hxxps://cdn[.]discordapp[.]com/attachments/1345162393990201445/1542618752787423413/detect-fm-99397693[.]exe?ex=6a95d7ab&is=6a94862b&hm=76d31d7d77a7a5522fce4a9f0889871b6b45976b5654c2f528b62030ce62ae93&

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1345162393990201445/1542618752787423413/detect-fm-99397693.exe?ex=6a95d7ab&is=6a94862b&hm=76d31d7d77a7a5522fce4a9f0889871b6b45976b5654c2f528b62030ce62ae93&
Sample260831-hltgasem21

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	892	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3504	detect-fm-99397693.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	detect-fm-99397693.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3504	detect-fm-99397693.exe

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_2134143301\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_2134143301\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_996617298\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_996617298\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_996617298\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_2134143301\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-te.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00090000000244b5-156.dat	embeds_openssl

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326326032623199"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{EFE6D8A1-CE22-494D-8DE9-D5DF36EE9CE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3504	detect-fm-99397693.exe
3504	detect-fm-99397693.exe
6712	msedge.exe
6712	msedge.exe
3584	msedgewebview2.exe
3584	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
5404	msedgewebview2.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	detect-fm-99397693.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1216	4280	msedge.exe	83
PID 4280 wrote to memory of 892	4280	msedge.exe	85
PID 4280 wrote to memory of 3796	4280	msedge.exe	86
PID 4280 wrote to memory of 3796	4280	msedge.exe	86
PID 4280 wrote to memory of 4912	4280	msedge.exe	87
PID 4280 wrote to memory of 4912	4280	msedge.exe	87
PID 4280 wrote to memory of 4912	4280	msedge.exe	87
PID 4280 wrote to memory of 1164	4280	msedge.exe	88
PID 4280 wrote to memory of 1164	4280	msedge.exe	88
PID 4280 wrote to memory of 1164	4280	msedge.exe	88
PID 4280 wrote to memory of 4100	4280	msedge.exe	89
PID 4280 wrote to memory of 4100	4280	msedge.exe	89
PID 4280 wrote to memory of 4100	4280	msedge.exe	89
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 4556	4280	msedge.exe	94
PID 4280 wrote to memory of 3032	4280	msedge.exe	95
PID 4280 wrote to memory of 4556	4280	msedge.exe	94
PID 4280 wrote to memory of 3032	4280	msedge.exe	95
PID 4280 wrote to memory of 3068	4280	msedge.exe	96
PID 4280 wrote to memory of 3068	4280	msedge.exe	96
PID 4280 wrote to memory of 2872	4280	msedge.exe	97
PID 4280 wrote to memory of 2872	4280	msedge.exe	97
PID 4280 wrote to memory of 2872	4280	msedge.exe	97
PID 4280 wrote to memory of 1256	4280	msedge.exe	102
PID 4280 wrote to memory of 3328	4280	msedge.exe	103
PID 4280 wrote to memory of 3504	4280	msedge.exe	108
PID 4280 wrote to memory of 4900	4280	msedge.exe	113
PID 4280 wrote to memory of 4900	4280	msedge.exe	113
PID 4280 wrote to memory of 4900	4280	msedge.exe	113
PID 4280 wrote to memory of 5172	4280	msedge.exe	116
PID 4280 wrote to memory of 5172	4280	msedge.exe	116
PID 4280 wrote to memory of 5172	4280	msedge.exe	116
PID 3504 wrote to memory of 5404	3504	detect-fm-99397693.exe	119
PID 5404 wrote to memory of 5448	5404	msedgewebview2.exe	120
PID 4280 wrote to memory of 5668	4280	msedge.exe	121
PID 4280 wrote to memory of 5668	4280	msedge.exe	121
PID 4280 wrote to memory of 5668	4280	msedge.exe	121
PID 5404 wrote to memory of 5804	5404	msedgewebview2.exe	122
PID 5404 wrote to memory of 5804	5404	msedgewebview2.exe	122
PID 5404 wrote to memory of 5804	5404	msedgewebview2.exe	122
PID 5404 wrote to memory of 5844	5404	msedgewebview2.exe	123
PID 5404 wrote to memory of 5912	5404	msedgewebview2.exe	124
PID 5404 wrote to memory of 5912	5404	msedgewebview2.exe	124
PID 5404 wrote to memory of 5512	5404	msedgewebview2.exe	125
PID 5404 wrote to memory of 5512	5404	msedgewebview2.exe	125
PID 5404 wrote to memory of 5512	5404	msedgewebview2.exe	125
PID 4280 wrote to memory of 5744	4280	msedge.exe	126
PID 4280 wrote to memory of 5744	4280	msedge.exe	126
PID 4280 wrote to memory of 5744	4280	msedge.exe	126
PID 4280 wrote to memory of 5796	4280	msedge.exe	127
PID 4280 wrote to memory of 5796	4280	msedge.exe	127
