1f0a835d37932f8e6074237bac599013d2b78ffb0763ea5dde94a0910f6f09c7

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Haze Setup.exe
Size 12.7MB
Sample260825-vnfpfaaa94
SHA256 1f0a835d37932f8e6074237bac599013d2b78ffb0763ea5dde94a0910f6f09c7
MD5 af2e947fd58ad037da7a8ea697be5f81
SHA1 5ea35d887e4875d8943bae16569c0e24bc368d22
SHA512 0b7a5cd74ea41a5450f1548e8f314f27a22eecf6d0474c229e5e5b1f09e391f755ce12c33147eee5874c8ef3274fcd51d9dec69dcef46a1100e2b319f356ab11
SSDEEP 393216:u/DaglzNBGQfgkU2idaYJ/befXpl++14dD:CaENwQ/uagiXH1
TLSH
T1C6D62351BA6B95ACD45AC4B0C3464B635E2170CB0B2AB9EF518842383FBEBF15F3C615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5900	Haze.exe
3320	rustwright-mcp.exe

Loads dropped DLL 1 IoCs

pid	Process
5432	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Haze Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Haze.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_2062738446\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1780118937\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1899909014\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_353712695\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1780118937\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1780118937\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1899909014\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1540917378\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1164	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321512944359752"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\ = "URL:Haze Protocol"	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell\open\command	Haze Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Haze\\Haze.exe\" \"%1\""	Haze Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Haze\\Haze.exe,0"	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\DefaultIcon	Haze.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{BDD67915-6446-41FD-9BB4-C1D3B85E83CF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell\open	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze	Haze.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\URL Protocol	Haze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\URL Protocol	Haze Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\DefaultIcon	Haze Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\ = "URL:ai.legionedge.haze protocol"	Haze.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Haze\\Haze.exe,0"	Haze.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell\open\command	Haze.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\haze\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Haze\\Haze.exe\" \"%1\""	Haze.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5752	msedgewebview2.exe
5752	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5020	msedgewebview2.exe
3916	msedgewebview2.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4496	Haze Setup.exe
5900	Haze.exe
5432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 5020	4496	Haze Setup.exe	80
PID 5020 wrote to memory of 4292	5020	msedgewebview2.exe	81
PID 5020 wrote to memory of 5140	5020	msedgewebview2.exe	82
PID 5020 wrote to memory of 5140	5020	msedgewebview2.exe	82
PID 5020 wrote to memory of 5140	5020	msedgewebview2.exe	82
PID 5020 wrote to memory of 1980	5020	msedgewebview2.exe	83
PID 5020 wrote to memory of 1544	5020	msedgewebview2.exe	84
PID 5020 wrote to memory of 1544	5020	msedgewebview2.exe	84
PID 5020 wrote to memory of 5136	5020	msedgewebview2.exe	85
PID 5020 wrote to memory of 5136	5020	msedgewebview2.exe	85
PID 5020 wrote to memory of 5136	5020	msedgewebview2.exe	85
PID 4496 wrote to memory of 5900	4496	Haze Setup.exe	86
PID 5900 wrote to memory of 3916	5900	Haze.exe	87
PID 3916 wrote to memory of 1864	3916	msedgewebview2.exe	88
PID 3916 wrote to memory of 5272	3916	msedgewebview2.exe	90
PID 3916 wrote to memory of 5272	3916	msedgewebview2.exe	90
PID 3916 wrote to memory of 5272	3916	msedgewebview2.exe	90
PID 3916 wrote to memory of 1272	3916	msedgewebview2.exe	91
PID 3916 wrote to memory of 3104	3916	msedgewebview2.exe	92
PID 3916 wrote to memory of 3104	3916	msedgewebview2.exe	92
PID 3916 wrote to memory of 960	3916	msedgewebview2.exe	93
PID 3916 wrote to memory of 960	3916	msedgewebview2.exe	93
PID 3916 wrote to memory of 960	3916	msedgewebview2.exe	93
PID 5900 wrote to memory of 3320	5900	Haze.exe	94
PID 5900 wrote to memory of 5432	5900	Haze.exe	96
PID 5432 wrote to memory of 4204	5432	msedge.exe	97
PID 5432 wrote to memory of 1164	5432	msedge.exe	98
PID 5432 wrote to memory of 2620	5432	msedge.exe	99
PID 5432 wrote to memory of 2620	5432	msedge.exe	99
PID 5432 wrote to memory of 2620	5432	msedge.exe	99
PID 5432 wrote to memory of 5352	5432	msedge.exe	100
PID 5432 wrote to memory of 5352	5432	msedge.exe	100
PID 5432 wrote to memory of 4616	5432	msedge.exe	102
PID 5432 wrote to memory of 4616	5432	msedge.exe	102
PID 5432 wrote to memory of 4616	5432	msedge.exe	102
PID 5432 wrote to memory of 2528	5432	msedge.exe	103
PID 5432 wrote to memory of 2528	5432	msedge.exe	103
PID 5432 wrote to memory of 2528	5432	msedge.exe	103
PID 5432 wrote to memory of 5460	5432	msedge.exe	105
PID 5432 wrote to memory of 5460	5432	msedge.exe	105
PID 5432 wrote to memory of 5460	5432	msedge.exe	105
PID 5432 wrote to memory of 5568	5432	msedge.exe	106
PID 5432 wrote to memory of 5880	5432	msedge.exe	107
PID 5432 wrote to memory of 5568	5432	msedge.exe	106
PID 5432 wrote to memory of 5880	5432	msedge.exe	107
PID 5432 wrote to memory of 6032	5432	msedge.exe	109
PID 5432 wrote to memory of 4392	5432	msedge.exe	110
PID 6032 wrote to memory of 3944	6032	msedge.exe	111
PID 5432 wrote to memory of 3428	5432	msedge.exe	114
PID 5432 wrote to memory of 2280	5432	msedge.exe	115
PID 5432 wrote to memory of 3696	5432	msedge.exe	116
PID 5432 wrote to memory of 5332	5432	msedge.exe	117
PID 5432 wrote to memory of 5332	5432	msedge.exe	117
PID 5432 wrote to memory of 956	5432	msedge.exe	118
PID 5432 wrote to memory of 956	5432	msedge.exe	118
PID 5432 wrote to memory of 4964	5432	msedge.exe	120
PID 5432 wrote to memory of 4964	5432	msedge.exe	120
PID 3916 wrote to memory of 4448	3916	msedgewebview2.exe	122
PID 3916 wrote to memory of 4448	3916	msedgewebview2.exe	122
PID 5432 wrote to memory of 3340	5432	msedge.exe	123
PID 5432 wrote to memory of 3340	5432	msedge.exe	123
PID 5432 wrote to memory of 5552	5432	msedge.exe	124
PID 5432 wrote to memory of 5552	5432	msedge.exe	124
