1468e3d24157ea45eabadcb2cde1d2e39906c28d5874b34057dd4b084acc958d

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
portable.exe
Size 13.6MB
Sample260928-rrhresbb92
SHA256 1468e3d24157ea45eabadcb2cde1d2e39906c28d5874b34057dd4b084acc958d
MD5 8057ec6641b000b844de28478d8bf743
SHA1 170c83873f53ce9f01216d880e257afbb3af425b
SHA512 fdd6462aff9b72f20a462f695ef524982be47fa56848c7ae6050f9714aec9a793a910c12ab8733aa2889a4e80fa34b42b849fd3bff905049d6d3c221776569b8
SSDEEP 98304:Jq/TP95/VVIMhRwf6COm1cfx185luBMfBcNkzNjJ160H+7EUqDKwW5+8wffN:JqLPnVVIMhWfGCHfKNoVPHWH5riN
TLSH
T17BE608257A5A99ACD09BC47483478A72497130DB0B35B9FF448496383F7ABF46F38329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3456	portable.exe
3456	portable.exe
3456	portable.exe
3456	portable.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	portable.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
96	raw.githubusercontent.com
395	discord.com
396	discord.com
398	discord.com
79	raw.githubusercontent.com
80	raw.githubusercontent.com
86	raw.githubusercontent.com
90	raw.githubusercontent.com
94	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1131317536\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_175461696\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1131317536\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_175461696\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1131317536\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_175461696\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-ka.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000a00000002461d-258.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	portable.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	portable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	portable.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{83A921F9-C385-479D-B361-CBD8A73C78A7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{673C7602-09FB-4F0D-8BF9-85019E88257D}	msedge.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	portable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	portable.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6200	msedgewebview2.exe
6200	msedgewebview2.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3484	msedgewebview2.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3456	portable.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3484	3456	portable.exe	88
PID 3484 wrote to memory of 4668	3484	msedgewebview2.exe	89
PID 3484 wrote to memory of 2548	3484	msedgewebview2.exe	93
PID 3484 wrote to memory of 2548	3484	msedgewebview2.exe	93
PID 3484 wrote to memory of 2548	3484	msedgewebview2.exe	93
PID 3484 wrote to memory of 3256	3484	msedgewebview2.exe	94
PID 3484 wrote to memory of 3840	3484	msedgewebview2.exe	95
PID 3484 wrote to memory of 3840	3484	msedgewebview2.exe	95
PID 3484 wrote to memory of 2124	3484	msedgewebview2.exe	96
PID 3484 wrote to memory of 2124	3484	msedgewebview2.exe	96
PID 3484 wrote to memory of 2124	3484	msedgewebview2.exe	96
PID 3456 wrote to memory of 1172	3456	portable.exe	110
PID 1172 wrote to memory of 1304	1172	msedge.exe	112
PID 1304 wrote to memory of 3240	1304	msedge.exe	113
PID 1304 wrote to memory of 3372	1304	msedge.exe	114
PID 1304 wrote to memory of 1048	1304	msedge.exe	115
PID 1304 wrote to memory of 1048	1304	msedge.exe	115
PID 1304 wrote to memory of 1048	1304	msedge.exe	115
PID 1304 wrote to memory of 5072	1304	msedge.exe	116
PID 1304 wrote to memory of 5072	1304	msedge.exe	116
PID 1304 wrote to memory of 4368	1304	msedge.exe	117
PID 1304 wrote to memory of 4356	1304	msedge.exe	118
PID 1304 wrote to memory of 4368	1304	msedge.exe	117
PID 1304 wrote to memory of 4368	1304	msedge.exe	117
PID 1304 wrote to memory of 4356	1304	msedge.exe	118