PID 4280 wrote to memory of 5796	4280	msedge.exe	127
PID 4280 wrote to memory of 6104	4280	msedge.exe	128
PID 4280 wrote to memory of 6104	4280	msedge.exe	128
PID 4280 wrote to memory of 6104	4280	msedge.exe	128
PID 4280 wrote to memory of 3696	4280	msedge.exe	129
PID 4280 wrote to memory of 3696	4280	msedge.exe	129
PID 4280 wrote to memory of 3696	4280	msedge.exe	129
PID 4280 wrote to memory of 4208	4280	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1345162393990201445/1542618752787423413/detect-fm-99397693.exe?ex=6a95d7ab&is=6a94862b&hm=76d31d7d77a7a5522fce4a9f0889871b6b45976b5654c2f528b62030ce62ae93&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,6697788409139492225,9347363463157862115,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,5534712586257953998,12343125719818187832,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,1163038756485362026,11661527259008988309,262144 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,959983912904369210,14727179184045855797,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9864244923006834162,14654347992634001378,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10764499086579427801,5010020951948414229,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11282608985743706326,5292720226719462279,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3285679434520131935,12052917466958425582,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9318273051420095845,16478652443168893024,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3091850854731765301,11631974732382619873,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,5317105534706507812,1345106081479397660,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15036030993658971473,17105731150470341988,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15036030993658971473,17105731150470341988,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,15991174146904616598,2112912107817641332,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3328
- C:\Users\Admin\Downloads\detect-fm-99397693.exe
  "C:\Users\Admin\Downloads\detect-fm-99397693.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=detect-fm-99397693.exe --webview-exe-version=" " --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3504.5264.14632971933151927099
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff90b79b078,0x7ff90b79b084,0x7ff90b79b090
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1636,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2272,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3488,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4452,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=784,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4356,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView" --webview-exe-name=detect-fm-99397693.exe --webview-exe-version --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4548,i,11009930455805194038,7864018148322423892,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7044,i,14753282369568764808,4573099169776471333,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4252,i,1923651351767720254,13222636750857115156,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7240,i,11049398574171228356,9472028065352248393,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4272,i,3782970142803076589,539582685758142604,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7588,i,3076930021949964555,12859328261137549525,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6464,i,12191301003980107659,13215500462794547171,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7380,i,2617774556945858445,15858425270255049686,2097152 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,2426836859615396222,16901425157297219529,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15387224296104629308,5569270419972581614,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,710582854906567188,5864199565494658679,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,3543946971305242184,1933840855344101561,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,5623657605222665582,6728713924906838656,524288 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  PID:6384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6784,i,11504429836543291791,3935053275803295043,262144 --field-trial-handle=2280,i,12055041724029321929,15989220323501247881,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_178771640\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_2134143301\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5404_2134143301\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 68KB