PID 5432 wrote to memory of 4476	5432	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\Haze Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Haze Setup.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Haze Setup.exe" --webview-exe-version=0.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4496.3816.14020113744087999562
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffcef27b078,0x7ffcef27b084,0x7ffcef27b090
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView" --webview-exe-name="Haze Setup.exe" --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,7767552798032718675,18157199122735741346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView" --webview-exe-name="Haze Setup.exe" --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,7767552798032718675,18157199122735741346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView" --webview-exe-name="Haze Setup.exe" --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,7767552798032718675,18157199122735741346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView" --webview-exe-name="Haze Setup.exe" --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3620,i,7767552798032718675,18157199122735741346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Programs\Haze\Haze.exe
  "C:\Users\Admin\AppData\Local\Programs\Haze\Haze.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5900.5696.840626976538431352
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x1a0,0x7ffcef27b078,0x7ffcef27b084,0x7ffcef27b090
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1756,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1776,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2240,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3372,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4504,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=760,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView" --webview-exe-name=Haze.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4004,i,9353977176617771566,5323566306919877318,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5752
- - C:\Users\Admin\AppData\Roaming\ai.legionedge.haze\tools\rustwright-mcp\0.1.0\rustwright-mcp.exe
    "C:\Users\Admin\AppData\Roaming\ai.legionedge.haze\tools\rustwright-mcp\0.1.0\rustwright-mcp.exe"
    3⤵
    - Executes dropped EXE
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://usehaze.ai/auth/signup?return_to=desktop
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x324,0x7ffcdb84c188,0x7ffcdb84c194,0x7ffcdb84c1a0
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7981597025659403699,5228545814746101477,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
      4⤵
      System Time Discovery
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16883143383809013583,2273923682173417594,262144 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,5126945955521971928,17480071832084012858,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,17702073977997818970,5061401183732423342,2097152 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7507152657462951105,554545424716238844,2097152 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,6663852705497965748,1905496252033632333,2097152 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,646691039599424612,965324362075399761,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,7793053253062380756,4590808901757982198,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,4528003727685919229,3811937847452545255,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,2775818496657136788,9307438542919575269,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,4528003727685919229,3811937847452545255,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,2169129054014465611,8419072210156166098,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6055759455512260586,17355090450468007278,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3017724754345766288,125045587749058376,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,16647702496250071761,5863899725160941720,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,3768335619948603343,11776990335507234748,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8580200361249295839,15859502093589291966,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11906493534125036923,13392514306340404048,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,12539197210697598644,10167183137340513624,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10312694373020960265,16194255771298922071,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,7049188582619667297,11190935843170340288,524288 --field-trial-handle=2188,i,16274430948930477014,15816029371042182595,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80677173-19e7-4b1a-bda7-cf6dfb8e4de1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80677173-19e7-4b1a-bda7-cf6dfb8e4de1.tmp
Size 25KB
SHA256 13ffc1a202bdf67555f0b895a508ca07816515d2109dc63ab1d738fb7b7aca35
MD5 78bbaaa96b3ce6f4ff96a6c2317703c9
SHA1 c6e21be0534207580eca1595252c90feb7f58a0e
SHA512 1ce28db83bfbb661c1a53b9cebbfdf8faf3182c2bfb5bf2878cca029ef5b1d9281e4a2aba39dd6187aeb59190f43794c0727575fe53affd564f2eff5405d4fe7
SSDEEP 384:nOiF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BoQis4Jf+8GbeQBuGlGe4KV8p0Z3:lFccps3dwgPKekmgRBGy2jlGI8p0J
TLSH
T1BDB26B35EC58CABBECE64F9DFB4A6603DEE01267968889E4DAD81D0D00971DD034BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b92764575a0f440147928252da43e0d686746e0dc36aa6381844f9f7d334b634
MD5 9bf1c90cc8502f47a42d982533b4caa7
SHA1 ebaf110af10141d4bb886c731e070d7292282225
SHA512 47e927154c61ff522f76f7cb03271d5a6e19e9df89bc14d069f6fcbcb99c6beaa5501678a24313fc044a48e3d7a33d1dafd088c70ff3cf854d6470fa1554b6ef
TLSH
T148E02BA5CC21AD3B19FE571890605746EF05135B2B42491F3A3CC1098FF173E4A49C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ed054623958b057425f825934c6a9e6069727156c98b8d80bae9cc7bd08d6c04
MD5 5e2ff28b0141125053f9ab44feccf0aa
SHA1 4d11275392c771bc8c188458061643e6223a3048
SHA512 7e354b5900755a0303010eda179c34619bd5b00a7cd9be22525183b61cd53a7354f13de8fd5849e58cc59a6a8e6c801358888dc675dc67f839c44900eaa26d78
TLSH
T10841ED1664B08C92F78EFE30D5E28EE9753176544E171E850590FABCA436B2F059CCD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e087.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e087.TMP
Size 2KB
SHA256 53b0e73c8bbe2d921a868861146c63ec17a663058068884bc53f1b1361ef4cab
MD5 739e99cc2d96f683ec5c0719fcb2472b
SHA1 efed1dffde88a409bb43dd66635663685d72b043
SHA512 533cfca329a4282d5ba5e088753028ca850792708ccbf03d3b20bab4318c0d2a67180b89f32f4abe9cad88afe1525ecf03586bed737b016175ed541eae68d374
TLSH
T108410B1A58B08C92F78EFF30D5E28EE975317A544E160E850580FABCA436B2F099CCD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