PID 1304 wrote to memory of 4356	1304	msedge.exe	118
PID 1304 wrote to memory of 5132	1304	msedge.exe	120
PID 1304 wrote to memory of 5132	1304	msedge.exe	120
PID 1304 wrote to memory of 5132	1304	msedge.exe	120
PID 1304 wrote to memory of 5140	1304	msedge.exe	121
PID 1304 wrote to memory of 5140	1304	msedge.exe	121
PID 1304 wrote to memory of 5140	1304	msedge.exe	121
PID 1304 wrote to memory of 5448	1304	msedge.exe	123
PID 1304 wrote to memory of 5448	1304	msedge.exe	123
PID 1304 wrote to memory of 5696	1304	msedge.exe	125
PID 1304 wrote to memory of 5696	1304	msedge.exe	125
PID 1304 wrote to memory of 5864	1304	msedge.exe	126
PID 1304 wrote to memory of 5864	1304	msedge.exe	126
PID 1304 wrote to memory of 5864	1304	msedge.exe	126
PID 1304 wrote to memory of 5952	1304	msedge.exe	127
PID 1304 wrote to memory of 5960	1304	msedge.exe	128
PID 1304 wrote to memory of 5952	1304	msedge.exe	127
PID 1304 wrote to memory of 5960	1304	msedge.exe	128
PID 1304 wrote to memory of 5972	1304	msedge.exe	129
PID 1304 wrote to memory of 5972	1304	msedge.exe	129
PID 1304 wrote to memory of 5972	1304	msedge.exe	129
PID 1304 wrote to memory of 5356	1304	msedge.exe	131
PID 1304 wrote to memory of 5716	1304	msedge.exe	132
PID 1304 wrote to memory of 5716	1304	msedge.exe	132
PID 1304 wrote to memory of 5736	1304	msedge.exe	133
PID 1304 wrote to memory of 5736	1304	msedge.exe	133
PID 1304 wrote to memory of 6064	1304	msedge.exe	134
PID 1304 wrote to memory of 6064	1304	msedge.exe	134
PID 1304 wrote to memory of 5892	1304	msedge.exe	135
PID 1304 wrote to memory of 5892	1304	msedge.exe	135
PID 1304 wrote to memory of 6328	1304	msedge.exe	136
PID 1304 wrote to memory of 6328	1304	msedge.exe	136
PID 1304 wrote to memory of 7044	1304	msedge.exe	137
PID 1304 wrote to memory of 7044	1304	msedge.exe	137
PID 1304 wrote to memory of 7044	1304	msedge.exe	137
PID 1304 wrote to memory of 7120	1304	msedge.exe	138
PID 1304 wrote to memory of 7120	1304	msedge.exe	138
PID 1304 wrote to memory of 7120	1304	msedge.exe	138
PID 1304 wrote to memory of 7132	1304	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\portable.exe
"C:\Users\Admin\AppData\Local\Temp\portable.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3456.3416.5979762963671141632
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffea365b078,0x7ffea365b084,0x7ffea365b090
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1372,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2392,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4396,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4388,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4404,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView" --webview-exe-name=portable.exe --webview-exe-version=8.25.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4084,i,13527568243201323038,2313066965495440919,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mboost.me/fsf?altId=470263037
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://mboost.me/fsf?altId=470263037
    3⤵
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe9ee9c188,0x7ffe9ee9c194,0x7ffe9ee9c1a0
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,5412371603495943014,10793706685712034924,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:3
      4⤵
      System Time Discovery
