hxxps://cdn[.]discordapp[.]com/attachments/1528107119344357406/1529794180581163098/Lumen[.]zip?ex=6aa3d4da&is=6aa2835a&hm=0f6d25c039ee65fb3aa529321985149fb7e4913a459884110baab5635b8b2747&

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
900s
max time network
639s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1528107119344357406/1529794180581163098/Lumen.zip?ex=6aa3d4da&is=6aa2835a&hm=0f6d25c039ee65fb3aa529321985149fb7e4913a459884110baab5635b8b2747&
Sample260910-vf9ybasfnb

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
156	3448	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	winrar-x64-723.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1880	winrar-x64-723.exe
4184	uninstall.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240846515	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-723.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-723.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-723.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335330476345051"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1880	winrar-x64-723.exe
1880	winrar-x64-723.exe
1880	winrar-x64-723.exe
4184	uninstall.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1128	3260	msedge.exe	85
PID 3260 wrote to memory of 4440	3260	msedge.exe	86
PID 3260 wrote to memory of 3448	3260	msedge.exe	87
PID 3260 wrote to memory of 4440	3260	msedge.exe	86
PID 3260 wrote to memory of 4440	3260	msedge.exe	86
PID 3260 wrote to memory of 1980	3260	msedge.exe	88
PID 3260 wrote to memory of 1980	3260	msedge.exe	88
PID 3260 wrote to memory of 1832	3260	msedge.exe	89
PID 3260 wrote to memory of 1832	3260	msedge.exe	89
PID 3260 wrote to memory of 1832	3260	msedge.exe	89
PID 3260 wrote to memory of 4716	3260	msedge.exe	90
PID 3260 wrote to memory of 4716	3260	msedge.exe	90
PID 3260 wrote to memory of 4716	3260	msedge.exe	90
PID 3260 wrote to memory of 4324	3260	msedge.exe	92
PID 3260 wrote to memory of 4324	3260	msedge.exe	92
PID 3260 wrote to memory of 4324	3260	msedge.exe	92
PID 3260 wrote to memory of 4772	3260	msedge.exe	93
PID 3260 wrote to memory of 4772	3260	msedge.exe	93
PID 3260 wrote to memory of 4772	3260	msedge.exe	93
PID 3260 wrote to memory of 1692	3260	msedge.exe	97
PID 3260 wrote to memory of 2880	3260	msedge.exe	98
PID 3260 wrote to memory of 1692	3260	msedge.exe	97
PID 3260 wrote to memory of 2880	3260	msedge.exe	98
PID 3260 wrote to memory of 968	3260	msedge.exe	99
PID 3260 wrote to memory of 968	3260	msedge.exe	99
PID 3260 wrote to memory of 772	3260	msedge.exe	100
PID 3260 wrote to memory of 772	3260	msedge.exe	100
PID 3260 wrote to memory of 772	3260	msedge.exe	100
PID 3260 wrote to memory of 4104	3260	msedge.exe	103
PID 3260 wrote to memory of 3356	3260	msedge.exe	113
PID 3260 wrote to memory of 3212	3260	msedge.exe	114
PID 3260 wrote to memory of 3832	3260	msedge.exe	115
PID 3260 wrote to memory of 3172	3260	msedge.exe	117
PID 3260 wrote to memory of 1564	3260	msedge.exe	119
PID 3260 wrote to memory of 1564	3260	msedge.exe	119
PID 4420 wrote to memory of 2344	4420	Lumen.exe	124
PID 2344 wrote to memory of 1028	2344	msedge.exe	125
PID 3260 wrote to memory of 4708	3260	msedge.exe	126
PID 3260 wrote to memory of 4708	3260	msedge.exe	126
PID 3260 wrote to memory of 4708	3260	msedge.exe	126
PID 3260 wrote to memory of 2724	3260	msedge.exe	127
PID 3260 wrote to memory of 2724	3260	msedge.exe	127
PID 3260 wrote to memory of 2724	3260	msedge.exe	127
PID 3260 wrote to memory of 620	3260	msedge.exe	128
PID 3260 wrote to memory of 620	3260	msedge.exe	128
PID 3260 wrote to memory of 620	3260	msedge.exe	128
PID 3260 wrote to memory of 832	3260	msedge.exe	129
PID 3260 wrote to memory of 832	3260	msedge.exe	129
PID 3260 wrote to memory of 832	3260	msedge.exe	129
PID 3260 wrote to memory of 4500	3260	msedge.exe	130
PID 3260 wrote to memory of 4500	3260	msedge.exe	130
PID 3260 wrote to memory of 4500	3260	msedge.exe	130
PID 3260 wrote to memory of 3172	3260	msedge.exe	131
PID 3260 wrote to memory of 3172	3260	msedge.exe	131
PID 3260 wrote to memory of 3172	3260	msedge.exe	131
PID 3260 wrote to memory of 3236	3260	msedge.exe	132
PID 3260 wrote to memory of 3236	3260	msedge.exe	132
PID 3260 wrote to memory of 3236	3260	msedge.exe	132
PID 3260 wrote to memory of 1624	3260	msedge.exe	133
PID 3260 wrote to memory of 1624	3260	msedge.exe	133
PID 3260 wrote to memory of 1624	3260	msedge.exe	133
PID 3260 wrote to memory of 2428	3260	msedge.exe	134
PID 3260 wrote to memory of 1280	3260	msedge.exe	135
PID 3260 wrote to memory of 1280	3260	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1528107119344357406/1529794180581163098/Lumen.zip?ex=6aa3d4da&is=6aa2835a&hm=0f6d25c039ee65fb3aa529321985149fb7e4913a459884110baab5635b8b2747&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff84b0dc188,0x7ff84b0dc194,0x7ff84b0dc1a0
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,8407031535167203973,4163368658970513607,262144 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17135688837010120530,2029356995236675650,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,18008429698170865960,8291133399718189887,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3020,i,2205580816456009889,3196471027344280181,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1252387250584922922,17100044266497301405,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,4345630210915617007,3935787963882899242,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,16361696921194335387,3908756919484156779,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,8484266212253879164,12941157547737726174,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16076942028044948757,3331050432377518283,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,15996820663082692063,16323744052097470879,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5704,i,10904047401732770562,14157094014609154767,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,8632007181310175600,2628356821275657892,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,8632007181310175600,2628356821275657892,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,14944913683843774120,9730077875093746022,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,6003956617913765929,10506433925071916811,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,6853990152956250613,8309985460122507176,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,8414330713987379225,3463280793319066840,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,6017974216926363724,7299723008274481869,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5844,i,16543658342963971338,3617283873424738909,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3976,i,9554285370223623219,5930529630919446585,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4368,i,16546934275788481293,13457309164160496995,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6944,i,11286048548672599115,13769810823831179626,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4788,i,9716700119036975489,7740644928884363277,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4420,i,17302461364267078582,7927861337562958039,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6896,i,6588772829661132891,11357161570005528917,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7056,i,3546489046500422105,13876024003672602452,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,17792828527661955842,17603535277749682893,262144 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6884,i,12543142145274433133,16562421320826619504,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11205713458099855596,7740169863727102211,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4040
- C:\Users\Admin\Downloads\winrar-x64-723.exe
  "C:\Users\Admin\Downloads\winrar-x64-723.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1880
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6912,i,6082059703300396973,16697870457148065823,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5596,i,1532597271144177342,5804507579636731685,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5836,i,2632548374516572250,3273869448650101755,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4420,i,6544863017829111728,2053427707078308873,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7116,i,14087906435035353023,18385061848942689759,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5176,i,9939453783275317092,14336087368477791669,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6288,i,1530096108007921680,11797896842774235202,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,13687249814527110144,16571995831108737260,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,3504215181002381742,7826032047813048467,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,12089136762558377821,8593008747881584921,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7448,i,16878729023507507531,13592847656327820914,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5900,i,13441834597410649566,14129110820052450370,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7544,i,18026980860822453913,10494300818546529823,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7436,i,16569421361973061636,11623232378882824389,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=1228,i,12394785042876614876,55159392736882372,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,14866523647717321365,12395645058975113661,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7012,i,10556837948173889017,5080867257450608269,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7964,i,213363592636119866,3282949789355463213,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5176,i,16163830849512251404,14703053475666465263,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7732,i,4874419776098307649,5878888711901048812,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8040,i,10379054181602887719,12711629845537209508,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7880,i,7738505333499530908,15532007495671859070,2097152 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,3427693641075703830,9912080102535204447,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3260,i,11143290282900054558,369102628620311632,524288 --field-trial-handle=2052,i,18085669123970958770,3194738468753412599,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3452