026559f0-4c7e-419b-83e9-fcb1e029e7f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\026559f0-4c7e-419b-83e9-fcb1e029e7f7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cdd9a321603944a2cfc7aa578eda5b883eb6c1411931c2b338780b619be14d80
MD5 ac6b367fba72361c8eb5ed0b828e6185
SHA1 40785abce7f42129073e2cedb7bd8343fc071d09
SHA512 9b9f8c87e46104bd3d68c386a8b3a4266121cd5387979f080b8e1653199e89abe75fe7f97db7c1a2c3b3881b169cb89566f411b3b6f597dbce9723c600cfaac9
TLSH
T18D71CEF783E9856DD90191F4AB18AE2BCE1D0524432C3C6AC8E4AF6BA3F2571E14174F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c00a202ff9ac30ab759e68b2e38aeda674cdf3d2ff349dbe57150e393b346b5
MD5 6fe9d9b3daad9691d0e1a16fb7a87435
SHA1 97d1561535b1d3bc0f48be29587dcecefa96db50
SHA512 c90b52ed14bea77b7b9718fada50ad3565e07d0f57bb74e7fcb5ec01aa493302615573419b3d7e2dfb77acb13b11b95c595eeef09269f4567cb6723781d0b265
SSDEEP 192:sxZBROyMvZjK1Ml8McE/fSs4LKTG5GN2SwSzodpP8/W6+WNnBHdY0hTDtUiIg5ZU:sxZBO0E/fSs4LUei2Dk/bBd5hNCH
TLSH
T1BE72E9056A645977CCDBD219FA55BB63D2F91573A1914E489AFCCA0C00E6BEC2207C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4b30079016d09c876e00ceb72faa203edfbea7ef4a2137bdb6d7fe72816f81a2
MD5 808cbf6764f1d5a3bb09075ed5c1e9dd
SHA1 88a44ebc9b51629839242fc060eb71ce1562c7a6
SHA512 43ed8051c526ef138be5e35c507b13e49ee5704b823702201a14a796f863779b3606d7374e1d3177488e08c12861b8523795ba625dae413f35740d317b2fab33
SSDEEP 192:sxZBROyMqZjK1Ml8McE/fSsj2KTG5GN2SwSzodpP8/W6+WNn6k/Y0h7DtUiIgj+Y:sxZBD0E/fSsj2Uei2Dk/bj/5Rj+Y
TLSH
T1F162EA056A649977CCDBD319FA55BB53D2F91573A1904E489AFCCA0C00E6AEC2217C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a0ce919a2aff6bfc8253aa90713bd397e7cc87e9b6335d6126e9736a456b99ed
MD5 d702274fe6f67fc4bac18119cd7eaab0
SHA1 5db17cfacfedc8b4d4116e6e5ee2a5ec9b8d8d62
SHA512 68b6d6ba4c72d1cbcc98bed955f4770371e931b50c28ed9b26955ab7d21a4b648b0c2b62e5d256bd159427a4499cb79d16fdc60658ac81c8a25ac80849c351a7
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kzx4Ll1:wQAKq8y02yqEnjbWRmj1QWTu1jaKkzxO
TLSH
T16D03FA3B680CCB7E4F804E9CED277E8A6DE8028BA698CD5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 7dde1deb9f2383a3913b59eea6d124adb78375f59338968bc67d2cdbb2255d79
MD5 5552e20a59801756df12121ac7ba919d
SHA1 85817ab93833b55598e3997aa532c2284cfde957
SHA512 91b079b88c43a4ee2bf3eb3ae9fa8fe29cd3fafd18387404155cec064321e14dbb94882a906132dca6c8c6a5c19a30e82d56c4491894c6f60c8673b1ac0aefc1
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F55:GZLVDJjEDPV0/ZdkJ8
TLSH
T190A25A0232FA02023C7E790C929697674A42F2633469AD7F7BB900B64E67E115DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7b074b0d2782922354118b97ac5c6e55983a02f84765bae4bc9660eab7b51683
MD5 1c78db8bd9bdc06e559c0fa71953abae
SHA1 5795f10d8e51ee1fc14597b826cba9e2ef2fdecc
