hxxp://pub[.]dev/api/archives/fl_chart-0[.]36[.]4[.]tar[.]gz

Analysis

user interaction
yes
max time kernel
268s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pub.dev/api/archives/fl_chart-0.36.4.tar.gz
Sample260905-caqndabd47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330467692023377"	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AD9078BB-00C0-4170-847A-70B5218AF03C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2912	7zG.exe
Token: 35	2912	7zG.exe
Token: SeSecurityPrivilege	2912	7zG.exe
Token: SeSecurityPrivilege	2912	7zG.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
2912	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4892	OpenWith.exe
2276	OpenWith.exe
4864	OpenWith.exe
4600	OpenWith.exe
4988	OpenWith.exe
4260	OpenWith.exe
1956	OpenWith.exe
5004	OpenWith.exe
3204	OpenWith.exe
3780	OpenWith.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4636	3056	msedge.exe	87
PID 3056 wrote to memory of 2844	3056	msedge.exe	88
PID 3056 wrote to memory of 2648	3056	msedge.exe	89
PID 3056 wrote to memory of 2648	3056	msedge.exe	89
PID 3056 wrote to memory of 2648	3056	msedge.exe	89
PID 3056 wrote to memory of 3456	3056	msedge.exe	90
PID 3056 wrote to memory of 3456	3056	msedge.exe	90
PID 3056 wrote to memory of 668	3056	msedge.exe	91
PID 3056 wrote to memory of 3396	3056	msedge.exe	92
PID 3056 wrote to memory of 668	3056	msedge.exe	91
PID 3056 wrote to memory of 668	3056	msedge.exe	91
PID 3056 wrote to memory of 3396	3056	msedge.exe	92
PID 3056 wrote to memory of 3396	3056	msedge.exe	92
PID 3056 wrote to memory of 208	3056	msedge.exe	94
PID 3056 wrote to memory of 208	3056	msedge.exe	94
PID 3056 wrote to memory of 208	3056	msedge.exe	94
PID 3056 wrote to memory of 212	3056	msedge.exe	95
PID 3056 wrote to memory of 212	3056	msedge.exe	95
PID 3056 wrote to memory of 212	3056	msedge.exe	95
PID 3056 wrote to memory of 4896	3056	msedge.exe	99
PID 3056 wrote to memory of 4896	3056	msedge.exe	99
PID 3056 wrote to memory of 2272	3056	msedge.exe	100
PID 3056 wrote to memory of 2272	3056	msedge.exe	100
PID 3056 wrote to memory of 2988	3056	msedge.exe	102
PID 3056 wrote to memory of 2988	3056	msedge.exe	102
PID 3056 wrote to memory of 1312	3056	msedge.exe	101
PID 3056 wrote to memory of 2988	3056	msedge.exe	102
PID 3056 wrote to memory of 1312	3056	msedge.exe	101
PID 3056 wrote to memory of 1252	3056	msedge.exe	104
PID 3056 wrote to memory of 1308	3056	msedge.exe	105
PID 3056 wrote to memory of 5084	3056	msedge.exe	113
PID 3056 wrote to memory of 1952	3056	msedge.exe	114
PID 3056 wrote to memory of 2936	3056	msedge.exe	115
PID 3056 wrote to memory of 4512	3056	msedge.exe	126
PID 3056 wrote to memory of 4512	3056	msedge.exe	126
PID 3056 wrote to memory of 3028	3056	msedge.exe	129
PID 3056 wrote to memory of 3028	3056	msedge.exe	129
PID 3056 wrote to memory of 4388	3056	msedge.exe	131
PID 3056 wrote to memory of 4736	3056	msedge.exe	138
PID 3056 wrote to memory of 4736	3056	msedge.exe	138
PID 3056 wrote to memory of 4532	3056	msedge.exe	139
PID 3056 wrote to memory of 4532	3056	msedge.exe	139
PID 3056 wrote to memory of 4612	3056	msedge.exe	140
PID 3056 wrote to memory of 4612	3056	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pub.dev/api/archives/fl_chart-0.36.4.tar.gz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffccf63c188,0x7ffccf63c194,0x7ffccf63c1a0