SHA256 c81710cb7bada676efbed41d7ec45cd7e3ecc578fedc384681aff77698123163
MD5 c3f9ed32b256e81614c727b5256d8aad
SHA1 898d15f76fa5f2e9507ec3a22dcfb9c5166b4584
SHA512 179bb6ffb1300dabfff5051ba36d1c7739d75b809e0ff4d78a03240b039bae99b10c0a0279afa8b3f9f5d6b0ca5b1861307bd6312aaca1615861888b2c07979f
SSDEEP 1536:vEIXx9GU08p3n5i1ccGeWZeOwwxbGD8IYzCEOyxe:Tfd3n5i1cZPlwSbGD8IAC
TLSH
T1F163123C61EB51BA7AA5ACF9A4F36326DD3274A3720332DF4A0552574BA0261DB0F0CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 407KB
SHA256 ef4df5446b670dfce5034828c0677415674b70bce5dbb39a0fb02b5b12e84307
MD5 50bb4fdea5034803f159d1341412cc38
SHA1 da589f08b83e00701b26cf9050b049c5ea254f28
SHA512 469ac5f7501dabd47179abd4d666151fa4221c641d31a7c806e8045a5771bab1990490f6d297afe372f1dab3c859007c04461632907379fb7f70c5535a4f0264
SSDEEP 12288:C2fSwHiPpN/Cc9ckbT8cIAz9Kx5MAtTYBbGHF:C2qwCqcX8092MAtUBbGHF
TLSH
T11B9423CF50CDD7E0247C3A4BADD63878660B2A60FCE211A203DAE678D645E177E35E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 27KB
SHA256 64e79147a82c808d8a3daae687c53b872bd0f3990445a7d146f16d0a5bcf5148
MD5 f1d6ac69d6247fd7d5a820b1d6b5112a
SHA1 26f6a525b97b7f2a9c008e8e4fa6a193091e071a
SHA512 3a2cb9a7defda2b8d3479cee40457053e50b41974ec090737e3c8a77b3d6b697a3b49f446d02422f6ae9a98c50ebbecb2a739670fbb0bd70825344a5a874458c
SSDEEP 768:itNT5p0OyEHO9J1EMdzwfKgbcNHC1lgET:QNTf0FEYNdY9bcNiIC
TLSH
T107D2E106CA539FE6238354A5473364DE5FBE12211123EC108421672EFADB59B7BCD0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 77KB
SHA256 41b11f538600d39449707c3c4059c414e43f459ed1d55d550c86295a4004049d
MD5 5608df8bfbd41cb60bf28b81d8d61efa
SHA1 9a21ea7361f2d274de584f06d7abaa786b9dd0ef
SHA512 48e5cbac75244db642db3472b90a4ccc65500aa6f48c80f9f020db94d5b41a2c05d3234128f1b941d23532770cc284c08c301f539b06d552776073d2d40bba21
SSDEEP 1536:TRN1p17WrnJxqFm2yz51VSw4TiQrFNiCe8yCdn5jr3JrLe:TxKJxqFJOSfZYX8v5jha
TLSH
T14B7302E1662B82E7F2D2C5611DBDA04D0BF17F9EC598BCCB07F25A0C694704BC6A6132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 cfff10977577d186bbfaf41c541effe476ae05b15b24a05f289b95a9478fd400
MD5 41aef365970551d82a09b37449623d27
SHA1 32060b478345a9c6840f65bbca8260a5e1f0e271
SHA512 a9a1de284fabb763809b0c515223a67c8953594ef3f5e51146a27a616f96e7be73f25e48046e3b37bd698a35e31c2724e09506cad9666fb847d8ba93adfef226
SSDEEP 96:IEKnkV1d4CzZmUpuowF9sHjD642xk9ucCidVmAnzhOJd5s1P1eC97YbTQCKNxFwK:/RV1VputAP64xurym0P1L8bCgg
TLSH
T11E02B73A98EA0051DF59BD3064FC98F43D71D4D9F92B3E270328E934A00BFDA523A0A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 1a0d59fe485e069553cc13407eec3db969c68a3e244c5f5b4592a647be9b8f8d
MD5 53ba17cac97ab0fc152c446a2b8fc234
SHA1 26331e6a7b622c5d3eccdcbb5e181aea06994672
SHA512 c32995dd1ca12eb884770c75eeb30e45454ce643d2f757cb8d8c4e414d0d28b0d943a69c2ba95ce3a33872b6e8c0e41c47c85e0f839723c274cf5188dc2a08e3
SSDEEP 96:niKnkV1d4CfZmUprwF9sHjD642xk9ucCidVmAnzhOJd5s1P1eC97YbTQCKNxFwhe:iRV1V1kAP64xurym0P1L8bCgO
TLSH
T1A402B73A98EA4051DF19BD3064FC98F53D71D4D9F92B7E271328E934A00BFDA523A0A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59305d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59305d.TMP
Size 3KB
SHA256 a54f4c7f804e70f5ce1232a0f68fc1e387c35654a1a66bd44c91b46135e4ca3f
MD5 ad8e21414b2981d47576e00b33df9f57
SHA1 77fc70b56769b2238fda6fafc6b2c68f9a353bcc
SHA512 7fa28a7b1c25d9017f53c31332fe9deec06a44c0ce4b28409905caf57717a363c1153703c01cd627b8319e3e7f0c65ab22742a0867f07c2f82987b89d1c5798c
TLSH
T13571533D19250961D3A1883278CD12847DB1C9EDFE335DAE0179F974E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 eac2f0dcc8eecd99ec1e930b6e165eddbdae3ce76f0cf426caf595b3b7198f31
MD5 f1176243ae4df737cd8b8011da4824f1
SHA1 d107f60368a565e6770af4d14db5f1bf35e9b638
SHA512 25c1c8b24fdec80c008cd4ed573ea340d847ebf62f9a14e1dc03ba8632479c071ed2f32058fd1eff8988c8adc4ca685b5f0e68471d88c10d55742d0d1e82e0c0
SSDEEP 192:D85jP2CxhiqjXVuau3f1w1MP5p50yc7hhVYboMCCRGVftrVl/lR:D85jP2CxhiqjXVuau3f1w1MP5p50yc7X
TLSH
T1E212C1F3C3D5866DC91162F0AF283E1BCE1D095552683D2AC5E4EF8BA3E6472E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37535933268f3484bd7444523a69289eaaea027e0cee417de387ce823da81b9b
MD5 89058bf21e292ccd6029886d9503c1a0
SHA1 04d7f40c79bbfef262762a789410c7cb0a8bcb31
SHA512 ee2f46898f1802f2b9dc67ce43c6e02e7c08efc9691f70c864c8b043d7c889f9fad39596be8cec440b80771bca24645977cb44b31b576ba9eca6fb38186880cf