SHA512 607c017f6eaa6af7e681a1ae6cd6a5150b977e14ea22def22a45182cb63adc703e46b0145864e4e48a84323cbb7eccec06862c00c40ee7563181a26ad51f0ec4
SSDEEP 384:nQiFiZcI938Nv8TUNTUlIRXPm3ek32nn9Elc4nf+8GbeQBu0OC5teA+HBbsP4/t8:rFQ930wgRKekmIbGy2ViAg/Tu
TLSH
T1F5E2A2F198D7C976E8EE4B97A77E2D4299BCC153B9884984B7C44D1CCC921BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02b5d8618291246e60c7525ef999cf1385856808cc54ad0fe6a12f1930e06dd5
MD5 dd52724d299866cea34cb287a3e4faa1
SHA1 d401b9c91fb0a8052ae6202c54d268aca266531f
SHA512 d94e939940c99c878da7465d7babc9c9c341b8c97dc30926256743b04e33dfd86e748b939efc528d8a9563678e75e93710c980efb685c913f58d9f77bf952af0
SSDEEP 384:n1iFiZcI538Nv8TUNTUlIRXPm3ek32nn9EPc4Jf+8GbeQBu0OC5tyA+HBbsP4/t8:8FQ530wgRKekmWxGy2VeAg/Tu
TLSH
T1DFC26B71D868CDBBACEB8B9AF74A7643DEE40163998C8AD8D5C85D1D00971DE070FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0beb2de5d349fbd32c439e570f4df34f0916ed9e0dea02603798e898855c576a
MD5 e195ac2af8a52fc1b76217a92d309493
SHA1 9dcfa40340f461800e9de9705d983de55a9ae00a
SHA512 70f7adf7597991f1cb46c53ecb8cddd72a92d9ff45aa089374af1d97b172d20b0cc4e313ccecdba10e8778de7a7cc042e744d2c9e8b0d0d5ba9f40e2c1ea4ed9
SSDEEP 384:nPiF9CcmyWCs38NL8TUNTUlIxBPm3ek32nn9RrZ4Jf+8GbeQBu0OC5tPAe4KV8py:aFccps3EwgPKekmzsGy2VLAI8p0J
TLSH
T173C26B31E858CEABECEB4F99F74A6643DDE0126399888EE4DAC84D4D00971DD074FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d80e60d0642242035b3bb9c1df1706a0f742bdfe1fdc54bf404699e643023373
MD5 a2d9506bd3e90fc4be7cd8baac4e4ad7
SHA1 a0ef0072694a6a01d87bede45d3275ca0985b0c5
SHA512 a3d05e46fd6171112774b2f4460d981aca15792a57b190dc278f9f81a29a8473e9d0f86a0f875de03b4e9781e7d79a449c18f7513d5a3c6436d5b9c1e3b649be
SSDEEP 384:nciFiZcI538Nv8TUNTUlIRXPm3ek32nn9MPc4Jf+8GbeQBu0OC5tyA+HBbsP4/t8:HFQ530wgRKekmexGy2VeAg/Tu
TLSH
T1A1C25B71D868CDABACEB8B9AB74A7643DEE40163998C8AD8D5C85D1D00971DE070FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 237f2aacd43dc951e08b761dfc2e90ceb67d3dbe3e2d41cb0dabc1328c9d7113
MD5 cc9549cc347dece30a7b3353def0c638
SHA1 9c58413fee5d335af868bf3b8c408d4c5ed99162
SHA512 c794879ef591e015f6a8f5c22e84f83afec1913cb7be4f19b5a7b9dbc7031e2f4af4c259e5b225fdefcddb3e1f1604a19813d34e05d518e6c2c4d477eef0d164
TLSH
T189414FD04C381AD2D0BD0E6FB49B39FC81D8D726F1A0347C6898E9980A7E64D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b743ae2e1a8ccb4b41ef514ebd112b5fd52536d8d1231c415159ee199c1ff7f
MD5 45322e0e9b15422294f33a82f217e606
SHA1 1649e0f5c43ee5ddc9381bd8fff227e2782ffb31
SHA512 fef48648fd7bb67995cfb37904c14f9dc503de7a678c31d94e0e92d4ae3caced4ae9cbf7a0ead10e53dcdf4bb46281a1c7c0e0ee281e837ef33e956410789ac8
TLSH
T1634120D04C391AD2D5BD0E6EB49739FC85E8D721F4A4343C6898E998467E64D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