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4148302435191727005,4143586757249318462,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16217845646530230138,15224589487036423931,262144 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,5374100595059433128,1051244975239786867,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8019330970174607544,13159129410498043976,2097152 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5832458311836898019,15446641793466606773,2097152 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,14003710185373900134,5947592804068495988,2097152 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,1125129602352116402,5322661323223018359,2097152 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2325663785587905664,11304488433839980211,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,11017047674618086404,14296476125748820283,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16396724052975736705,11562320467972039577,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,16823638607575715324,3906050752211096167,2097152 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,17825473082376594798,11793871242567719213,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,17825473082376594798,11793871242567719213,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14585136935302852589,8060263642374069057,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,7173280923480612951,15286213871241219712,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,17520706873187493312,13809639481583805104,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,16955924404482122414,10557359254669035270,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10805366234308541579,10727850597859702497,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,18232614251425887091,387111601484709479,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4704,i,5411759860935137029,8541830731954534971,262144 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17726067048344858032,15260726808257989597,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8111683239762631175,4604564995193291678,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15338954562842306955,16148561333229326039,524288 --field-trial-handle=2240,i,16168634731552317258,5484953639043320160,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15358:98:7zEvent7230
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:4696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a6dd18f1c6345928e1983ab4c23d24f062dfe29c28f5020573af09ec262b8184
MD5 f1f2abc3fae4aa0a230ed9881dd84700
SHA1 d5e04e433de8e59af4580961b1fa6766292edf4f
SHA512 fc94b80011366f868fe070c14de7b4a4a942381d2214c07f6decf0951493305179bb3b53389a4fb4ddcc5142d252f535a1489a23b0b9c0eab80e84aaa46d3fe7
TLSH
T13BE026A944CCE23FB3486487816C470CC2E03B6B92CC6B0A1708A48D7412098E7A7BF4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e7653a0f42778de4cb1284991a9e88ba20b26ab3510953935e0740b754f66ed5
MD5 6e2c20648acac0e98bf40f3995182ab3
SHA1 3aef49124bc7c6be3061e6189a3049b8a0e305f2
SHA512 4297ef7570847130ddeeb3185fcf18ab4fbfeff5d0db005114414ee345e34651bed797bd43d9189a65959d04b6376631c2f3d6c51baf14d54c0480b8bbf71a11
TLSH
T16961C6750B10C4ECE79031B098E932927872DDEAF4835E4670735EB1FA05F5149EA1BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f98297be6539c65c14b54fb158ffeec9e55f9f7095158a6b18080c72fdc755ba
MD5 d8d06e15ebf6ea74cef1829c8398f838
SHA1 48d8f2b22997cf56e2e9ae90c6884aab5748b2e5
SHA512 cd86257fc87e0564cf31a5f7df7873f1b4b2ff371454f9061ef532533c5c626266007e056bbd1c62d4bd3560388f116fdc71db12660879a70645d464f4cf665b