SSDEEP 192:sxZ8Rc0cBWi/fkskYNcdpmEffk9HW6+WNJ99iZHmd/YIWBtsIg5MC5hew7jpY:sxZ8tmWi/fkskYqoHbJEo/RHhew2
TLSH
T17462C6535A24D4778CC6C619EA357F62E6F950329C910D9CAAFCC91C04EB6FE231B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a675ce5245f47de56506f0c0abf2ba760dd5d68bba90a26dcd842a1ab9d6f85c
MD5 1c7ea392f4974e90d736eba0952e8ba0
SHA1 54846ab174707bf1837e7dd772cd026a034c9ab0
SHA512 cf64954983c7998b87bd557196e46b3ffdf0aa996e3b0858044896922d4b288959c4b570d5bf39e12f9ffaf0301da992de3e3cea1b5397c66609e67166101cbb
SSDEEP 192:sxZ8Rc9i/fksmYsIdpJHW6+WNGYIwBtsIgrJ:sxZ8Ei/fksmY1JHbGP9
TLSH
T16A22C7526E28A53B8CC7D21DFA257F53E6F55032A1D41E58EAFC961C04E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 38d030547b7faccdcec76a4e24e3618c1887cecde5bd7d4849738e39d75c282e
MD5 f898a268f7bca63d4fcb71de186f2305
SHA1 0182cddb1afc1cb753a209046824fe868a01ce50
SHA512 e1b5ef5c210357ae10897bd7bf2879d485a8fd97d8621d5b702b47319f159c3e740d98040d59d31b5d54dc13e16e0814f4b8644c4b9c848e023d7a1e7f89de00
SSDEEP 192:sxZ5Rc0cBWi/fksk2aPzdpUdEffk9HW6+WNJ99iZHmd/YIVStsIg5DC5hew7jpY:sxZ5tmWi/fksk2ancHbJEo/z0hew2
TLSH
T1DF72D6535924D8778CC2D519FA357F62E6F950238C810E9CAAFCC91C14EB6EE631B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 54e015b1f5fc7a2d27c8acdcafd5d4c630a047f19988eef5918ba89e624a5d06
MD5 8d0275219d3c15255297ae585fb2aaf0
SHA1 6d437aec4698ae896250b07c2e6539770530fac4
SHA512 820805766176c18afd9e3c3ddb4e6e5f769817478af924bfd1425c43d5d32c3650416b076bc3b8d6feb7eab6b7466173f5856ce079d0d6054cec1d370871d1ed
SSDEEP 768:CNyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR71ropup:CNyqbblWvJDjTu1jah4LAs7OpW
TLSH
T13AC2093B654CCB7E4FC00A9DED5A6FD73E9802C7A6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 c3b552b873a21f665c7d9d5a3e3a9dfbf1554e1d6d181752bf3d87f8a34c77b9
MD5 b1bcd452ea2655ff47eec3ac739c9427
SHA1 e78361d1786cc651015a59e8cae925b84c370caf
SHA512 218004535e411868e8d90d92760197fb52b0a809b1d6e9f79cfda18557bcd5bac78fa81bbf046f35849d10360e57fb09761924636d2dbe3240f39b2290dac5c6
TLSH
T17D51D80F4D0A1E69E89C95711CFA2892737868DE1B48AD0753EED731BCD33341E4D048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 f88b733e3db4e5ffc60aa48669e298179a06f60ce6b6bfd3968b2a31d3bbf579
MD5 56a1797ffa94c1de9ed6431e84247298
SHA1 4f7a35dc238b3748ec0974183e751404e8f1a406
SHA512 ff556ae4d6b7071606a97170ac589d55c8113f8f42b59bce589dc74d2cd2f8c4a80a135c9b761b947ba56110d8dd8b4c75e9f82b23adb08836a56bf1edc8c5c4
TLSH
T10B2121DD4E91559FE9A549F31076A1E033B0C9CC6B21E3535C7C32772C2238A2A4B1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a4d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58a4d6.TMP
Size 1KB
SHA256 2cd335ab54b2c8dd5b7c612111857803f040f38687cc45e5d723ce8ed387cc5c
MD5 d66d457bc3565470e9fee3e08a3a25d3
SHA1 a7f87980dff52b0f0a69664ed088d99de5a88f23
SHA512 2ef1d07d00f428b57b54422a3196edde8050914d796a60805cadc7d083d0d55aa2af3db987886d3c30b1ea6a64858bf4f60c4ef76208ddab54cb2cc21a1148af
TLSH
T1532140CA8692890FECE140B60553A4F83374C9006322B3D3A979673E5C3579E2E5B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2061621fa2333d77149551d70f14ff3078eead78e1990516193eadf41590f833
MD5 7923b984975413f5b3ddf3dd29f75d2a
SHA1 80b9ba9380409c94caeed4d55bbe3e791dbff312
SHA512 f5ee562379267512d089abf15d6c804fb0355ccd66948b8fcbc44c87179967496b01bfa67f4c422aa841a5368d2998fdafbd82498ce912be43d0ba475c50d7e5
TLSH
T1F7E06FBA2AEB0800A8ABC3EA087344A60411F828C891EC4F1029968320623A02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cb9fcd3c2a33c7a20364dbb479f2484a5a3cef3c1f7abf5a455fcec741c1c50b
MD5 98477c4d3738c9eb36562296c5b9f154
SHA1 8f65dd3bba866fa71ae7737c6902eb408273f258
SHA512 c26347e89a9ddc618a6983837367531e4b4158d5fb88092def4b2b1bbc078c474d4c0544861ccfe39ba91bf3f28791d4d8f443945361cc825894378bcb322de7
TLSH
T151B0112A020830B2C08E03B282A280E0B3A00CAAC20333A222A820F0B030A82022A300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591841.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591841.TMP
Size 48B
SHA256 e6c8217962ee53beb88b90cc05dd7a1e17d43e410fd2c1bbeeaafde48fa26376
MD5 70b6aaa9cd4507ed4b1ddc7ed18cbb6d
SHA1 2f5645ce97ac18558dfc3780d2f2a78630f00e79
SHA512 bbae4c9fae393f662d2937308473fb69b1bc021619c20ce4cdf8cfa84d15b548aff06619982d3e7e8b97612f73a00645e753e3e90c815b379d931dfce5ca05a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 480ee7f481e20772ab65c651d981e52d9919551530a63aa98e94b0e5f4450cc1
MD5 383075cd523bee1035bbfe18651ddc08
SHA1 13a51d3449a99fb200c99e50ae23543e18532cf0
SHA512 c424e0334d446d44d38c4a18565bceea1f75a11aa535b3b8c20a70a2f56c6374421fc173d5327fc04969e959b8dd294f016537a50e1adc96195b254bc844f24f