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,6757633104407205383,15786365329727099545,262144 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,10354854506550440995,5994387704398894848,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,1428497179229594807,10413526812276635613,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,4648442916143276776,870975212438702393,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,17085949856207463016,5579075399648624163,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,6344057126366172569,5730636729715542055,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,11490338538178263302,16639654403390942642,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9584435270538171984,12664454804920654427,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5168,i,976244098020370032,1474624771784654849,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,9332687563818680005,11145737307867449596,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,397850784610884189,16830920808635349987,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4180,i,18277059335208710125,4402647137823083952,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3294786048109990654,16937194365687345985,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3294786048109990654,16937194365687345985,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,4523146077005225895,17845631616953600350,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:8
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,10603563292960936864,2894199423486702022,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,28444094694413190,17163972088922982424,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,3373413558139818158,18078258156779676873,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,14816121113995502106,11028560353325352412,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7460,i,1711611984241298651,11712454259578966371,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7524,i,6096204189323239811,9343994690112620757,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7652,i,2480856192119866647,15408056301557104949,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3560,i,11308589264757959085,9996430131384010310,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4860,i,10435424756576163679,17363999790268228508,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,14990334553555051716,5206285071996400218,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:8
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7972,i,14732030686225277812,3607325930849075717,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:8
      4⤵
      Modifies registry class
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,3339064813714115428,12933441871386348492,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,16601916518384012111,11492015556562556687,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,2114820835307781328,14697153792505168225,524288 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5368,i,9368709338010679881,16061429339297674315,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7088,i,16862954554539331169,17470864272642952435,2097152 --field-trial-handle=2884,i,13393097684961776970,14980847452865999118,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
      4⤵
      PID:6856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1059099876\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_1131317536\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_175461696\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3484_175461696\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cb0b2e7b2f05d775343f6d8358811aa49d866a633de80073ad625e169021a10
MD5 f075ad7186a1f6c200abd69ca7856c96
SHA1 9bc250f221c26c725e12199febb7a3a178070ec7
SHA512 52730b59c4a720a9d526482430c0b2af7e12cb71a526f9149bb1b7748ec8134b51426f9b1d414cc62a4ca0c89bb9b0344afb23b1313af6aaf8e1075ff2f08415
TLSH
T1D0D0C001ED689FF4E071183C0239800836CCB1424B023141D0A012578C24242106CCE4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

1f3ecc7d-106c-45d5-99a2-687842d0ee4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f3ecc7d-106c-45d5-99a2-687842d0ee4a.tmp
Size 11KB