TLSH
T1E6214CB3C3D586AE890556F05E146E1BCE2D0906421C7C5A89D4EF2B97F3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 39a05202e01192f9cf0147198d25cdd1a91fb0d712e57c6373a8f1d1c7531257
MD5 e00ec2ff8e2e0e7353beeb8a3ce75c68
SHA1 57c4fe744664f5da0b2d982a420c5311271bf8a0
SHA512 d0762c871336d9bc204302d6b99daf914dbb7c703fe9d61d27937d1e79a9056d567550b4168f7d84783e2fd9a98d066a67d93f8cb8880c6be4dee99f560a6798
SSDEEP 192:sxZqR+9u/fCs7QlXCiXzVUIdpJHW6+WNGYvxBcUUIgrJ:sxZqGu/fCsiyiXXJHbGDz9
TLSH
T1F722B8116E28A9378CC7D21DFB15BF53D6F9503261D11E58EAFC961C05E66DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cdc4de6210cd7abf1a1ddee9ab9a61f26297e9b1573bb90739c1ba2eaf384edb
MD5 d95b3f06a632655df5b60fdbf8228c3b
SHA1 76cd1c11b4d1cc7405970795d4a28894818b4911
SHA512 381796dd8bd6e060628883047b22b6bc77752b8a2d623e239e1059e6d7450cdd99c395e7feaf3bda18692e6a86662f7b43354e0c6c71d759cf4744296e3d637b
SSDEEP 192:sxZqR+9u/fCsEQlXCiXzVUIdpJHW6+WNGYvxWcUUIg5NJ:sxZqGu/fCsfyiXXJHbGYz5
TLSH
T17E22B8116E38A97B8CC7D21DBB25BF53E6F9503261D11E58EAFC861C09E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bc349baf25311eb7c461667f4825a10059ab5f2ffbc30de4c2e0b9ccc4c10832
MD5 738f34fed0308513c50c583cb7bb7995
SHA1 3ad66c5c8bbf1834ed07b766911339d0f914895e
SHA512 8a3be019db72347438ab31420e55f750fd1509d507fa0eef2dfe02a914b3a731415856d32fceab7281f0446ad6a6f69c381c34d615d9fe3e50d10cc0d9e7b2fe
SSDEEP 192:sxZqR+9u/fCsEQlXCb1XzVUIdpJHW6+WNGYv1icUUIg5nJ:sxZqGu/fCsfyZXXJHbGezP
TLSH
T1DE22B9516E28697B8CC7D21DBB15BF53E6F9503261D11E58E6FC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 456ae2631449e91e4f18691f12b5c613e509f6e807adb3d71ae70ccaf0e55482
MD5 749fc56491b0c6105b4fe2eaad1a4d28
SHA1 3dde2424bc368bfea5d85929d57ce83f543e6053
SHA512 115771fcd64517910287d00439e17968dbb14743e3fafbde7c57aef48e675eb45861e15642bd2f5380e60baf788f97f02014bee77de24e0e443a157e6f53a706
SSDEEP 768:1Eee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbcroq:1Eee3rxWvhffnu1jatcL88bHq
TLSH
T10CC2FA2B640CCB7E4FC00AADDC5A6FD76FA802C7A7548D4087F9994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ad04e564c93f6dc7072f67f9592bd0d12110da4eed252d24d3b29648e6158c6d
MD5 6671ca9e8055d55d951541e8d0725a64
SHA1 5326bf78acee114578a5dadbaa12acb1ca2271ac
SHA512 2926347de124069f10a50e89bd3aba4be3f04419f172b860c485b3b569d316c5899ac2abb714f6f95cbb2d4e4f5b0f6e0c12a5d790d7bef9e3d871bfc57fd442
SSDEEP 192:49xdjM90PzFjfIP2zrNSSRa91+HfYXvaRFvBhWlcx9ToSvkH/09a:43B27L
TLSH
T10CD18416703A0642397D3D8DB5A1963B0F8132A37054E9AF7FB804660E6AE255EFCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95595694-695b-439e-bd21-7e8047da7248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\95595694-695b-439e-bd21-7e8047da7248.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 01e31de7ac1df2ded7a513e61612b67f18844df557eec44feb2647e1fcf13dad
MD5 f5dc039cc8a2d850fbb960a382d4b74f
SHA1 0ac7fdd13c8ad3f21d8f989cc4e14081381909e4
SHA512 62f6cbba09c9ca3e8806f87ed630576e45dc114418fef9a79a8a492ed9a6cebb07fdb7584c41555f35963fba6c6e60a175cde4e321ef65d0e95b0c2a1642e478
SSDEEP 192:uwm+xasuheOwQxMGsNKrQ+YmM7+3hQmiU1bo/B4MTAn+FdLQx6ptFd3EG8z1Aqal:aZcIhsNKrGb7E/xeukdcxMdUn4hT
TLSH
T1BD626D315C389C7BA9B3B146F18A3A135FF4902BF6C85F80E5ED6B1D05DA2A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 08a243f27ad55172c50fc33608119b03f403f3736a0000a54955e4f04d572a0d
MD5 24f21d9155d4284c55862019f7943500
SHA1 d45bf04cb858fab6d2793099e6471ee9565a1d65