C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe
"C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
    3⤵
    PID:1028

C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe
"C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe"
1⤵
PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
  2⤵
  PID:2088

C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe
"C:\Users\Admin\Downloads\Lumen\Lumen\Lumen.exe"
1⤵
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
  2⤵
  PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
MD5 af2f59a1c3b3589c2e1506ab00b6148b
SHA1 87532b1ad6421f5ed629b4cabb096c1a23f24a33
SHA512 f6684c3f2af9801b62e2c1402a8621ada4cd5087844de7e6b36eb5e48b0d023aeab875c0d1cb3a34c7587a2a3c1af296a4a67e71312e371ac819dd00486cb5a0
SSDEEP 768:xodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:xodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T169B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 413KB
SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
MD5 3950935f79f37787312cbaceef88439c
SHA1 cac58c62f23ced8c2e075d53e7083585ab7ec674
SHA512 eab00916e65d8155afb892959b821e2ab49ba665b9d0554044c6bf59580ad772c51b1e4d5875810a8a21cffeb8a0509663c01dc8d78fabcebb10c98e79cecb15
SSDEEP 6144:F1M1lgZJyBGLRx18VFtq9V27SCrJFSO6pXLR2III+Sn5HBK7jcR0IA:HM1m5Pwtq9VSrJFggIIvS5ejcqH
TLSH
T121949C1AE7A455F9E5B7D13CC8924507EA727C558BB1C38F03910A5A2F237E09E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 64KB
SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
MD5 a1bee36438565456368f497fb69195d7
SHA1 83940cda35e775151197f08531bd445556185889
SHA512 35db801d5194fd21481203235c3a00adb60cac8c8e359c3ec06d75d8c50ab23d5cc4d4f1d55286ac9f90d1997729d3e0398994ef38714e69935c9391d055aeee
SSDEEP 768:sMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:sJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T1015394237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A6D2F72FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
MD5 b2edb6e0812a75b601019485047a17a0
SHA1 11bc174397b42e1b96f531def552d3b133a5a34f
SHA512 a09520a3ba484d55bd7efb89a7f2c409d7056ff73bbb018023de86ae2f29f5ad28703a7e9b3c77120247167c6c6bb3ccce45715198618db1bf38409f1d0e1a0e
SSDEEP 6144:A0W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSz:A9iygYuV3f3j33cKo8oDfyo
TLSH
T12964121E6D9E8131E4E57E71EACC03DD2320782940C27B112D5FE9F6A5D8FED8168798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
MD5 51f6a6e10dcb9452f7357aa7aef19bb1
SHA1 2daa1a057f592d5e2d1446ed1fdf6cef8a0d7e9d
SHA512 99a963fd8018044e9a606179a7666a7aab86cb989ef76a3bf99d78b42f6d09802da2f40a7f0c4cc70ef6f95fffa0b0b767576e988452a5f269ca12c5dc5ad4aa
SSDEEP 49152:I7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eQgXUeT+uXEkjNEEBHLu:7soEC9/a+uUkjDBHLu
TLSH
T199F59E0AA7E406ACE0F7D679CED6C553D776B80D07B0A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 145B
SHA256 722b5db327c5e7725754cfde837c6c95dd8ab0977b72c8aaaa335c222fec7a09
MD5 4346067a35b0dfdcb1ea7f31785ad412
SHA1 2d1f2770b97d0281c685673c51c6d94864db3279
SHA512 16ceb51c4e17a8afb29991d85d45e2ce989d3b8a0d7bbaa7dba6d30d457288931fbdd74a718a588d07abf28306ddd337e93e007beec059dafd70990e6c407230
TLSH
T147C08C8419E6C22BA244A94A03244B0C8A80360A86C9664E030494843081485E986A70
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bbc55055b2e132b782ad63b58c26f55976026d2d7fe61006faad904187aca725
MD5 99ef2419bb1049be2e6e9056c71b5117
SHA1 5de52d21b13ecaca084889aeee5d6c3834c4da3d
SHA512 3e4706a0fc21c60a1a5a2bd9716af5c179c933b03ec65290d84e527bbc1ae406b7625b0625a458874a448ad0d3bb1b015f80a19aef5d3ce019f1465193a3d166
TLSH
T10AE0809485C5C77ED254679B827C474C87D03B0E96CCBE4E6704A894F54158466F6970
MD5 SHA1 SHA512 TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 23KB
SHA256 dcd12aaaded68506614fa5d19923ca445bcd42835dc6d2b5a99ed69c85b385da
MD5 fd354823f871531dd9aa65428efc4e80
SHA1 5bc5f904c8c191d2fe3a1fa20e3af594b7bbe6db
SHA512 54cc81484420ed6567ed6f70e714ac1b6600e0521f68641a036ed2f5bd5d16614df9038fecebd672185eb6086a3ff7ba3cad3d216b7b858150a4223094e7de2a
SSDEEP 384:WjCNgZXqil52jRTPHh6BQmy8Wep6pmhB9BrHEIVrwCYlERTgfJPybTqc0xekT:WGNgxqdj1HhNmPZ4pmvrkIBwCYlyO03G
TLSH
T107B2E268FDBD4174C841989C6295633950CB35D2233791F31DE9F984F56332A24533F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 29KB
SHA256 777efee22cc03118f4e5ba78aef0cf7adb1e8a13fc2b5c60fd220e80472f0188
MD5 fa20d8437865646e82dc61b9adf6c93e
SHA1 936b2b3a3757eca48867cf43badef1c608177a28
SHA512 81c77e1a7b29d089ef10056c10aac8f696cc889499d9b68b40550e861173557edaf39049859188fe9eec55f69b3b22b05044afd8b6b212101ec792a7fd289f02
SSDEEP 384:vqVmdqPCM85TevWTS9XJbgB2EttwJ52qjCpG6XUcUsJ5plH94VYb/n9SjXjwPG6G:vqUdH5TevT9Zi2CtE5FcGcUvq9f9tG
TLSH
T183D2F19C7EABCDC67051CB224DC55B4704B5F50B68AF4BB2BA6D229D88D20F7210A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 75KB
SHA256 943928aa9be1eebe4cd34fdee07751ac1c4aa4b7874e22c12b9a1521dc82d83f
MD5 d07a2a9f25ca26f04531696e1a3a9463
SHA1 980f7d8aaaea9e8d59c98b469af1211f06107c5a
SHA512 abc081aed102326bf25005528e8c247bbf0e1519668e2f485321d41550fe87400cbd9553fe66fa25ae03e238089378738a3445e3b5b3d88cc11ad6f1f3010f8d
SSDEEP 1536:XMkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTX:j0nXnHdfRVEASB
TLSH
T1167302E63B6C4943E03D6460708ABE9F104B3AB42FE057E5C876DB7F2722992B71552C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc94d91ebfb5b719_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc94d91ebfb5b719_0
Size 307B
SHA256 9c32fe1102a8844d7f1a332a262c5ede62ce8645d9a38dfd4e6d9a4942d06314
MD5 af1aa325c574c814373fdb65c26e9ae7
SHA1 c729a97877b75d1d12a0466f32a91458211409c7
SHA512 284b17f265fef0f11f12f89301284f0df43a7586d2c92adde1dc94491961d981a85d19968e53fb239ffd1c3edba3c2938f9a662d53956cfd09f774195ef6f8a4
TLSH
T117E07D4BD13419C9D705C4FED627D6999181447E3099A4D0D569C8321021574C24F224
MD5 SHA1 SHA512 TLSH

