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4gk4st43.lb2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4gk4st43.lb2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Swift-ManifestVerifier.exe

Path C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\Swift-ManifestVerifier.exe
Size 1.4MB
SHA256 ab6728b0d2eac9fe2ef1a1bef914ca832dff3ac7a0d455872f77c3031f2d7956
MD5 ff958dd43b71bcab415fc0cf31c647e8
SHA1 cebc82068299323501641aa77031f08895125943
SHA512 75c9d35a8284c2965579b1735ecc1ee57785d6386705b774600d06c03acf1921fa40f4d313cce8e1e80edd4de690ba026daa5b297f226a912c7d5c4d3be7c7fc
SSDEEP 24576:JFqhpEbxYNZ+7bHVLWdjNHJKdANOPTins3b01UeN+8HGnOA/0Q/y+JbTPD5k1Xjx:JFqhqKn+TVLWdjNpKdANOPTON+8HGnOz
TLSH
T1B365AD15E3A821E8D467DA34CA669233DAB1384A4770E4CB0A99D3552F73AE16F3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

full.zip

Path C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\full.zip
Size 23.9MB
SHA256 bb8e9e773f7f6443640ededb0219720ba1565d6aab7d359c193bca90839483f9
MD5 4d537eb04a83438ccba752309c9c0008
SHA1 ea4a1575309dd10f95b15061835eda1f8cacd622
SHA512 90aa7bb79aff446f6e9946d7128696e0c581563b3c7b5a72e4a7eb7dd689408394961415bef090221ceaa12834919df3c39ecffc12167d5b13c305219fff3f44
SSDEEP 393216:gAamhrpBnUKzfC7aurK8lGbbaSh1vwpHoGMaOys0fZFRFy0mj1bFsLCSaGH64dy6:gADhrp9UKzCOu0GSnwULOnEa5HN
TLSH
T1134733CF66E82E8E19161534E2C355B453DF79A34EFD6E1EA18928C50E7C8BD07A480F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\manifest.json
Size 2KB
SHA256 a655fe5aacf488dfe7386f92fba2eaaeef3f2ce8ae1167481edb368b5913514e
MD5 43c5f7ac486593950ffa40d4ab8a5819
SHA1 fc7d6fb6e4310f4567e710ac5eb9378a99ad51cd
SHA512 502a40e47f8ad9340eab70937aa618785ca4cbb88f6295ab9b56744ea6d3f04daf870657000253c45b4485aaf55726a8ae5e18c56af4f95a75f89f7299dec411
TLSH
T17251567BC1A49E6B3476926F5E220354F852839F01805B0B7A3C84CCCFB6F902966A77
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.sig

Path C:\Users\Admin\AppData\Local\Temp\is-083ZLU70R7.tmp\manifest.sig
Size 88B
SHA256 543d8c9f9d173a883704d17ae7dd2266775e0bb6547bd1ec14eaaa29b89196f4
MD5 909974743a8b5fb92413082d196e106f
SHA1 4544f3edb0e651d39d51c4b53b2c8a09745dacc2
SHA512 bdf05792bead311882ec416cdbcecc2b4156c83cdfb83fd9f1d318dc153eb587865953a164c1f6326b132004bd0d9d2d7fd2316f394444b6469b3c6ebb1f46f8
TLSH
T1ACB012DC0F46D30488174B4124CA1F4E630B01515C0672C413825246910835398B08A0
MD5 SHA1 SHA512 TLSH

Submit Download

Swift-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-S4547TIJE7.tmp\Swift-Setup.tmp
Size 4.2MB
SHA256 1d56be538be186ba58c18eca4ff2f54e9e66e4107df1e8db23c4070390326012
MD5 b9a03347e91a941fcf59d5fb4b4247fb
SHA1 7549060b5081a1a2820994a4e0ea728e76f44819
SHA512 28c6caa1bcdc0e3cd04b7508ddbf8de830abfd6c433b6fa8d1a0a8740d191d8f6b405a2766c3a19a88c90ebf5dd62524e4170e0d0cf2ca39d970b90ad032151a
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JK333t:HItJj90Z6RgKwB
TLSH
T1E3168F03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Swift.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Swift.lnk
Size 1KB
SHA256 3e02c32d4b7e1a5052b87aaa63298a722ba7711f3a094c351418c212ee22c7a1
MD5 268f675d092db3a7e4cbc6b492397c7c
SHA1 0b60cf9c8b59cb84d1d94a7cb39608ee627b3fd2
SHA512 4fec317835cf3917969a80221572d9666506a55705bf6fc0bc5f89ae3079b554718b9702fb607f027a4845fdc3dc284c6783543c7bbde1d6937fb811a8077bd6
TLSH
T16321101055C61F45C2B9C27645FB2726CF31BCAAE39E2F9C4184C348DD409029D48F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Swift-Setup.exe

Path C:\Users\Admin\Downloads\Swift-Setup.exe
Size 2.6MB
SHA256 8430b3920ee0e81b3ec7bfe2485f93c381ea8985d24538da13666f19740b6096
MD5 995a0a8a63d55723d43b49cb0e520340
SHA1 269edea412623facc52b7d75a1c090ac5823362c
SHA512 250a2d96b4c5d1f434f74e0583d3f07c666fb8983fc7c951349aafc140d8382054e897e69832ca269d0eebd8ac76187a117372c4a42675e239f1c4f097262656
SSDEEP 49152:PuI2hC4K6cfOIIs64QC0rX1Ma3SUWYhwZzz3:P5ORXcmqFQC0DDSYqJT
TLSH
T1FDC5E13FB28B653EE06E5A357AB2A110583B7A6165178C16D7F4C88CCF194702E3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-295-0x0000000000E30000-0x0000000001272000-memory.dmp

Download

memory/1352-235-0x0000000000E30000-0x0000000001272000-memory.dmp

Download

memory/1352-291-0x0000000000E30000-0x0000000001272000-memory.dmp

Download

memory/2432-233-0x000001C410180000-0x000001C4101A2000-memory.dmp

Download

memory/2432-236-0x000001C410210000-0x000001C410222000-memory.dmp

Download

memory/2432-237-0x000001C410200000-0x000001C41020A000-memory.dmp

Download

memory/4032-292-0x0000025AC1AA0000-0x0000025AC1AB0000-memory.dmp

Download

memory/4120-223-0x0000000000720000-0x0000000000806000-memory.dmp

Download

memory/4120-173-0x0000000000720000-0x0000000000806000-memory.dmp

Download

memory/4120-296-0x0000000000720000-0x0000000000806000-memory.dmp

Download