SHA256 5461a8f1a814979c4c5a2b3d5a366ce5b64cf1353e6e98dae8ee3f95b140127a
MD5 e839a3a8ffb575551ecea9b0b949010c
SHA1 dade6eba9bc19c36a654a779194d4f3fbc1e2772
SHA512 a941d73bdd446f789aa2760f78ff2ef12063d7708e8c9cd347311568b74b7d7b8a11370534da3198dc452e4e9704a3dfe28000a78bc24eec087d0f3e341699b1
SSDEEP 192:sxZ4R7sk/fKisQMZrTIdphXHW6+WNGsM/z/NYIZ6tH2AtsW+YBQQpIg4J:sxZ4Kk/fKisQoMNHb6/+xxc
TLSH
T13232A752AE3469BB4CC6E619B614BF13D7F5003295D05E89ABFCC51C01EBAED220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 23KB
SHA256 0f8b4794ccfacc77ce3b776b91401142f01e657bf2580a533aad6c0aa2043142
MD5 147437dab863b8b0a4f56967319a78d8
SHA1 e0882f43c16adb6b388ea21f24fac7d04106a3fd
SHA512 0b94fc068df71136e6de94904b5a4fd846b9c4304105be8e44dd5e80553613d99f25d4164d556ea2a69b9ac0919166bbb4b55c4c7be1df52e6cd075ebae8f695
SSDEEP 384:XMWgSF9GQuNERzPxQutjrSvdxsjCAVoUm2cWKA2uuf89V3lxy6PWb9RKSjzSAnb/:8WgugJNEsijrS7sjJVoKsA2uooVK6+bZ
TLSH
T1B8B2D1696CA05F319220BA07BF97E0B11B78C3460316034CA3257E7E7A477D9D887D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 380766cfac1a16dc69dc07e40bb9ab4d50b830885a2aeda6d223584402561832
MD5 dd10bb5a9104fa6f9a2455a4875f6cd5
SHA1 788de2efd6216da5c813c08d869f74af107d5f35
SHA512 c3e9083fbf18d0a86aadda75d60b690a4213a24904490d00556d6cae5d3ce8cd537b44d8600523cd68ce7d675e1b11b22108f5e711b0fe3fe43b0a34118bd5a6
SSDEEP 96:iLRICNi4TVrhcJXe1z322WeBazNAPVydmZLQp4eHRYBSLRKelczsKtDXR0HdvOx5:iLRICdT1KXe1z32oBazNAPVydOLQGeH2
TLSH
T180C184A4D0874152FB9400B8B5D407A73EF26D7E84879E067965C973BCFAB7ABC14AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a202c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a202c.TMP
Size 3KB
SHA256 dafa337f1d24f3b09b8d4d46ae2f2652006602b2bbcf8900faa3bc0ab642151a
MD5 3cab75f7f3e83b51d4d440cc6fff03ed
SHA1 bbc190acda1a85bde4bd0818449071ec94e4ef17
SHA512 2de2ebcf2d8d178c13e7bf16b6c6c4153c68dd7119f2da17a3053eaf0b164258681c775fd34201aee5be6415cb50f5811ff8bf33d9aecb63b82bd86ed3a1e963
TLSH
T1D161A5B494434057FB9840F0E9D811CB3EF0A5BD98938E16A4A6D277986EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 80KB
SHA256 dbc3c0880b87757e05a9278e8f67d4ef5206fd16b7d4a757a32a5847a0038253
MD5 ce4bf3130878c512c29690c27f7c1ba8
SHA1 20f1b34047d93e05bef7b8397d8738d28e7a69da
SHA512 6f25db78469f7a683e1cc9eef525778e2c77a38a3eac6a6b1179427d553b2b41e61133d420d457335bff90d1c0d81ba6a8e1242f30881c4895e45c0bf074d912
SSDEEP 1536:7J6FZYhJ0GhzvNiUaLnRZAE0vXbsSXv1e1Js5:7J6FZYnvNiUaLnRZAE0vXbsSXv1e1Js5
TLSH
T1D083B62F46E08ADAC619C1F558260FE25B3A2D0578D8A0DFF0C9776DF576AA00731E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 ebfc4ba177d590b00c9001498deafde20805d4073b05ea98a910afd218d335f9
MD5 5b9f78909ff1fb9ce39754c240ec7be1
SHA1 41f1b153cfe6bb0f0d6f4b630db2114b819a9db6
SHA512 fa2d5b639d2b69e560a1aabed5ea215da010e707f8b672b304da55ccb147b4df40e9e0ed4e32375e7f7b8f2ec341d52285b7760705ce2b634fb045566be4f12f
TLSH
T12EE0C02C88C9C11F111464D745387F0DE1BF620FD7CCBEC24F01C810704A448D0AE151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 d3d9c16c976104a0dd36f012a4fcf5594976dfc48174d1bac707f03023c00de4
MD5 f1725c8534f930bb4df36be4be58f0cd
SHA1 65c61cef9d16aa0c9e48b3d7e09cc791befc5bd3
SHA512 78f31a9a4ce0086d463ea50ff947b8670a329761e0b7aef0c3043c0dfd6b4de308b9a6d576ede6013d97db0d907ec2e50f5bcdde5e7cc58b88f65d4413b4ec06
SSDEEP 384:DoUnFWob/nIDuy2fpSde9EJUtL83TLXUaUbJDQJ4hhoYub+be3eVCKaiDCCG7FlG:ieqGe5MdiYz
TLSH
T10072CEF3C7E5822DD81596F0AB257E1BCE690D18932C3D2AC9D99F4B93E1431E24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9bf21b99479059d0c8f2fe85f4e49d95c95e7735641bfc916171b2db9d9c82f0
MD5 c32c2b116040e8d1186f6cd483eb92b9
SHA1 3984ae7ac151d880eda4c7f50e00bf4d65d6fee1
SHA512 bdcaa115cc713f142e7a098a22c3e86861749941dbec598b49603c57b2c9ba5bf6e88aa267902f4e980ef9f42caf7c396e2f8e41d1cfc2fae755b2d8b2f9e6bd