Submit Download

eb1f997823564b96_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb1f997823564b96_0
Size 34KB
SHA256 1a905bf738c129eb97246931ff6bb4265cfa42bb24d075e74816818cc90a6f1e
MD5 6d0c14ce243958b7c54598599c0c05c2
SHA1 3ddd4307022ff466c87b56d50a0137ad5eb6f3b1
SHA512 a9a85ab413b1be86eb018d85d9ed85ca57f2591cb13856a6a2e7eee47eeea085aa5f136dd75cbb085f632ea3a4748ffa42b73b6ae67c4eec4118527c575271fd
SSDEEP 768:CNBtaIcL4MdUm+x5l4yWKvsbSZBqzT5ODLzrwv:CNnaXL4iUXHCJxODLzs
TLSH
T1C8F2E7C55B95BD1ECE2753F941A28A2EF33985893F83E32B24D113352C547D78E8A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5b174a1cd1327c8f082b80dee630f7e5aeb08002341c61d02d647bde92b757af
MD5 6aef5f4982775c2acc4b8c1d18cd7e0b
SHA1 69bf31106c0fe565776b153f4594d37d2f79cd11
SHA512 ff083c02197a614f42fdea1f392b9a60f4d3b13d667e3bc4ccd5f54b7976b836819345597ec0e2250de933c28fb9b119dfb6ed4149646392b64c9ca297f6a3cf
TLSH
T1F27182380DDE66F5E721C0F298E10359707BC9E6F9335E5EF290DCBA2A827F25118126
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b13848238b09e00d9d22200b818d6d804c852718a059d8f09e7f2d33ea383b52
MD5 545663619ba01b66243b1fc8e088d9e2
SHA1 0a69a6da239f6656f6cdd2c24a017918ac54de1f
SHA512 dd20d9770003eedb22e6a9ade9b90b5f20021e6fe51cad040d825a9b6f79dad21045cf1a1bfd276184f6b98842c64910aa302822da3674c6ab15f43c747c6350
TLSH
T1627183340DDE66F5E721C0F258D20359707BC9E6F9335E5EF290DCBA29867F25218126
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 99482bde346e9865aad02ed46c0bf57ba22633cca3913a01843d267affb99b42
MD5 5b1d12c38b5c5f506c000952ed578d98
SHA1 65fcc82acc32a77f7f5b2c62f0b300c7949c1e0e
SHA512 980041cafeb4e20752f435dd94156df9b6e70d1cdd30a572f269cb52c8c465f212b4673da0cd85bd8d1bdf2530a14006c40493a2b3f9564ab22a1bc56d929933
TLSH
T1BA7192340DDE66F6E721C0F258E20399307BC9E6F8335E5EF290DCBA29867F25119126
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 703fadfad1fc809c950698f3514ad07e53e160df516bfd5c02b00fb53fcb471e
MD5 ddcddaec076f37bec5eeff0b3d912573
SHA1 6596b6df740db05319ecbdb433c6efe0bfe1d246
SHA512 6307b09edf1ae0cd184037548ea1965b52c1d0aa4a44d10bf269b2efa6eba18a02956711b3325500d7a7212bdaa551055c7cb8efdafc7d31519246bdf5cd2d86
TLSH
T1CD7182380DDE66F5E721D0F298E10359707BC9E6F9335E5EF290DCBA2A827F25118126
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e411f6e02823e38d5ff5d0afa081e6bcd8850c2cecc973b4bdd22827538d3bc9
MD5 eeaf4b750e57eabfbd4cf1d3b401dfeb
SHA1 b78b2bd52730216ab2eea30b553ac1e36574e134
SHA512 8ec67a3602027bcb712e31b936cab6d6546f0d4b9e5820e23ea2cdc09cafe3b1bd1795b3c49d072f8bf19111564f718c6ea10a52ea5141ab6bc83222b27d51a4
TLSH
T13E7193340DDE66F6E721C0F258D20395707BC9E6F8335E5EF190DCBA29867F15119126
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 90f1f0474e1022f398ddaaf3ed58b9d3bf99a912a2e83be97e09cb53673fd483
MD5 458a48b302a92c38e9cd738b942a76b3
SHA1 734789ef2e72c909cb5c4cde4f281cad9fbd491b
SHA512 c5e3b61051307f1474701e53c5406ac243aed0406ebf8505917fa04c4a74a0f257c03687a8d443251eb9d865422bb8e4fe2b582e16970da4f2a7309e5d1d14d3
TLSH
T1AD7183340DEE66F6E721C0F259D20395707BC9E6F8335E5EF290DCBA29827F25119126
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e28fdc09781ddc765c4eefc8a363a4c6aa41b50f486be68ebb58ad3fba7b942
MD5 8bcc15cc4312e22b541c305f18326768
SHA1 cfebc2bada7bdc36e309d16ff1bc7298bc3cd9be
SHA512 6b424b311511e86a6b0d569256dbf99419717012fe75afcbf120e7fa0dd83eda51146c16490c800fa278d7b485fc3012a33d1fa2730c35190e83d4b3f8b1b282
TLSH
T19F6172340DDE66F5D761C4F298D10349347BC9E6F9335D4DF290DCBA2A867F1511812A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e5a8af97cb40fe5959820590720764819775f6a01d3ee5e1f73f0e381ba31271
MD5 dbfdce31ad46f6ba21abe16fcb57833d
SHA1 8efb04eb243f79fac9e548c604b5750c82a64346
SHA512 14ba65e9f3ba0dc2a5265a5b776643e3274b06ea5f86751a41c51e6fb98c8a69fd9847ebd48d1de6000e7d8adaf65cc8f3f6094ddd677045c5a5fa298abae52a