TLSH
T13EA0022403D14811C00C06B029C203B07360DE56A183620381A04048CA992965D07814
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 54a8c5b62fa0c78887e6601775431d29a009d4aa2a5e60b2f21a7f16ce41bf6f
MD5 70de7530be439ff44cbc2502d3294f41
SHA1 7950c18d303b8c1abee173c971956e564027ffac
SHA512 cd00bf682390cf089cdc4c85242bd312a62db14df0baa528a6c15ddfdce15013ebbaf21733d2b5dd0165d6242c23d989baa444fd5586c816a5aabb89ce6b1378
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikT:KYbaKYIKOfuKQY+S2gKnKkNCK+wag
TLSH
T199B1A615B27A0241787E295CE2A799370F4635633008A4EF7FB990A64F66E110DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5935db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5935db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7d804e93bbe560dc83b0787b70858f3e7b4661fdc385e446f2f08ca8b9312217
MD5 cb591f205852b7906cd3918b72605683
SHA1 59de39c40e2b186e089a59f0e181861ed76ca676
SHA512 fc4343cca9d4d27dc6d319670a50f819322181dab8f8d254b72343aa870d639ce4903a837a78926e81e82ab7fbf463cf2a293926bb6e5d9f0df149d3546b9c8d
SSDEEP 384:tZcIVsNRzYum6KbehCVRNT6b3A0X1puLeQCoq:1VFV6lQHTqAsyLeQCl
TLSH
T137827D726C785C7B69F6E505F48B32135EB8C133A6CC6E40E5EC6B1D01EB599130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c5aca612807e7413a1c9194e43b7136a5901f2a48021b3a067666f2dc33e03e7
MD5 9397fe9dccde35727a2cc641de0af601
SHA1 6e50c6a66f2ddebc7d82459981697d9e45325a50
SHA512 fd3c5fef967d55804c26eb8714da5814b2f8cd84720b2ea69546463623befb756d2600da72509c246522508c3185be4ea879598c79d99f372517947741cbeed5
SSDEEP 384:5iFPZcIusNj8TUNTUlIl+Tkum6KbVBGVRNT6bYA0X1puLeQCoq:QFHumwg5V6SkHT7AsyLeQCl
TLSH
T1F7C22BF258E7887AD9AE9703E77E2D134EBCC063B5846A40F398591CCC961BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa9714f9ea27ccc33ede240f853dac0183da765cd36cb3b6e4ccdda7f48cdd35
MD5 7ba1617668bdd2fdf74ba3a54f8bbd2f
SHA1 63c0f7fbedf759139bd5e35a2ccdbdcca0bc9d0e
SHA512 77d1c02696e3b4bca585033914fcafad877b13d37568004aa583d99dbaebc94ce2c93f877de2d78c8a7b36cb6bbd1c016247baa7018913f0a68a8c967c79d93d
SSDEEP 192:tONb6JkRtQmiUydLW+RNKFCk5dZDh33REU6:tONb6UruW+RNT6bVaU6
TLSH
T1FB02FA35AC386C7B9EF26E05F48B37275FA4117BBA952F40DAE81A1C00D765C234693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9cba928cdfc1a8bb66d21bf5a6f7da5d227778cd3062b0b9c771fd401427c909
MD5 f72731f028147a5db686db71a70de633
SHA1 0df8e3ddfd6efb23e84bcd3972487c2739e29943
SHA512 b7365e33b804a132c703843a8bf3af066005884baa7c345cd4fe5922a30480b5e29e8953e9292ca7a35d13ac7118a5013b48a6973f2de5a2615fdcc7a9ccb11a
SSDEEP 384:FZcIysNR+Tkum6KbVuGVRNT6bJA0X1puLeQCoq:9ymV6lkHTUAsyLeQCl
TLSH
T138927D726C785C7B69F6E505F48B32174FB8C123A6CC6F40E1EC6B1D01DB699131BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f0ab8cf3c48fd540cd50b9a7fd31807dbb0e9092944d3c6f5cbccba3ab2d3bb
MD5 ac5a0e3e6c147ca1b2eff7843a04859c
SHA1 a4586a5debd1103865435f119e7077663d690c40
SHA512 48b389cff52f41853cf22a8cb824f663d56cd95f51fdfb3d05c12e75834437a0fe13035216ebaae22ac47c90d6b41aa5f5679e4164fa4728707a8d1a113e754d
SSDEEP 192:AONU6JkRbQmiUyPLe+RNKFCk5dZc0v9VcYq8BU6:AONU6UNue+RNT6b0AU6
TLSH
T174121C32AC385C7F9DE26911F4CB32135EB59227EA897F40D5DC2A1C01EF59C134E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21aaf771e65cf175efa6cc9c6bdadd15e738c0022b1d7f07b257cec9200b85e3
MD5 4d165ce7af8cdfcf9c442b42c59a11c3
SHA1 124f64c5198b423770dc0d5b0b7fcb769b4fb044
SHA512 35c1cdf8a724d151c233ba511d7d89332fd18b9188eb2190f991c43986c81e3258a579254728285624cf8c34d3a04402f827811f0b11523f2eb8826970b31702
TLSH
T109E00211E35000BDC07C473100935F302EEAA12042F747495A35096E2C377C02F35FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f0e20ec9ac52ac75f79c461042c5ceee4b09f364e0efdd737e0ddafd63b5a833
MD5 636cd65bb00b9535b2de57a93eb7c937
SHA1 c66d7472c8a37dd0e30b4b4a65dbd481991d6db4
SHA512 06ce9a44591afaf5dc6017214ffdbc744fa6068899c0e064b3e27c2c4a953002dea0edf0c7e6cc9c4ffa4e2133baba6bbcdf8367d98ddf55a4ff4726f197cdf7
TLSH
T1CFE00210A150007EC03C073100835B302AE5611042F646485625096E2C237801734FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58d6e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d6e3.TMP
Size 392B
SHA256 0cd1f7d6c9487fc6dbd19b2f658c1ad2e1919bc0c3b015f57d096b499f66a73d
MD5 f8d72f1a59a276af9f8ecc1eeaa6580d
SHA1 154d40075c20a55bb290b062ddc7dcd3a85d5bad
SHA512 75368a8ee72af30a028d0c5a181c67f32453e96d474f33f88e55353473e1291a6415db5b3c96fa200c8ad0339706fca4245558ee47f9c66e78e9020831c178e1
TLSH
T19DE004017150007DC03C07300043173017D1711041F5474C551405571C133400F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