SSDEEP 192:sxZmRoZk/fKisvjWpVcMZrDIdp0pvf0ZFHW6+WNT2fakNrgdBTITxmNYIZ6tH2AE:sxZmKk/fKisvjWvcocjHbiKdhexje
TLSH
T16462A753A93459BB4CD6E529F615BF16D3F9102694D08ED9ABFCC91C00EBBED2203847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad6c3f82129df06e8c57ba35eeebe97b64cb9b07efa7ea64655f5fc0434b3c45
MD5 af57deff466ac39abcb1df06f5d29092
SHA1 f458501d9051fcd4a7b5f1b112e7fb93b9fc70c2
SHA512 de778ce518536641e419fc6f91866bfade730632508c8a6d614ab3ef8f59b92d2b2e844c485bed3bcd7bba8dd6cda62d6e8346f3712952427424c1cbb3dcfff6
SSDEEP 192:sxZmR7sk/fKisvlMZrtIdp0pvaZFHW6+WNTnm1XBTIT/NYIZ6tH2AtsW+YBGQpIR:sxZmKk/fKisvloOLHbgXhDxTY
TLSH
T1D2529592AD3469BB4CC6E529B614BB16E3F5002694D44ED9EBFCC91C00EBBED2203847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c488e8a4a41475336b755e04ac119ae5aded58a0ae0c2ef1f8a1e15253f30250
MD5 5e78423131ad37bb7dbe8f05cd7817c8
SHA1 2d9380cb32f5bd8134168c2ccea75463fe558259
SHA512 0e0b9be49aa352b5c8274adfd748e9783341daea9a0b3ef21d4bd06f2a0c34641cca2cbc575ec701b50b7df9e82807495e72d40c5c1b36176da1843144a7c7dc
SSDEEP 192:sxZ4R7sk/fKisvvMZrcIdpxvaZ0HW6+WNGm1Xz/NYIZ6tH2AtsW+YBmQpIg5lJ:sxZ4Kk/fKisvvoF1Hb5X+xzd
TLSH
T17F42A752BD3469BB4CC6E629B614BF16D7F5003294D45ED9ABFCC51C00EBAED220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c29fbda5c7431345cd61a475687b2f1172f5d65d3838f936c6fd919372ca3450
MD5 37f3e44b51fd5835f089e190fc05b94f
SHA1 f991396eba00fae1d9eae2dfe2a43a3fb52a9f6f
SHA512 76fa090f68bde02ad3dc51e1ff9d24098b6d8b7b34e1a2d87f3be3c77d1b9150e2fd8fcedb048916f95ede286a738e4e50953bee42ceaf636189635b10060a6f
SSDEEP 768:Z+yYRzC7pLuLbbjWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNn/CLlGcvXHroF:Z+yYRzaEbbjWv3NRBu1jaIn/CL8OXUGe
TLSH
T177E2EB7B780DCA7E4FC04A9DDD1A7F8E6EA802CB9698C94047FA945C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\01e9d331-4f89-4aba-947b-754666bb0e47\index-dir\the-real-index
Size 576B
SHA256 ca6f408f9072401e0feb00dca8989aa8d6a34ce0079bcd6a7997d659bea56459
MD5 6746f4550993002c68e09bcde2da4c53
SHA1 99666f529cb044f758b77a5c1494207362ae3f05
SHA512 90233e3c6bb9481eb332aba59fca94eabc639e269e99c6bc0ef950c89722ed86fcd7c6e8f319fcbb1384b1a9d9eaf7915ff4b4ebe938622766ec2d4ec69471a5
TLSH
T196F0AB523584189DDFBC5934D23604E1223C8A4C7A92A2DBB5DCD8A99F4B1405680A40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1d1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\01e9d331-4f89-4aba-947b-754666bb0e47\index-dir\the-real-index~RFe5a1d1e.TMP
Size 48B
SHA256 2e437c37c3f5991cde8cddda2cd29d630b0ded4fed00cce43c985a8de4b32a65
MD5 fc7ef9fd644f93aecb9d515e0261c47b
SHA1 bbf839167dfbb24cd238f668385c4f67d060a880
SHA512 e6f575a91d36dbc7febee35470a6fb92c7608d9f4871a050096e90ff2f96d004252629b9a13f413b139c971f8454b863e0e62842a8ef9e86e8158f1714d6d14d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\573c9819-d150-4f80-a56e-993972aa9250\index-dir\the-real-index
Size 2KB
SHA256 1193976c09300e76b69c08e97f872b7a241986305f7985e13d9b079687d621f3
MD5 8e466bbfc06e4c29cea52d5792232fab
SHA1 ea0f8348d46687c60626b5a6452a5ec891347c24
SHA512 cf7ba925377cad1f68a44173445282844abb4d411d5ca020123c02c86850d4292a6226a5bbb6044043bb4a91e4050430d4e899c660dd9c1849779c112cb5b0e5
TLSH
T12841534CC884AB9EEC7450BA2D9419F257752D28FC58C29281A4B2B134032B45B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a16b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\573c9819-d150-4f80-a56e-993972aa9250\index-dir\the-real-index~RFe5a16b6.TMP
Size 48B
SHA256 0c645ca4bc1db89c9f17e7f1c7f3ca09e089f3496056b244af197bf99f0ecd45
MD5 bac657688bf9892fe6850a1d7b3dd9b2
SHA1 deebdf57d94d7351cd2576bad31522b41b2716ef
SHA512 73eba8e8ce55cd5e075de4d371f171b648bd64ea053740106b0a87e5fa76a0c0adc02f7ab9153c59c7ea13aa15527b3809b2142cb16258f0337250ff15dd1654