TLSH
T1D3318CB3C6D48A6EC81516F06B147E2BCE1D091942283D2F89D5EF5BE7E34B2E10254F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dc9881c0439d32b2b610107a80db3c0bdbd40cc341bbed7f8873bbf2991f372a
MD5 94dbfea6a219ced6734ac86be4a0f7b2
SHA1 8fcabfdd1c8176f4345df2ee4407b7b28598b72a
SHA512 c4c673642005d9b0af949e12200d102f94da63d1f0f8c531314516ab00e15f5af03e239e500343717f2905798cfbd68cd3a98602a86099dd8948f23ed0b2605b
SSDEEP 96:DZ/OwSNfp+aCeOYzBV1uwB5BvuqjvIvQQGpWi3ZQ1gi/j4/L4:DZWwSNfA9eOY1V1uk/vljvIvQQGki3Z0
TLSH
T105917BF687B0866DD91151F0AA046E2BCE6D0429536C393B89D5EE87E3E34B2E14174B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a2146d2bfb02d9d6a82d24686ef1aa1ba275cc0b5fe30986e06a14dd4a4e9600
MD5 ade97b731c4ef69475668a80f6a79bcc
SHA1 63475e834a9663ce82ddb286169a7a1456e33b23
SHA512 baae869be8f7596dde1c4156b1ad9a7dd04860105552517d8aec5cdc77a480bd6bbddb9eddb8cca9abdb8ccc2273eb6736600065b1f7ae2385e830aec3c4661e
TLSH
T196318CB3C6D48A6EC81516F06B147E2BCE1D091942283D2F89D5EF5BE7E34B2E10254F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 97206601f3244a0a2a602086f46972bf3ba72590d9557ea1ff40a928549ee88a
MD5 65a642698d37c057d5752774e1a0d900
SHA1 b77886490210085e3b22c8503392ad363b59afb0
SHA512 9d21501bcbd4bd9dd05e837c8cf306852f1db1e63d2d377f8048d901e15eea5283d8d4ad9c3a71f7eeacf17303710e71c8d8006507ba425ba607a7f85778f0b6
SSDEEP 96:DnMOYcN+pkkC+vzyt1uwBjv3vQ52QIHIpWi3ZW/1gk/uM:DnHYcN+Ov+vWt1ukjv3vQEQIHIki3ZWH
TLSH
T1CAB18EE7C7E48B2DC91156F467142E2ACE2D0919522C3D2B89D5EF8BE3D34B2E14174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2abe408239f40b9c07dc1a94fa81b5c8a0f9e3449f2b2e470e817850c0feb308
MD5 4609bcc8470695e4e0182eea2cecd98d
SHA1 c23334b3767bb4c97426f1217d04aa51a871b733
SHA512 3bfdf0d99386a3ebe74a7324802c2d932a42669d3c2f130e9d5716c6c15e364cdd9b012a42d41590875a0949260ae7b756038157dc6ada48b72436e87d1a85b6
SSDEEP 96:DZ/OwcN+pkkC+CYzBV1uwB5Lvjv3vEQopWi3ZuQGus1gU:DZWwcN+Ov+CY1V1uk5vjv3vEQoki3ZuR
TLSH
T16CA16BF7C7E4876DC91152F06B142E2ACE2D0469522C392B89D5EF8BE3E24B2E14174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 10a794b3320d151eb8f80743dacb815cfc6756a0878a45063fdd40ec3325145a
MD5 a4ac97f338a7a741603e2fc8ebed7385
SHA1 0df0765f8ad09134381a5d88a5613dc924730272
SHA512 ffa666bdf76eb3ce55a172371a37bdbf727072ca862f7675357c07865c350cdec4c7aa853a69d343fdd9b425bb04b5f94bd48142ff26eb185f7b03cf754c8b22
SSDEEP 192:sxZMRin9/fHstM4NIdpJHW6+WNGYCIhrviIgrJ:sxZMm9/fHs+4uJHbGyq9
TLSH
T1461286126E28A57B8CC7E21DBA15BF53D6F95032A1D51E58EAFC861C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2a9714dbf7c639a132a202c6a06c94b025503f4e0392a78d7d3468ff89550c97
MD5 f98db5da0f268c5a4c040c270293397f
SHA1 181136027c43e1d6694838f7d51e6ad11216a913
SHA512 db0125b20f6afbe066077dd1b4980b0cbae4fb9063fb320eeb199da3efe0c4fc259b2c55f40b760d43c5133f3c218c770ca36f40abb385eb3c5ca35782dfcc67
SSDEEP 192:sxZMRin9/fHsH44kIdpZQhxpHW6+WNOm5y//YCxPrviIg5UJ:sxZMm9/fHsY49kHbzK/Rqm
TLSH
T1C232C952B934997B8CC7D21DBA15BF53E6F95032A1D45E48EAFC8A1C04E7ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ed3ae22ac60a6421de26ecd0ecff457997758f9f3a438b15d229dbef8a5c3ccc
MD5 fc5a0b29d11672b8852948b6bb966a58
SHA1 9018d8d958c275c81c465c564a2af1ada2e8506b
SHA512 4f31da2d51cb2ff5f73d5f76e4bb38883ef17a4e4a97cb641ef708e8bf6128f896174d7f5d399e6901edde3e4349bb92812d481d7bc2d48f59b3bf79c4d1afff
SSDEEP 192:sxZMRin9/fHsH44NIdpJHW6+WNGYCE5rviIg5UJ:sxZMm9/fHsY4uJHbGYqm
TLSH
T1D52297116E28A9778CCBE20DBB15BF53E6F9513261D51E58E6FC861C05E76CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9728b35e562a3a3fde430446d6d59a551dd6a5103130e521bd507a4a191fd44e
MD5 6f8c96e9b4da2942a814349f678cda48
SHA1 ed9b00b37cc9b8338089ab70207ee93a78969c91
SHA512 34085dd653fc2420e32dfa9e18aea0c9b4d9acbeb55b8563d87f7cfea630275376c49109938f2c47dc1d9dc678cbada129e22c8d8b1d0d63df4105a0ef11b925