2f332493-e20c-4a61-95a1-df182aee5fe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f332493-e20c-4a61-95a1-df182aee5fe4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69f6bc2cb51173bff30dbb352b6a0bfade6bc7d44f28eb959ebf5b931bec66aa
MD5 cddc81ccfa57b778bcd08f95e77100b5
SHA1 065a7318016f75893d74e0520f9199ddc8b18769
SHA512 fcebd49353cacf30f2b18eb7d1e828525e90f14621296f17e8a61f373b43169a4d4368193503851f48cd0abb9d047d60c5a55f995954d1f2819a0ce42ca1fbc1
TLSH
T1F5411D5CAAE91109B3B76F5AABF6A86D48BF7C772E06D45D10120D4E0623A40C8B2777
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b78cc5c9efc0d5071aab10efff4749612ece2a5fc9abacd84aca1bff14dc2b2e
MD5 b2b8cc0c9ee5f528b826d8b4751a129a
SHA1 92a2c57a999427b2ad9e83a011b96866fc53e4a2
SHA512 6923288318aeda9ed88c6de074e65d4c34ea510e68824047dd6efba433a707f7976d83602be995dd0b84c01d8863accdfa9a0877c37cf01656b956f16871142f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aee4b508e38ec1448bb2740f264725590d8314564fa1f004ac2ee8691db61a11
MD5 37c09c73294c86256cdf328ffb42e07a
SHA1 b7ecca0043e7c3e1f04c1912d9ce29398c25ee17
SHA512 e36db80f9d38afaebf63fbcb444924961f1cd3a4ddf0d4b94821475cb207ce90d2fa7b120e77dd60c61c11002f478893f78e80c020f26357dab988a38caca1d4
TLSH
T1F6D0121273010134C05021332442B10C0800D30B414650466829855D3F064500D13841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe59b0c8.TMP