Haze.exe

Path C:\Users\Admin\AppData\Local\Programs\Haze\Haze.exe
Size 26.8MB
SHA256 210164144a53df3ea2ae102beccca5e63d2b7c885a148e330731de7445e7152c
MD5 4bb5c8eae4de10ac5d9928741a578cf6
SHA1 7f0dfb66bfa55dbbafa71ca0580aa05714b82bc7
SHA512 1ad51d1bfbc6e198e770b4c2643113857cee5f1e8b13bcc9db22b51d12e7fba5c19b6751ce2d64507dde30e97eef1c45334a1e6c426d3141c4ef0bcd84881e19
SSDEEP 196608:+jcSQ2uouTDBJd2xHsB1PH5jiMh+4zXQ+qHMtELwlxeCbBiNA4bxQe8aT2oZ:8uokjd2mziZ4zg+qHRLGWA4/8aTJ
TLSH
T1C55717117A6B98ADD15AC8B0834A4A735E2130DF0A36B9FF44C446393F7DBF46B29358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2500b9769cac1f43e00537caa14021beb603dcdf28d635ac7ce8e5cf53ee87f0
MD5 dde5bc7a2a596e2260ac52563ed715b8
SHA1 201ab97916fd410aaf0378c3a07f967362bd7d98
SHA512 82a1f19a1d16f8f3e8fe766bd7ac5c4e66c44eaff0ccc701f3a5a474c066a6632ff6c26efee35445614e926e65fc2c40aafb918069158ebdf1e7f9eb97543668
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 59507e4b7f0c2409f1662b0f0ae101fc49d9c9c66d15a4919ccaa1588569f9ca
MD5 6bd24d236b84ac2bd7db6cc7a7aaa0a3
SHA1 b72973c14a303dfd60dcae1b34389c43d9070541
SHA512 ba4feaf9f31cf5ab9d87aa758d73f33e452dac9577ae2eb8b223f6b195b3a682aa624b85cce51b8ccc849fef285f6adc41dc84fe464ad4076f05ded9b54a841f
TLSH
T1BED0121332060134F01021730412720A4C40C20B41094000A428E62D5E440654D028D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

975065ae-2e0f-49c1-90c9-14d70d1c6ecf.tmp

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\975065ae-2e0f-49c1-90c9-14d70d1c6ecf.tmp
Size 6KB
SHA256 4574f3d7711cff7c550e3b9f30d90ace9e934c7cfea2971c98e88bb58bcd0d83
MD5 77fdaaf03660e210fa6deb515f8b2b03
SHA1 92997e78ed67ea7931478f351b9cf25658f7ec4d
SHA512 d652b9215594708e6997d8640de903449837646a26342e454b8e6d021f675e36807c20024e4a9fe0d589c2fe6d2c5ebb5b325d7332a806cd730cda17c9a29010
SSDEEP 96:stQ054gPiEYb9z5ffyZ8i0vhE9klm/7qx+WVHMSm+uecadQj1+gIyYKEB:stQ07Uf6Z8pa7/S+Wi8doVYK8
TLSH
T121D176029F28697B4CC7E21DBA35BB42D2FA602265D51E98EBFC851C05D66CC530B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58463b.TMP

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\Network\Network Persistent State~RFe58463b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State
Size 1KB
SHA256 d51cbf38ddd727098ed20084f330ca129945231416df2c7801c210a35bcef195
MD5 6c70d047cb11a0c21005d0a512723c07
SHA1 fea2c9a2a396e3b91608ec0314d6586a0e9e51cd
SHA512 44bbfca2aaf2288d2df5f3d5fd76d7a0f50cdf4d0716c202f904cbb5c281238f7e69c3cb1824ad87a35c3bdccb7e3a355267c575b01e0f5b9bdd1ea1ce346f57
TLSH
T1043150B3E5946B336CD29549F1462E4F6D20506AC2524E5CA2CE461C02DB5CEA62FC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State
Size 2KB
SHA256 c014e78306592a9b1cd559f4d264e9b87746be23415cfb9f4a305b3c7e8cad8b
MD5 4a1a4cee0bf69ac58bc88a26c7dd6c96
SHA1 7db8a281ad444394b85392cdcc72f15598958b3a
SHA512 cddf9601c3f494577416fd66c988ae5d48d45fe281607c0f4b4559d42d19d69e78ec76bcf0acd2368f0e46f2840751ec2d35d304aa1584a4eb0b968994592ef6
TLSH
T132518373B804AB374DE39A48F94A3F1BA975506AD6621F68A6DD0B0C01DB58D2307C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State
Size 3KB
SHA256 9af70d5a502eeae5d488d1b2080e3db321fd853b4d0222bf81225075f1200d65
MD5 78720157ad8aa8ba39ca3b9710c194e1
SHA1 e8f772c1508446acce2303d6eaaec952b21cb59d
SHA512 4ca4de8cffc87ee3536371b62fd777ee625066f4ea2df4e6328c1bb04ee3b8b350609ef34232827aac805a07c5e1deb4b29330ce175bac65e9cdbf8647c5169f
TLSH
T11A719637A964EA374DE3D944F9852F1BBAA5502BD5962FACD6EC0F0C01DB2C81302C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State
Size 16KB
SHA256 e0c9bc6c6ead27b4ff8ad57590ab8d1e31a8d0ec04d544f8a06ea0fae0b374f8
MD5 9345caeefccd557e292f032c1d81d5f1
SHA1 9960e95155df40e8b135d29d33c6a7e37d9dc7e0
SHA512 d8d9a57d14e9f9f472b9ee86fab381c859c0a479f2af54d6a6cc92a95cc7fe9e85894da3b42a873733b24cbaf479db85d1486eede5da3718a126cb6f03799b95
SSDEEP 384:zm+aQikB+z/xvxjg/qhE7Nb9crHCayn2UO9z0:1/UxvxjgC+zcbCrn2UOF0
TLSH
T152728D2B65797F2358F3E505BA4D0B4FDAB584A290826FBC8AED1F0D06CB3D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State
Size 16KB
SHA256 daf9b6ee46227daa2d96ea9d97910eb94a144037a7c18d59917f78783cb31963
MD5 eac3276aa4a2dea1d7a3033fd42a331d
SHA1 8a2ce23f7b8ba8777393a3d3f051ac99726e8ca5
SHA512 82ce6033f611458d50ab063394f025a0d60fdf01c365edbef7dbe80fc78833fa84d748d17b720a9d6ad04ae73b48d51c857bbc0b8f3c629a88a359420f0bcdf1
SSDEEP 384:z2+aQikB+z/xvxjg/qhE23Nb9crYyayP2UO9z0:d/UxvxjgC+2fcUyrP2UOF0
TLSH
T183728E2B64697F2358F3E505BA5D0B5FDAB944A290826FBC8AED1F0C068B3D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe57e455.TMP