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a16e93e8-d017-4a5a-b88d-1e7f67bd051b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 bede809aa5423e24ceba7e262f9af1bbef0ba1f94fc7be3da17196d905fc7969
MD5 5bfe26dedeb8a3b7f1192cf5076a4340
SHA1 5bff2fde1042725fce1167337b144461e482132b
SHA512 a771c6a7522fd68b0d84faab7fe5ac0d2a2e02fa0cbc198523a8f491c61cc6e4d323d46fd71a40ae78f78175350de09d1c3f8d3ce8c749237ad96bce9e7b51d4
TLSH
T1D0D022D7873095DA2F32AFD1303C210E813F9C0898E8E8B49E18B00230B8A02C107A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 a2f43b0ee48aa7ecc72b98c8c9dd02dbcc5514e1f8ef734263bfcb3d2099c73f
MD5 bca8cd7f5a5a6a3a67c52969a8501da4
SHA1 6727c1b35ae5bc65a1e7eaffe6301778ba802418
SHA512 9c28e02caaea48404008aeb4dd1dd6440e66ac5eba7b11b8d8c1fcefaa40b6c592db9ba5db47337130e995a50a35f0b3adb4aab2614939f497699a81c719960c
TLSH
T1CFD097C32962808A1F724EEA3038B05C826F8C088CE2CCA40508301071B8A13C013A31
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 0ce614b7beaca06d20191222bc45a56d9b82fcd2411543112ae8d7d629730325
MD5 f2783527d6223f079a4614bbe620a9de
SHA1 606f2bb50f44b950fea2e9ac10b1bed8a21f381f
SHA512 90e8f20127f1db6149daea62116ab4a2c7cfe9b059378e80173466930b88e9c3f1551558b74625a5446d29ee7eea1ba492a647720fed9e68c6837541513ecf3b
TLSH
T198C09BE3592095CF0F71AFC5313C661D966F854894D4DCF4954D600274786138403635
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 478bf3409c271621896633e1af468252824145d81197f67d020d0568765be5e4
MD5 76b7045ed14f0c6a726b66b2bc456373
SHA1 0e707141907c6ac0b2c81cdbae4bed519d0b16bf
SHA512 172b00fa61e078f779c8983f3bbec1b59c4550bf531ba453af377f018bbedc2c53f5e8c8faa69c8807ba4ba87bf14331eea7cc93f35580552dcb4174294a3492
TLSH
T1DED097C3AE52004A2F728FC9303CF02C866F4008CCF6DC641A08201072F4B13C023A36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c20e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59c20e.TMP
Size 137B
SHA256 97575f14115886b99df1628e54b6d400c4a40a2d275c4c6db67811a7756b2c39
MD5 797d525277c3f1900a6199c3cbc2181b
SHA1 d8060e158c0566cdaed9a1fe5821c255ae7c94d0
SHA512 b679685e46d02b0d9844e9e4b9bb0c4bf88495f1324505116525acdbfc7c46580ea8d4ad5d78654902a105cca305ff3a9856841cca14478a56d909ebc8d56338
TLSH
T126C09BE3593055CF0F726EC5313C624D967F4D4898D4DDF4954E700270746138907635
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1bc163678d63d2974c5762c2a5958c55da0dea6275b61372095ce5a107c18c05
MD5 26ce86be7802bddbc5e0412dd0026b23
SHA1 38c68a93f0023f01e06072b8933402f6b1491311
SHA512 8fb6009bfa139a1c900aa170ec5ea44275d4c98d76f30f3564b87e7902c7a5de031e2a05603d97d0bd66b6ce08c99224dd4c5090db7ebd88bea3ac1e59f687ff
TLSH
T1F5D0A77FB4614454EF7B4F621672149943713CC818C5A28CE616312D7C75A43D112E93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 8f98cd37f45a458d28ded0f8643c62a357654e54d4e476b3d66f994d276f63ac
MD5 610632ba39744cc047eb6fa406ba06d0
SHA1 8eb1144424390efc1346ca7f2405de0657dbeee2
SHA512 df737eb078c36086e556532349df57b3ec7bb5dec785613d60920350ea1c2f48fdb34413ae59cf82c48bdd9a78615b5a35f3ef03c293745042b139e73e4628f9
TLSH
T1D1D0A77FA0554554EE6F8F621672145953213C8818D6A28CE615012DAC56A53D112E93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59fc48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59fc48.TMP
Size 138B
SHA256 9c92c42ae85d4cd274fc9070b215933b480bb4a9ac06fa57bad36321512ec028
MD5 86404b9aa2fa5d3587cbf732e42f5fad
SHA1 2046cd49ba3163e75e4b2cf01a5a27c962a49650
SHA512 cd69fd999238985933df3781292f939ead8dc0f556fc8b140b7622df8c63d7037ce611505eff5d2d1b4595946bc7e11bef6c9dca7893a8ad4856909785ee945e
TLSH
T15CC02BBFB0410408CF1243521332014D83133CCC0CC2818CE10330283830E133103ED1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 21b0a4caa78026d02871eca6589d814a94f1f3574022b28a5771e0718c8ad80b
MD5 77380206b833891e2ec80c5d4cb58f3e
SHA1 61eceea17033a2ed9eca87be8a318959946633cf
SHA512 810df2d06a5d82aa84ae378ff46d36f7c751ac8547daaa92994a379986fde5b6ce3804f00fcee169debdac475ac67e8fdc4078edf55267f84ae51988db87e941