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Default\Network\Network Persistent State~RFe59b0c8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Default\Preferences
Size 6KB
SHA256 5722f1712991acd0f61925d404dfc49b0c77a9018dd1ec9030f366788d118375
MD5 2c8074cd02215123949c613bef46352c
SHA1 a18ff5ca3d7a2ed19b3b7e48230bad1ea99afe6f
SHA512 3ae7cd2b3a8ff8340c1a13899486fa4e8f8dd20776853b57ca95a80ce3deb541d83228d83f6d080a2684c0865c72f472397ebede00b249ba843be75544aff2de
SSDEEP 96:sty058Ye0b9+ffuZ8i0vhEiklm/7qx+WVHMSm+uecadQjn+gQ8NMOB:sty0K9fWZ8paU/S+Wi8d6lNMC
TLSH
T1E0D1B8035E2869774CC7F619BA35BF42E2FA503225D50E98EBFC861C05E65CD930B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe592570.TMP

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Default\Preferences~RFe592570.TMP
Size 5KB
SHA256 a2ed07954e3cbd3117e622a3acf9d42eece7a08bbc2a52d736f86c5fc4874341
MD5 4c005572ba3ce2fbc62d136883042212
SHA1 87a46d92637636f5ec627dfed60b5c6c2819e932
SHA512 ad2d16440376f31cd0331d7cc9a3fc8eb3635ef42b38343a816754a9e1b7275b66811857082435a818129288fdf74f184cf58703095709a40dc5366e1db448c0
SSDEEP 96:sty058Ye0b9WffwdZ8i0vhEiklm/7qx+WVHMSm+uecadQjn+gENMEB:sty0KFfeZ8paU/S+Wi8d6mNM8
TLSH
T148C1A7035F28A9774CC7F21DBA35BB42D2FA502265D50E98EBFC861C08D65CD531B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State
Size 1KB
SHA256 50977b1a8e33f7c01bab3b746f9f7625215948937f03984e1b661a2d12079b4a
MD5 8283a1dac5c117da3f70861aab53aac3
SHA1 3573aefc853ed0bce636048ae950c9aa0a18b371
SHA512 a883739b37fc136d58f84f47eceb63f0c6cd7622c44b859f17494f7fc53fa4df00da1e8791449cf2a40974dfce7321ccc145be0419fb92f6b6d67cef2fc6c298
TLSH
T17B3185B2D4C0273359926A89F2032BF76D708136C2119E44E1ED1B2C21E758DE63AD32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State
Size 2KB
SHA256 339b590feb9263e2782067398c82af4f96829c3f2ee7bd0234a9a012823e642f
MD5 4ee06d83fd9f3034cd2aa54f21d712ab
SHA1 a87bee12616876551056a72b0cd4ceb35837a543
SHA512 e01c2ae9361d35daa3fd6ff5e9583b3771a98c239641428f84359f2427032c1f406840e3b0628524778b369e8dc9b3b570fca89e26c935bf3a90877da0bad88c
TLSH
T14051B672A84467378AE35A48F9062F739975C17286512F90E5ED1B2C10DB59D6312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State
Size 3KB
SHA256 1b07f8f0f97bab6bd6a8cedb4440d1838032adb61a8fbc29ef9a756951e80614
MD5 5704abcb6be0297ded0fc177caca34c0
SHA1 2f1043e4e737d88d7a018d3a335a04025c02ce72
SHA512 0169e2227d725e94378f25ab0173d5c19bd942699b589b00521c0b26ecebd8ba47063222bc35655aea52463e36b3f025a6b898e7cb246123f24a1baf49b56104
TLSH
T10C71C876A8A4A6374EE39A44F8822B22B6A58133D5813F94D9FC1F1C11DB2D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State
Size 4KB
SHA256 00e4e95aeba2e4784ff1e026cd669c77c2ce35d44d34b5fc51b522f3f0821e82
MD5 7fd9ee3b6c1618e51ac282df05774aeb
SHA1 ec6b35c5ab1ef57e9d1ff49394c83be496efb291
SHA512 dafa20e65772dcbf20d07019be8349ae1ebc42a0393b93072d87791adb3fb43d3062083806e68a9813a339cf0d1e8d9ebdce0ed849a8fc5757ea7dcd018d6bc3
SSDEEP 96:zumbNkCEifXxUcO/eEE8Frh/cInURoDoto+5aVZZDgB5n7U6wzZyd/gZKTzlMa:zrbNbbxVEnooDUhaJE5n7F/IS1
TLSH
T1E091B472A4A0AA374DF2D948F8422F53A6A58133D5913FE8DAEC0F1C01DB2DD2342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State
Size 16KB
SHA256 226235eacb8de11dfabc8ca7b628c5652e343571746b21c0804a4b4de1cdd944
MD5 e113f0dc93e1750cb52375df0d9dedd9
SHA1 c37bac770adefa1e0dbb64fb03de66f16947c6aa
SHA512 9df3943ef39164a701b9f03613b62e14b2644d4aee19851782c272bbd0bf33acfcb5f02589b6825ea18c77b20136fc325368aecf01bf5a84fc6e9c9ac08cdf7c
SSDEEP 384:z/+aQikB+z/xvxjg/qhEwNbVqm57jc5D9zN:C/UxvxjgC+w5PchFN
TLSH
T10E729E3B95687E2355F3EA44F9490B9BCBB9C47380C12AB889ED5F0D169B2A41306D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5885f4.TMP