Path C:\Users\Admin\AppData\Local\Temp\haze-setup-webview\EBWebView\Local State~RFe57e455.TMP
Size 1KB
SHA256 e82f578bb2799c441b186867b509f69a909438e9b940960503e9dfd55ffa6980
MD5 ce39266ec6e0bfd7fe41389a035d82d6
SHA1 d4942ec3c7f6343c25c82d861c58df3ac0830ab4
SHA512 36f2e8d040d69d852bb1c8cc473e9f93b7d9531fba3d2a3b8a3bfc4c97075139470be8fd0edee1014f02412961fb7c4c9305c7164dc7f6c3bbb23601324f6a16
TLSH
T1C1214077E984AB336C928448F1427F4F2D60402EC2554E2CA1CE421C11DB8CE963BC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0570bb49ee512c16415bb63ae5c43c681a7d52254bc0c3828f8c6038efed8beb
MD5 c636d81da60b3083a108305c604cc90a
SHA1 e9edcfe98526b0cc48e04eacaad263e24e404a45
SHA512 64617bac99abc7f6997bcabe4dd459980bda6ced3427e4c1aff1c428c4bbe2da4a205a81d3c6001f5c3d3a06e9a868bab062cb271695be7ea0526d3555f521b9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6287605cd5f1eaadf97880f20382cc5cfdd1d35e679edd29fca9895e123d5c4e
MD5 a886285d521ca1a9eed96d86f9e8de40
SHA1 0c3fe08e642b5543e02f9a4dcefcaf664a219f41
SHA512 f23865fbe65ea9ff92a71700980068d5f0178398dc1c7c3dd54b2d14e42725347e4ff7349e5993d9b3af2f9c103a180fd7c491ef60604549b561fec9f50694b9
TLSH
T19FD0121732610338D71030331042B54C1D40C3AB410940405439851F3F040500D17441
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e3212cb18e269bed415875c0e8d8edefdced788c7dd2c668e43a3a3ed4933633
MD5 2da17be97d5c59a7e53bfc02f5af23e0
SHA1 71b17b2a60c24a4419653f1adabccc6ebaab1775
SHA512 88416c4de6467187fbf9323a7fc0b326cb934754010a3ba12e8fb89ace5ab90770ab834465e51f0a3a93165a336217967900abe1e26a592abe1f1f40cef70d01
TLSH
T148A0025057484582C395DFB021C701A0BBB09C3446131B4586E4D5FD89643E49626458
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6da.TMP

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58a6da.TMP
Size 48B
SHA256 acb3f3a9564fdb9d72ca4b9ab180e26bfd58f477ec88d349a44b79dbe2343a3e
MD5 840064b9aa244932c0c76cd445801c7f
SHA1 688e20d7eca4f1cbc891a6912809b4f5b39a3a01
SHA512 d9accba31bc9b1cf05712224fc5dadfd7ca215de359282c95f1ae8e5d7b8bcd57d0f54ed767148f5a24d51a511660a990ad037c4e7e79270d7d141970226274f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 0db9e888a228a3dcaef9292a3b82215dbd0f83c00f9aef99c817bdc09315d9b6
MD5 f532ee85660413cd719abed83bad16ea
SHA1 f5fe91eb72b5e89c7db83c16775be3cd075874ac
SHA512 fe84ad1a836e8c45ab292c009ed6d7ddbdee35b62356b879be72cbe9a213a1adaac5b197d960ffed496be2b21d743b920a470f2d4abd609a190854f64c08cf0e
TLSH
T19B21AD96C3E8C67D894567E027307913CC2E051992283D27CDEAEBDAA7D2071D12150F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Preferences
Size 6KB
SHA256 a79363cb948c8be58ba255840e722384c351a5b72c1881aad2a3d68e822dd0bc
MD5 d745a0eadbeaea7df5a2027083d4553e
SHA1 4b1cfe774b51feabe8a831beb6ae0665b3d8396d
SHA512 d163882b978982894edc7118e3573e9940f44589af1a76aec505968829560a49e3e30b4181660f26a2d01e0b5f0ef517484e97ce912eb116ed39cce9fe3b2eac
SSDEEP 192:stU0K9UrfdZ8palh/S+WiTKZoYdYqH+M8:stlK2rww/Voo0v8
TLSH
T1F4D197025E24A9774CC7E219BB35FB17D2F6206171D50E98EBFD851C04E66CD520BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Preferences
Size 6KB
SHA256 14925299f806bc5943bbb5f7f12df7b08023fda7f1db57409773d34b6f8a4c94
MD5 98984bfbb490093bdb69517c864444cb
SHA1 3f483252174f5e045382fbf08787e0330057380e
SHA512 803ddb3a1b305dce94392b1e8a7d9792129260e3fb950d63c89fbe8bd6f294b109d02d57c7dfcb2501650c05330a9f89ae7b31896fa5f0b77910256a262f95f6
SSDEEP 192:stU0KZUrfdZ8palh/S+WiTKZoYdY2H+MC:stlKqrww/VooAvC
TLSH
T179E1B902AE2469774CC7E619BB35BB23E2F5206271D50E58EBFD861C05E76CD520BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589381.TMP