SSDEEP 192:sxZMRin9/fHsH44hIdp6dhuOHW6+WNuv5y//YCxfHrviIg5UJ:sxZMm9/fHsY4KOHbGK/xqm
TLSH
T16732C852B934997B8CC7D21DBA15BF53E6F95032A1D45E48EAFC8A1C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 847274add704c3fa04c2c0eb2f43125dd3ecd00635cb3c33971e4176014f35cd
MD5 5a256ec19195d7d478307860c95352ab
SHA1 881cd60dbf7e7a41f1770bf5cbed7f897a12c21c
SHA512 cdc3df262e4ece9a44449d234b70a3fb6d12914e3bd4cc32062d37c535a3145d0668dbf2e811edb205298554a523d21afaa155f64fac5b9e907cf10709fb59cd
SSDEEP 192:sxZMRin9/fHsH44RIdpcjhaQHW6+WNRO5y//YCxPrviIg5UJ:sxZMm9/fHsY4a0HbgK/Rqm
TLSH
T17F32D852B934997B8CC7D21DBA15BF53E2F99032A1D45E48AAFC8A1C04E77DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 98d966becdb974ccd573f9067942e20966cc03d1c565fc2e3d641ef0ff191b4f
MD5 d055462574710d9a01f24f3ef78600b5
SHA1 85f626731b1cb37d440bae9c4d4ca10c7cff1a39
SHA512 8fa6cafdee1e0a6b2a130f91aa27dac96fdb9700bf40be56085e4d5560a0a12f1e2084c17f306f3d8b3324cc8c32a8c96b0dc323e6c95376378b48e256c4c73d
SSDEEP 192:sxZMRin9/fHsH44eIdpzKhABHW6+WNPt5y//YCxfHrviIg5UJ:sxZMm9/fHsY4PzHblK/xqm
TLSH
T15B32C952B934697B8CC7D21DBB15BF53E2F95032A5D41E48AAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e356a3fd0c4c17e0cd9152c13385b5690ba8f5e420f7f539711822c7161587ce
MD5 d6b8bd597532e11214ac67534ab495bf
SHA1 ecfa670750da9e97bdac10292cb1b1b33affc7a9
SHA512 7d972c74c8dc8ba4756bc8d1b04a2c23c15d708303884a46c59765f94f7daa6e0d4ba9478fdcb34379920c877cac18a4e4b54266036b48970c21acb9defe2f34
SSDEEP 192:sxZMRin9/fHsH44NIdpLHW6+WNGYCLfHrviIg5UJ:sxZMm9/fHsY4uLHbGDqm
TLSH
T16222B7126E28A97B8CC7E21DBA15BF53E6F9503261D41E58E6FC861C05E7ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 04a57d0d4e5f141bee9ce44a413bf1c44a81743fdcc7a36fe1c387f16ce7f6c3
MD5 c1348543b980528af62e3209e7768663
SHA1 82a7217fc7fbddb88c175aadaa3d1246d5b7ba23
SHA512 01107714600ab77967b4ce87500eca82236b73ad8b24bf9472eff92b843646bfa427ccea33b78e1379e650bb31e9e504d4294b65f818096275a56b6c518d72e7
SSDEEP 192:sxZMRin9/fHsH44IIdpyxHW6+WNi5y//YCxfHrviIg5UJ:sxZMm9/fHsY45CHbiK/xqm
TLSH
T15322B8126D28A97B8CC7E20DBA15BF53E6F95032A1D51E58A6FC861C05E7ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4a0fbefabd8ad6d3101be8e1542ea897cab012c177259b776c0afe7ead3f482f
MD5 74e69554f15365b5b17048da7f1570dc
SHA1 20e907ce7028bbd68d612a1249038a0cd5520872
SHA512 731895f606247e29b32b4529139613b1cfaf6a2e7994f2129cecaf0bb824fd2c5cecbcbda45ee9b662fd6ff7dad87e392a8b1f8352606eddcdaf2847e91881bd
SSDEEP 192:sxZMRin9/fHsH444IdpdIAMoHW6+WNOj5wnpiE/YCdwrvbIg5UJ:sxZMm9/fHsY4JrHbaqh/obm
TLSH
T15E32D852B934597B8CCBD21DBA15BF53E2F99132A1D45E48ABFC8A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fe6731b9d76142e1ded195a133e7da58fd236dc142f995708942adc1bc548833
MD5 1d1976aa8342621dd1fa719442630b51
SHA1 bb2414171c35981c01a9956443af1a6dda65c424
SHA512 c79d8f12f65f670e73a92f502bc2fe42a13fe2f64ce60df86986a5bf86cb0f50a8a68c233700517a9806044d2a5759e01980f73d6c8220af6517fc488644da62
SSDEEP 192:sxZMRin9/fHsH44gIdpKlAarHW6+WNQS5wndYCLwrviIg5UJ:sxZMm9/fHsY4h2Hbtqdqqm
TLSH
T1D332C852B934697B8CC7D21DBA15BF53E2F99032A1D55E48ABFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cddcfdf9d937ce89e2a2d6ddd0c321cbcb8e9440a9ca538181e122b5b66b38de
MD5 7ead11f83040e7b83b55403d1be87ee0
SHA1 b14c1152d464e19923c37dc3cc06f5144ed27dea
SHA512 9e2725eb48d9dee2dcbe4e489ffc5931e1068ef3dcd37aa47c6386584ce4586d9cf430894d8a39f1bde4fe9b797735e1a6b8b516e23fa143df44fffe240fc11c
SSDEEP 192:sxZMRin9/fHsHM4NIdpJHW6+WNGYCIhrviIg5+J:sxZMm9/fHss4uJHbGyqs
TLSH
T12822A6126E28A57B8CCBD20DBB15BF53D6F95032A1D51E58EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 68ac04c5c125459799ccae4492627194cd3cc2447e5c0f1ae7356e438102bac3
MD5 a2ae81f06f14f5dc59b844e5db0fd16d
SHA1 f17e79bd0fae597384821fea7c71c58a36efb4f7