Path C:\Users\Admin\AppData\Local\Temp\K1mDL7M4OnKJSzoO\EBWebView\Local State~RFe5885f4.TMP
Size 1KB
SHA256 f767fbc25deea0ff6825b58ee0ed3e018f0a95c7054fb2b86e67284b090c1364
MD5 c1418c80d842206b39bab50aa532a067
SHA1 d4aa94022a3c866d688dc945c01317b25f18c3a5
SHA512 8d3ac4aafd4dae3039d5c64801aa3cb02aa1a585a138ae13dd787753dcd8aee372c34c0e9bc0bd4bc1728c4e6d50ba00877986ac4b44f008c4597b98d4d36241
TLSH
T17F2135B7C4C4277759915989F2036BD72DA0C136C2105E18E1ED172C21EB8DDD677D72
MD5 SHA1 SHA512 TLSH

Submit Download

detect-fm-99397693.exe

Path C:\Users\Admin\Downloads\detect-fm-99397693.exe
Size 28.7MB
SHA256 5fd5ae9d8268bc6c47f09516835b2e0efdbf88816dc159cfe094859c776b9ec0
MD5 af1b63416d9dd063c57b54fb47b84dc9
SHA1 1d429217a53612c3f831f7843cd45f00f15589a9
SHA512 7554f2aa068a2291b814cea72d916ab72a0cdf5c2e546344e767e8b4bf00d3c78cb18f53cd8ffa7deab0ce563730e434d5222902986e0cffa8bd49dcacafcd20
SSDEEP 393216:GBkSwiMepkYgC5gZngPEazMqufYaMtqPOTJSKEnxkpTLPn1+jr7mhQ2:8kYghQ4hnPOTJSKEnxkpTLPn1+jr7+
TLSH
T194670A736100C0BDCE485075C290CF0FBD2D28E95EE70F93D8957AA93EA69786ADBD05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3504-1690-0x0000000140000000-0x0000000141CABE00-memory.dmp

Download

memory/3504-165-0x0000000140000000-0x0000000141CABE00-memory.dmp

Download

memory/3584-1962-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1968-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1969-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1971-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1972-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1973-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1974-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1970-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1964-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/3584-1963-0x000002A5BA6D0000-0x000002A5BA6D1000-memory.dmp

Download

memory/5512-761-0x0000019F54300000-0x0000019F543CD000-memory.dmp

Download

memory/5512-373-0x00007FF92AA30000-0x00007FF92AA31000-memory.dmp

Download

memory/5804-276-0x00007FF92AA30000-0x00007FF92AA31000-memory.dmp

Download

memory/5804-711-0x000002E6D2620000-0x000002E6D26ED000-memory.dmp

Download

memory/5912-341-0x00007FF92A8E0000-0x00007FF92A8E1000-memory.dmp

Download

memory/5912-760-0x000001C42F740000-0x000001C42F770000-memory.dmp

Download

memory/5912-342-0x00007FF9290C0000-0x00007FF9290C1000-memory.dmp

Download

memory/6044-1668-0x0000022183ED0000-0x0000022183F00000-memory.dmp

Download

memory/6612-1709-0x000001DEEAFB0000-0x000001DEEAFE0000-memory.dmp

Download

memory/6896-1917-0x00000242D5140000-0x00000242D5170000-memory.dmp

Download