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Default\Preferences~RFe589381.TMP
Size 6KB
SHA256 5eef8dcfc10c4a962f8f80a2d6a9d0f85eadba436e9e590ed96d6d079d1d8d21
MD5 0c6dde33a6f278fd114837f305a285fd
SHA1 8a39f3d4b39d0f91f854fe61ce49d92c02428e92
SHA512 adf526ed9f40651e663758a9781b6b527f7267ea6b925034e3c2b6cb78dc3f3a5d4530d2570ae3c2da2b19ba04ac52c0b613eb9613327bd2ff2c7f8aad6d5470
SSDEEP 96:rU05o/j7b9DUrffqKdZ8i0oE+ktIm/7qx+WVHMSm+uecJ7hS1iYdQj5+gmKH+MEB:rU0K9Urf7Z8pFlh/S+WiT7wwYdYVH+M8
TLSH
T1EBD187025E24A97B4CC7E219BB35BB27D3F6206172D51D58EBFD852C04E66CD520BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 4KB
SHA256 bc45a6f59a8d9af5d17e378feb6ebd1a5ef9bfe05ec43deb41aeb6721218dbc3
MD5 99ba17bee896feb44efa5d988d2146d4
SHA1 255347290d3fce5fedb7a1864d14cd50f6c74a06
SHA512 02e56750a872ae4b271920234da62840c40f3238ac8aebb47c8ec4474746492bba3462e2e15149d84b8a549e351825b6e5e9b3e4f1ebdbf45e27dd70838efb80
SSDEEP 96:zu1bNkCEOfeDxuWR8Frh/cInURoDoto+5a1hDihB5nZp6jxZKFTClma:zCbNbaDOooDUhWRiX5nZxxA
TLSH
T13D918422B974AA374DF3D905BA463F1767A1603BE4956FA8C9EC0F0C01DB28D1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 1KB
SHA256 6ab1f1603235346ebcd9af4c7f2ec6de7f99fc57e19cd39d3193171fb71036d8
MD5 56993977b26c521684b7f1ae9c8c3a15
SHA1 55046779d228f5cc4d82741a4a5ebfaa7380db64
SHA512 352655008d8b9d1c845cd62434bebfad01d7b5303950dc8cf395031d640a086b807adceae390070cc7877f3f9c4c2fcfef73443413732163a1227d88a9855efe
TLSH
T1013145B2F8A06B335CC36541B306EA671F51257ED1514F9861EC471C02DB28DA22EC29
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 2KB
SHA256 64f54e9039bea28765f3db6186beffca4563ec7c3549347c106587c97e91c3b4
MD5 41f10d0fcaa8061082137c96e9e2747d
SHA1 fc6e793272129db0bf9a999d82e19b0798e0d3fe
SHA512 3eea5ea532619204e4f6c341f3300b73bc93c6122cb94b7a1d6d4795ada79044e991d6d62453d45b8df65c93f6af9ee488fb2256e2c693c0004915aa729dd17c
TLSH
T11451BA73BC14AB374CD39904BA0A7F239B75617DE5521F5495EC0B1C01DF24C231AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 3KB
SHA256 a2d026879319026d1b7832d8d8ebdd97ab35b4a979fc1ea2837dfcb078339c66
MD5 736218bcc85cb9bbb4084635c3c329ba
SHA1 420afc6bfbf8fdd64c876d26ae23169743e0c91b
SHA512 3e8b3f78e8ec0c92b31f4c242c524ea730c3f5f5e6dc01f1a4635500bdf7ce5f0e922b1a7889a50399d5d1599af183dc638fbcddfbb77d9b28175ff7a8c94b45
TLSH
T103718572BD64AA374DE39900B9852B1677A1613BE5953FA8D5EC0F1C01DB38C2316C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 16KB
SHA256 18e8b0460568d8acf618867efd7c7fc5c711211c096a0b58d9459a3d1a1bf9be
MD5 df6832ba65d1a4b35b6ee3a901742497
SHA1 f3209bdcec91d86feb2b3bde02e6db81fa236abc
SHA512 f449aeb929468475d5764126d5bf4361df85d4d0604ea9c7e2c176f52f35841d7e3f8eccb93b88f0dc88da5b5c83e706c2cac2bf69deb1cfb70ef910088ebe2e
SSDEEP 384:za+aQikB+z/xvxjg/qhEtNbNJw5lKx2Uf9z0:R/UxvxjgC+w54x2UfF0
TLSH
T10A728D2B65686F235CF3E9057A5C1B5BC7B59866A0C22FB84AED2F0D06DB3D80306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State
Size 16KB
SHA256 c9399df075ca7785aeed0260c06d60f988d7085293229c61ec17808789c1de24
MD5 cee11ee0d5adcce6ae38a1a50f12a137
SHA1 3a1cb1483b9ab996eca2c8c261cb72e761cd916d
SHA512 3524274d1016397ee296b99b181c2131d065a12da3bbdeaf77081ba924322e27ef09f01534bb31bf8835dccfb6ee01e2d19f6d6092858b6c48aebcf6b479b8f2
SSDEEP 384:za+aQikB+z/xvxjg/qhEtNbUJw5lKx2Uf9z0:Z/UxvxjgC+H54x2UfF0
TLSH
T12D728D2B65696F235CF3E9057A181B5BD7B59866A0C22FB84AED2F0D06DB3D80306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584263.TMP