SHA512 ac9760794d9579b1c5b56c626a5cdc017673aaffa14589e2e905ddb36364a326492cb220638b2a3c3bf7785d6fe31a83bc79518ff3d9c22fb08728ab766768b2
SSDEEP 384:sxZMm9/fHs666s8qMpRiYnazAW8pZS15posJWeT+k4JmHbaSB/bbm:s0m9/ff4Mnc7WeT+1oHbambq
TLSH
T19FC21905A824C87B8EC35D18653C7E33EAEC505222C9DEDE5AECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9a7086f45c2c76c64c4fa65cd56f709d6f2035ebd533e7e2e64c62029de28079
MD5 cab6ab05114488b4c19fa0168bc792d0
SHA1 b2535de0b889406c94cd42b478240deeb48eea01
SHA512 94d6066fa5e3f44f115878da89966bf9f42c9dcf1067f6b0155c42952d2488d322f98205dac88e7f4b0a8360afd144ecb20fc1d5bdf79086453263611c1db43d
SSDEEP 768:JbqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKryroGU:JbqbUj+WvSCs6u1jaaZLbWrpGU
TLSH
T124C2E93B340CCA7E4FC01A9DDD5A6F972E9802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d16dca805ee374cb59a7bc4fc830107833c8c02e50b4567b8c3397e5c53965c1
MD5 36be465f8298bcd92db62b8f46fa7cbc
SHA1 b0c34bbde4800c346b6ec73c511f8d7243021dcc
SHA512 b9b2a64dcdd343ec8bde994c369b5877ad78c2480907624d0c514f7fe410536c459ac241c28c4114813311bfc229b93e23cc85b366388407eb1d40dfe5b78e3f
TLSH
T1E5E068BA29E72860BC7BE3F524B058E002497988C94ABC8E006AA1D710B3362285AC60
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f63d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f63d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 081cacbfc3a30f1e9d36d966e0f58f99a724c6aae573fff1d4dd58548f237370
MD5 04af6894ad6a6d3aceaf88ad15cfefe0
SHA1 f6b1c24ffd2ada6e23f5770c9d47285133b09ce2
SHA512 7655b96966c864030c24f52ff0fe4bc78e578fdf5a5587b5ea7a22508434b4c5cbb78bda2836101349915b2af4c9c5c8e777080b4f26daa6e5e00752103e93a6
SSDEEP 384:hZcIhsNbO/EnlXEC8Ea++d5Uu8A7Vaai92plk74HF:phhE9lna73U7A7Vaatk74HF
TLSH
T104828D325C785C779DE2B584F84B37039EF8D167A6CD6B54D5ED9B0E00DA6A82307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 76bb6322848f891d76d849112af09f8dc86da36cecaeb3f18eef0434e19b6fa5
MD5 89b8c25a223b1afd69a5d2c11c7653c8
SHA1 6f6a13446f327f39e3823639426ad470a2fcba21
SHA512 5d789afd39d93487c06b08359c43ab15c7e1a956896f33ed1155a31867ea9d26329f0498cf295c1879cf355ca7e556b14c287aadbc20765280d555232dd4a8ed
SSDEEP 384:GZcIhsNbv/EnlX9C8Ea++d5Uu8A7Vaai92plk74HF:UhuE9Ina73U7A7Vaatk74HF
TLSH
T196827C322C785C379DE2B584F84B36039EF8D167A6CD6F54D5ED9B0E00DA6A82307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 02fc23b992c96696ccd574e453384ab6ebe7171b9bca38c121a9d5de33321b7a
MD5 94a12231cd414cf1aeda2b84a8994091
SHA1 2450c2b5c313eee2978fa614922fa670261a7e8a
SHA512 1b7a8f98693dacf7f3b1dbc71b2332fd9b7e8c0f21d146335ecac8f68a5fd31717d3cabf79913cbdf84004f7170a0e9b3d86e3f3168f0b8ffd993560d41c5d0e
SSDEEP 384:tZcI5sNbz/EnlX9C8Ea++d5CNu8A7Vaai92plk74HF:15KE9Ina73CN7A7Vaatk74HF
TLSH
T12E827D326C749C378DE2A584F84B37079EF8D167A6CD6F54D5DD9B0E00DA6982307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9b13ecbde48ad3c8ddaacbdedcc2c44727e9f0e1e61ae1ad214c1cec008e1c86
MD5 d99215514567977a67274e02a36eecda
SHA1 3a06d4925a92d3ff64bb1619ae5af899bd43887f
SHA512 5e282299e73203391cc5a87664e14f1b10e667fed270c95c6aea461d6649c0695d8fe4047aa4ff848ecd69d4546b51ffc8ae2b3262c5d1647e89e3388d5df792
SSDEEP 384:uAiFGZcI5sNl8TUNTUlIlz/EnlX9C8Ea++d58u8A7Vaai92plk74HF:ubFU5AwgRE9Ina7387A7Vaatk74HF
TLSH
T195A26D335CA48D7B9DF6AA84F84A3203CEF491A7D9C9AA54D6DD9F0E00976DC2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 aa6d30ddf40a3d5b98dfc133e1debfc2abaaf77255af47782e89a9deb7e4ba3d
MD5 acb9764c103cc667d6b75ab49d776043
SHA1 43bcc9dbcf0572453bf68fad7aed31b9f9498419
SHA512 6b7515ddd63210b74003d57fcdebae98f1db110d739fd35e3d7ecc835c28caedb1addb218b22897fb9c7663b2711df842b9be9dcadce0a548505abc32c60b4ea
SSDEEP 384:uAiFPZcI5sNm8TUNTUlIlz/EnlXQI4Ea++d5ru8A7Vaai92plk74HF:ubFH59wgRE9nba73r7A7Vaatk74HF
TLSH