TLSH
T167B022AB002CB083CC280330C08F00A033320C280ACF03A320A0C0FAEE0B3288C82808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a11b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a11b4.TMP
Size 48B
SHA256 0f799d526035e4e3b4df1c8997da3f9feabba6589a36e3380944235d377218ff
MD5 ba0f273d9708798dbbb7ed170fbab921
SHA1 6a57d3bf2ba7475fd35d4ede53660b3919a29a42
SHA512 4ed0f3664bda7b69294b8d76d5310e5908ec9cae7a880564cafbb8578429b17ff987624dbf720029ff470c67ec2288c4c08185408826e3d5e2826824154847e5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f30be9f23c3998d40c58dcd6e2c77cc0a4a32250dd20756e3397a310dd3f775b
MD5 c893e6eb5c1549a8269019126153a954
SHA1 c24472d41c325eca534bf9314b404e84c520d2b4
SHA512 d419c98863e9347b06d39a24a2e4f19e4aec2f039cdbb02b177f9f4b463b16ffd0319ebce3b6aa6587573c34b6ac89020564dc45b5a2fa8662b1a5cc35f526e8
SSDEEP 96:K40xCGMWyb5CXqjubK7ijIb30cPqSoqWP0geM8l5odYjIlK7UjW8AK1OuaEAKtWc:otlr3zn
TLSH
T105A1575038BF060038BD29488AB8D71F135231B6316CE97BBBAC85E15D6AF091DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6546c1eae895303588944b52a190d29c102159c46917504db31bdaf8839d329d
MD5 4ea8ebcee82faef73d36f7e18219fa14
SHA1 91224d3231ad44732b3c6a9dadc961427db0ea51
SHA512 6bbae58e33d5833c08727b20f78310bd552b2b034f0c2e3a8c54b95ef683297e691e744f37192385a71c427628ab9302e28e6279b53fe2dfcc9633b5e277e369
SSDEEP 384:naZcIhsNENai7leL6QX5+DtN8zX3+2/B5tgOIwZOyYmoA:YhwRJkD03l/B5XsYD
TLSH
T14E827D3299B89C7B69F7A245F44632036FF8502796C59FC4D6FC5F2C01DA6A9130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4e8303e013c59b01d9f9980f4833189edd589bdf6b7c23792fed4042af85e99a
MD5 60e26468a8f9da857e831c3c6c67669f
SHA1 a3e5de1ce77031c0f3282742459cd4d56fe3afa2
SHA512 4af184f0c100ad2aaebc32ed46e378867f83f9084e7a8f9e7b7e178f5759f288f90f677ed5f97b288d137f8e1d18f6357d12c6650f17b90e6ea6ac59988a3527
SSDEEP 384:nQZcIhsNRQai7YOQ+QX5+DtN8zX3+2/yuASwQHd2e9qvtgOIwZOyYmoA:uhQXVkD03l/uSce9qvXsYD
TLSH
T13BB24A71D9A45CEB45F6E9C1A546E2037FB8113B81C89A9CD6F8BF3C305F9B80316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 697321d8ab35158aa775958a3748e27f2d3fe77e21cf4a1d18abe28bf3306f8e
MD5 8f0389f26c5edc6161d5c71a39cf1459
SHA1 b00980f0353bd404181195afc8a6f2250c91414f
SHA512 4179597adcfbc56e751c849a248d3f990415aac44ed557e1ea89ff1f8e68a2c1e8514bd71fa4e038102382756fac87bdd7e8f6a1fc302a39c198ce3de3c2aad9
SSDEEP 192:EONh6nnHGQmiUynlnjQYcX5hQDP1xjzor9RfMchwU6:EONh6nCU9jQNX5+DtN8DWU6
TLSH
T10C02ED35F8A46C7B8AF3AD45B4872713AFD4213BA5956BC0DAE81E1C00D765C2346D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 38e3dad09e0b16b23b17e77c39151b91e2fee3ce89fd03655b9b98b3ef8d14ed
MD5 cd1c9bfabb703acb4fd4f5a6391b61f4
SHA1 46f1b3db2459ca64322188e2f6987ff41ff20da2
SHA512 4e53ece67f5f5503a0172d1da76e7118cddcddd457116a09143e9c04fdab874e88835c94e7ae6810e75cf326c8dd4b7c539c9e1e3b3c1e7aed2fd33b7763a909
SSDEEP 384:n+ZcIhsNEQai7lNL+QX5+DtN8zX3+2/B5tgOIwZOyYmoA:8hpSVkD03l/B5XsYD
TLSH
T13C827D3299B89C7B59F7A145F44632036FF8502796C59FC4D6FC5F2C01DA6A9130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77979b28d710519b9c1d612c2240865b5e738595622e008cc86fbf947bf95909
MD5 1f196bca9c5a69b3476b7b27a92828eb
SHA1 5110ab7c1098de28ab8309a4e72f74904acdb1ed
SHA512 581228baad9ba3941ebd12493c1eff952532f88e1a4cbbe22cfd1e73360065bbdfb647affe0c90e1361c4b512c03ee22f3bc44f8dfa8c8c691cfb1f8aeac8fe4
SSDEEP 192:EONd6nnHEQmiUynrnjmYcX5hQDP1xjzor9RzX1x+2Xg36q5mYU6:EONd6n0UrjmNX5+DtN8zX3+28B5U6
TLSH
T11B121B32F8A8AC6B5DE3A595B08731136FE51127EA85AFC0D6EC1F2C01DE66C5349C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2673a773d5a6c351bf09510c16434bb0b3d935740ac4681a9503473c9ef0f032
MD5 810a3162a9f90d339255d4995a956c65
SHA1 601e2f3abf656a0ac4ebdf9e0f4822ed205d3659