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Local State~RFe584263.TMP
Size 1KB
SHA256 ecb0fc586a2c7c7757c16fb25cf9565672891a968293fa959fc01a9030769205
MD5 d3f82264898a1f0848eb4524e8b189f8
SHA1 881f5fc4d152862f992865d070a83b06e05870a6
SHA512 479a49c42b7121d75611f251ebb12e0e32af8611f2387f23297d448bc24cbbc3eec7939564d66a97ef2f4de761be62e32d4a2d7c9b9ce7992d4bbb8351449519
TLSH
T1E22140B3E894AB335CC2A811B306EA5B2E50657EE1544F58A1EC522D06DB58D933FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\ai.legionedge.haze\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Haze.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haze.lnk
Size 2KB
SHA256 cf0e580551488cf823e0fd95f87be19ed7de4b4de7320153e649d94060e1292d
MD5 70d4cf6c3a2311872666acdd219bb896
SHA1 ea22d515c6d00759ffa41895241d0e8c6cff3c41
SHA512 9ae177dde11babf9032f8eb1afc1ab526064257f94d2b6f67f0463b6e3c3afb32553869a3362b425fc5ae2b1023af955e0c1188782073f2723766f12cd008031
TLSH
T13941FE027AE55634E3BF997114FB727996B2F892EB91AE1D000043491E36E10DF38F17
MD5 SHA1 SHA512 TLSH

Submit Download

rustwright-mcp.exe

Path C:\Users\Admin\AppData\Roaming\ai.legionedge.haze\tools\rustwright-mcp\0.1.0\rustwright-mcp.exe
Size 11.0MB
SHA256 b4b9929b12e73289f42b93886edd9a7e3fe483f4c21a968f212c0a1efe7898f7
MD5 28a5c4bf57b2bc4c770f2ff9169f2c95
SHA1 03a3895523b24d887c71d32407ecbf89762ed63d
SHA512 0d559466441de6ad984d4a57976b3c922d909af08966a850b9c06160466d8f57c05d4a46b2c4d7918251fc48ec1c2a799bb3a80cb5cd9ea3d496858aac7d6491
SSDEEP 98304:OI4vsjI2i15wO7FPLx1Fj12+TNmsjNwLvfSSKrRec:QkjIH0sFP64/v
TLSH
T143C6F6216E5A59ACC19AC474834A8A725E3130DF0B35B9FF44D492783F69BF42F3D268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Haze.lnk

Path C:\Users\Admin\Desktop\Haze.lnk
Size 2KB
SHA256 3fa5a1fda15dbcb1ed3b7192b587126263d5a6782ee37284ac93074128361e2d
MD5 b704808f93ac930126a096961318e136
SHA1 998cb2466684179f75cac2ae4b71025b8cdb7f1a
SHA512 6c6a941fed47261e611eba28a8531167e3639cdcc85472d96afadf106522adfeb052711715dc56daebf9ef3867b6e1300ae857eed2c13b64e1e132d3fb7c2ecf
TLSH
T1BC41FE027EE54134E3BF993515FB726996B5F891AB919D1D0000834A1E32E10EF38F1B
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\manifest.fingerprint
Size 66B
SHA256 403e6e5965571238c03bb289a9e533261775fe381e5a91300788cd37e465b4a2
MD5 bd493e5a161e6d66c7253da476ecb4b6
SHA1 4ce1686e9532aa7190f90457cc648bd55e1a8bf5
SHA512 ae673a5aaf2d5c73eb3a0331cd9dc6b7d8d481aff6afb3015c745079debe10a73c089026c2c614bd847d3d364bcac6e6910f896e785225d88ef81a98ac24c15b
TLSH
T186A022E2E8F3B8802CA0200C08CB32C0A022B3E300800EF8C0000E8C02A2C2CF020AA2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_1363310202\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3916_2062738446\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1780118937\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1899909014\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_48622149\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-590-0x000001900F110000-0x000001900F488000-memory.dmp

Download

memory/5136-211-0x0000017154250000-0x00000171545C8000-memory.dmp

Download

memory/5136-141-0x00007FFCFC680000-0x00007FFCFC681000-memory.dmp

Download

memory/5140-210-0x000002BAF98D0000-0x000002BAF9C48000-memory.dmp

Download

memory/5140-25-0x00007FFCFC680000-0x00007FFCFC681000-memory.dmp

Download

memory/5272-589-0x000002050C440000-0x000002050C7B8000-memory.dmp

Download

memory/5752-1466-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1468-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1467-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1472-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1474-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1478-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1477-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1476-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1475-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download

memory/5752-1473-0x000002D06EBD0000-0x000002D06EBD1000-memory.dmp

Download