SHA512 eded58eed84547ca3cfa229d526941f4d9e58df7204b84b29605a252a00be49689235c1f5de5d99904c349857c61cdf8ceb82921601e9cb19d25a8727970c230
SSDEEP 384:FiF4ZcIosNS8TUNTUlIlgGb7EEDxeukdcxMdU/4hT:MFGojwgJReNnU/4hT
TLSH
T1B2825B724C68DD7BEEB7AA45F54A36138FF44067E5C4AE90F3EC5B1D01961A8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7197c8ec24693d05f410e4540937224531f6cd2bc52526760660dace42e1efd1
MD5 2ad8cf743690efecbbb644276e45cc68
SHA1 05b582f2b162ce926effd4938bb0e63584752cff
SHA512 a9e3afa5034edc1440533e76b4804f89e4942ac3388b1b7cffd7ac13e9fb65e5e5b65c964fa4c351be26ab6a6d8ba66b654a27d3bff8200cb8650c7398f58762
SSDEEP 192:uwg+xasuheOwQxMosNKYGQ+YmM7+3ElQmiU1bo/B4MTAn+FdLQx6ptFd3EG8z1Az:wZcIDsNKvGb7EEDxeukdcxMdUn4hT
TLSH
T169726D315C789C7BA9A3B146F14A3A135FF4902BF6C85F80E1ED6B1D05DA2A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ccd8deb998fb3a563b0f49e1908016f8302e361f34da0a52ffa4e66b904b1a59
MD5 762e87d768e5b65da046f0e7d8b1b565
SHA1 ef54d2d75cf13779750e399b9d3b95c5294399e9
SHA512 059e40421c8fc8a7f4b304f90cae4c2561143d72756208027c91965855c42ac3d5b4ff62366cac217e9cbc53a72d20232ec85d916ff41243a94da35651262398
SSDEEP 192:uFg+xasuheOwQxMosNKYLQ+YmM7+3ElQmiU1bo/B4MTAn+FdLQx6ptFd3EG8z1Az:HZcIDsNKgGb7EEDxeukdcxMdUn4hT
TLSH
T16D726D715C789D7BA9A3B146F18A3A135FF4902BF6C85F80F1EC6B1D05D66A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b444acf6a3462a667610e78bd23a0802c8f6195549b8dbf871ff88c7486ed88e
MD5 f6d1a9ab2f8a25b1f6c31f9903bd76a0
SHA1 27f9c3db17354fcd5aaea8a234d998fc792b7122
SHA512 695a1222eaaa31fcf3c3d22656361510d8f65f0d10729bc1a364504ff501ab5157eff9dc8d2ed67db3a0939626674f656877b2c92a6986bc22f6a9ff6352fa53
SSDEEP 192:lONb6vMtPQmiUyF+ThTAn+FdLQx6/847kMU/u:lONb6UtRPT7dcxEJU/u
TLSH
T186020835AC786C7BEAB3AE46F48A37175FE4116FA9D01B54EAE82F1C00D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e1d11f08042d721845503a32fbce93e66c311a9f6334aa3e4cf1ba2e0d975a9e
MD5 a1482ea36c234593556f93f9199f55be
SHA1 82e8122d5777a2e318a934d7e35fbca0ebd48090
SHA512 de94dc85486c3b954798090311d2fb67ecc5ca64cb7715560a8b4a1452b241f0f1c8f1797e880fabc21bfb57a83d08599bbd6249927f9e38b3fae61f23312367
SSDEEP 192:IONb6vMhPQmiUyvT+KhTAn+FdLQx6ptFd3Ej80IAqaU/u:IONb6UhRM6K7dcxMdUU4U/u
TLSH
T176121B31AC689C6BAE93B586F08A36135FF0916BEAC46F50F6DC2F1C01DA69C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8fdc8d7-d08b-47a8-b4d3-cecb9b1601e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e8fdc8d7-d08b-47a8-b4d3-cecb9b1601e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c96b5c1e8658d1c75330b5a5f9aac0caa49ffce41e92b93d20280c2b254303c
MD5 d8debd9cb65d40495481abc15c290154
SHA1 e50195814bf2e6bc4a4d0f29f8265ad6b2504199
SHA512 6f493bd44e9741fa5dde7a313a864b729a16baa1b1dcd541c61449fdcd05ea6dcc49c8fd05ecec60c5e979f8efe9cbc6f5dc8f0f08482ecb44fcfeb6a8c80aaa
TLSH
T179411A58AAF91148B3737E5A9FF6A96D447F7C672E0B91AD00110D4F0A63B40C972733
MD5 SHA1 SHA512 TLSH

Submit Download

fl_chart-0.36.4.tar.gz

Path C:\Users\Admin\Downloads\fl_chart-0.36.4.tar.gz
Size 25.5MB
SHA256 0c8baa9d4db70817d27099efb99e40e4164448bb86f73217216ef65b3976bc4f
MD5 31b54cffff428d62ad005163eec2f3ec
SHA1 39c97b3a76059d65fed765393a9dad2f071d0aad
SHA512 3f64190022b85d6408fc412cea3bcf97016f44d5343800ce1e4846394de9bf42213bc42aea60adbcfdb006712ac56618b66b9b45b0ef3331e52c51b935e3acb6
SSDEEP 786432:OL1Om6/4i2KDhnbL0aBVzVHCRdAG1msjHpwL:GOEKDmaBNFCRXjy
TLSH
T1A2473337FC71032B0539EA1CB27FCE210ED87980A5A20D9EE585CDE59B8C5ED529CC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download