T130A26D335CA48D7B9DF6AA84F84A3207DEF491A7D989AA94D6DD9F0E00972DC2307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85fe90ad1a03791638d31afc3b9735a997d9a2829c34f70a4538f96dd147b337
MD5 034c943deb687bf05d3060e3e49e42d1
SHA1 a4dada98821bb24d94c5f59dfd9ef87dd28193c6
SHA512 83974d243ce55d97e6d824f86af99d275008ce763597977fae78f58fca80b2a8b3aca1dae230532d77de3eeaed582cf320483472a556f36f10e81fc3daa84d3e
SSDEEP 192:vONR6Db6QmiUyV9HBa+j1+FdCKHRgiDxU6:vONR6u+HBa++d5GWU6
TLSH
T10102E83568786CB79AF26E49F4873B279FD4203BAA966B54DAD84F0C00C764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 90b3a7186dfa263adb259be17231ff484716f0a304f349ed2c4e4912ecf733b4
MD5 3f3a677df1f42a247ce446dd8d3b4648
SHA1 46dde37c4acf37f06cddc7bc9fd305f0b2cd0f61
SHA512 98499846716b35825be18d07232f53225e1f4ccd2f6518fd08698c972cfff9784574ae3adcd576d17f4e37d9f7866e8fc1a2da6060d7e72400af252823e6ea15
SSDEEP 384:uAiFgZcI8sNT8TUNTUlIRzOEnlXhyMEa++d5Ou8A7Vaai92plk74HF:ubFe8WwgUE9QXa73O7A7Vaatk74HF
TLSH
T196A25D335CA4CD7B9DF6AA84F84A3203DEF48167D989AA94D6DD5F0E00972DC2307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 98ff03c71ab8a9edb3a8eb3fa4762fdcb3c3912427491ce462d2cc503187bfe3
MD5 7a4e890ad92d2b8c49c5be1191ffa7b8
SHA1 7222d76a2542f724fb342e756f000e5c0ccdf96b
SHA512 5e9ed3588207d68dcf5fb7ea5fc28107069a25aab6b56cab8cb7dbe3c293f1885fa75a2825d4863faa98bb04a2a6dc98e35380186402fa6a0498626a0e1cf47e
SSDEEP 384:GZcIhsNbv/EnlXEC8Ea++d5Uu8A7Vaai92plk74HF:UhuE9lna73U7A7Vaatk74HF
TLSH
T143827C326C785C779DE2B584F84B36039EF8D167A6CD6F54D5ED9B0E00DA6A82307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f25dd162b900ab80f2dab5343a1a4857f5636f6520adc2d338e2a8d0c5cdfdec
MD5 3274dfd6cb86b3dc950f22f2b883d9ec
SHA1 05c39f9c91bbf8ffe2070371f0b1b8ad4a12fbcc
SHA512 ee32db690c0255ecd21887c555c596d77f7ee9f55ba60b313c62d49bc121e5d907807d606643c29f597a78572207df026e186146ec9747ce2161ae9d40e44113
SSDEEP 384:uAiFcZcIvsNT8TUNTUlIRzOEnlXrTMEa++d5uu8A7Vaai92plk74HF:ubFKvWwgUE9fXa73u7A7Vaatk74HF
TLSH
T1E4A25D335CA48D7BADF6AA84F84A3203DEF48167D9C9AA94D6DD5F0E00976DC2307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1a6706e3ab8f4a588e3e95067e7c97997cf802c8762956a043ac4cc59a8f856
MD5 7832e3216bc64a065eb0e3b3e7d1c491
SHA1 675ce4313cd4276f64dd01092acdedf316d956e5
SHA512 ce1407044a58efecf2db22e996cc8e6dd1f233af28e987224fde6d288fce9c2837976eb01af39cab376197c38ce187dea157d0880096bfde4990316c8a66b7fa
SSDEEP 192:HONu6DbFQmiUyl9sBa+j1+FdCK2dNzixq48U6:HONu6LcsBa++d5cu8U6
TLSH
T139123B3668789C7B5DE27984F48736139EE49227EA8E7B90D5DC5F0C00DB69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 47f7c316132503b47575d642d78521bac0f24a2f9c86df344002d7333737271f
MD5 ed6a4dd6c3549d8ea1dfce470756077d
SHA1 5b885e9d62f5306124e42aff4c3e04b1711d2ebc
SHA512 aebdcb7786a839189822c199c813465d1a223fd689b4ce4f3bba20c4e6425d3a6707a8c462f31b558d574cc6d174e821ba89a52588e8efcec368df688e843ae5
TLSH
T1ACE00102D700109EC46C433141C7133133BAD06423934347980002B0FC867008F21AA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 207974258fb1012fe46b27b1c02d6928c6dba58c8b17cf954aeee28f075b1f00
MD5 43b93afc6832ad70f9cd908e2d2c8e46
SHA1 beddfdf18652bfc923bb442c76f2aaf4b03ba211
SHA512 522713cca2535a8942995cbbbcf28b91fd950bdd450d2f411e2364b989b907c8b18e6e4d0389edd0d158e5026e9d9d5bcefe046e3dd89fbd135c4cdb548c809d
TLSH
T180E00202D700109DC47C43314187133023E7D064229243479C0001A0FC862008F21AD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5aae91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aae91.TMP
Size 392B
SHA256 000404ebd7e4e7171844b1b540dae2b4d8406c81ad4e91c266fe79e4841fbc3c
MD5 fcee0981a51edbb1f9d9fef384005381
SHA1 6001e057c531971cd617b8ddcd7ca572e7835055
SHA512 06b1911501391e50ae998f4eddc9e2aa01c87e9b1448e6a18074808ac62f384ac1806a2b64bb1c085bd644c957cb8eaf2c7b60e11a415555964fc3ff8411a8ec
MD5 SHA1 SHA512

Submit Download

3a65a9c7-130d-47b8-a042-46024b2a133f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a65a9c7-130d-47b8-a042-46024b2a133f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fda32c090954764a57d728c0f319291a48cf63724e152533cb6193f66f8af5fd
MD5 800665470e9da9ea987f0baad9db7a63
SHA1 57b539a666ffe56e7c45fa98c79c19c998bfef7d
SHA512 c4223f390ee979510142612f4a062677a3455d1e4febfabc533e4bde5e514e16f0fe143939af0fd0653e8d9f873493807a354153b56807c679e0280e38e76c46
TLSH
T1D741F699A6E91158B3B76F5AAFF6A86D447EBC772E46D45D00110D4E0623A40C4B2733
MD5 SHA1 SHA512 TLSH

Submit Download

Lumen.zip.crdownload

Path C:\Users\Admin\Downloads\Lumen.zip.crdownload
Size 14.6MB
SHA256 d68f7f2f7764398494bd14fc36e9818e24ed56a877543307144d19fe236a7218
MD5 6a4597bde689b3372565419f69f973d2
SHA1 30a41e756d750ece98181a74bd03ede6af296202
SHA512 dc5447be2a24e8292ea2d90cb1f8db58c889946bf77999e738f18f018097fe0012fa8a8479f046d5574d3c5f5caa59cbe65df0d50d69024dbc7b8010f588213c
SSDEEP 393216:pRMhEW/y+muUI53CIgBYDJoiLBHIV+xkJgQlyKi:pRvW/yWR37DJTLBHc+uJgMyKi
TLSH
T136F6333AFB2160F2D1ADF8F5D13AC27A9F94C01CDA106816678E151A3BDBBE75D00789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-723.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-723.exe.crdownload
Size 3.7MB
SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
MD5 f8c87a60b54c555b5bd5d18f7ad9b35b
SHA1 8c1afc0011357ab6a60a39b4ccf1698865e2b0d1
SHA512 93a49776b41cf6c47a615be914c6e8a1ff670aea3d2d966db9391054c0327c64ad852ec0807d8a7789d5a0f0f1fe7115820162ae3a58490129308fe3ee438a45
SSDEEP 98304:ZqBAjnA0XicrT3mN8Elu+GDQOQ5X3555ViyKp:HA0XicrTDElu/DQOUXp55Viy
TLSH
T110062329D79514F5E137D534C8A10207EAB17CAE4771C6CF23EA198A1F23791AE3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-655-0x000001C4A7AD0000-0x000001C4A7FB7000-memory.dmp

Download

memory/756-669-0x000001C4A7AD0000-0x000001C4A7FB7000-memory.dmp

Download

memory/2652-857-0x0000025948110000-0x00000259485F7000-memory.dmp

Download

memory/2652-832-0x0000025948110000-0x00000259485F7000-memory.dmp

Download

memory/4420-338-0x0000020847000000-0x00000208474E7000-memory.dmp

Download

memory/4420-319-0x0000020847000000-0x00000208474E7000-memory.dmp

Download