SHA512 eed23546ce5eb20cee24f5fe4f7bbfe91ec092714173cb8c400fd6fe4c87e483f085a3a7bc8b40b7eae395baeeb43e7da9d9c64c0eb839ca7cffa26f58cfab94
TLSH
T15DE001039300049AC474033001831B202AA2893002A212465A3011692C323403E11680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 04e9264aea54caca9abf61d8092197a5fb5378434340223670b8d1c24a4e40b9
MD5 e9a0de32983803e106a32a1d439ed878
SHA1 de9c861a74edf4729a1810014a63b4ca430f4450
SHA512 4136b45891c7080e7c35dd4450c4f8c2e0c03a63972c166a9898570458fc25fd84b6b638087e970b7caf6f046d0f5a22af99ecb18a2adf9ea937652477e5a9bf
TLSH
T1D6E00203530004DAC474033001831F202EA38530029212455F30016D1C313403E10580
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59ed25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ed25.TMP
Size 392B
SHA256 e42ec85784538054c1277c43a80c434cfd3d582231a62277e3f581d4d1a0132b
MD5 6465369c897bba30845e884f2b0ab3c3
SHA1 21212a7d8e1c04683ef6d242920adef042bff7b8
SHA512 19831eccaee270eea2bccc05d53c1e1762f38a135f33cadff2c74080f89ef8fb0e937a999e26f26fe681a6750f1f5d2227d1c0386f8263380aab2c2ae1e5da92
MD5 SHA1 SHA512

Submit Download

f4cf26cd-a595-4e77-936b-02184041b97b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f4cf26cd-a595-4e77-936b-02184041b97b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e441ffa719c449e2a7518aed35471891fb14f72a8217de4df816b2aa54799c2b
MD5 3a4b03f028774ae9d9207876f157065d
SHA1 bc8afaaa19045f0e122e008b3c5b3d070c63548c
SHA512 d2d46243a9cb5bbc6cc1d2eb989e4ca65880e339e8c97e285f88da5657cf300eda46ad9dabcc9c9c5addce16a344f7d5ab547c950eea134b2ab3c46e1270f161
TLSH
T190411548E6F91148B3B76F5AABF6686D48BFB8772E46C15E10010E4F0A22F40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

77088ce0-cece-4976-9d9a-3c1a8ff2ba48.tmp

Path C:\Users\Admin\AppData\Local\Temp\77088ce0-cece-4976-9d9a-3c1a8ff2ba48.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b88e5e65-17f5-4d1e-99fe-c35ac87e92fa.tmp

Path C:\Users\Admin\AppData\Local\Temp\b88e5e65-17f5-4d1e-99fe-c35ac87e92fa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1304_2038598470\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac23693b-d15b-47f5-a741-f81e0aefb015.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1304_2038598470\ac23693b-d15b-47f5-a741-f81e0aefb015.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 88299bf72eeb5d865057549c4d72696a63abdf20e45b9a5330a739e5a17652c9
MD5 92cc54d457e893ee30ebf6d911dadbb8
SHA1 ff0d4aaf1bbd810980323e23910b1936fa65a8e7
SHA512 656cffecd4fbac00f3e90cc1082f332175d759506bd6e727d4bec08997e132b7c58cca00d7d4b8658638a457f0efaa1c90c057995a8d47e810d76cbb40ff6eea
TLSH
T124D0041153010337C7001C711154C1051D5044C041C117000553440745544104113034
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f36296bbd7ad76e746177b65d5b4d7c1cd29248749c2a6ba8cced04c7789328
MD5 58ba7d3b75ebffe2a4b8d95d3d26da6d
SHA1 da19be6ea214b4b1155095f82b31046bc082226d
SHA512 499ed869b36796c2a2fdc737396957487b944f3c8041bb27f28dc56bbe72f8a9f935c4089b75e0ff64014971f0a01586a37902fa0ef9e499b676e0032848cae0
TLSH
T194D0121333020339C61028731142E10D1C40C14B81854100582AC91F5B184600A13461
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fc5f238957ebf9989d72e93320a3681c0e1f7db87f2f4f976ad9d022a26e6855
MD5 88f42edd34acbff4b4ddfbd96604413a
SHA1 5e4345edf4dab9224d7ee07ef1394f34d2a99312
SHA512 137f0aed014198d2f060fda3b0808504925add7aff8280c7384a7d281fc9148347eeea6e83e2a48f523bf45d4c4136f2f08445f55e89921a42c32e1077e660e3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 4414d1cb7ccfdf68a14da0e1d3963556c3b02531225e7c3e2cb85901c0d910ab
MD5 054944480cd6fe5d9e19624069107a90
SHA1 9b1cc7f53a1ae6bbcfb58921beb2d5e90471db98
SHA512 be0e93608bce32f44c29f90e44802023839178c164e0088b550b8c573f5b37f9fb09ef8f69e0b5e8085e711374694c3508512be2497ad156ad1e684144af566c
TLSH
T13CB01234D0D000C0E76B17B18BC50772386B4EA9020F07973064F02AFC307C44944304
MD5 SHA1 SHA512 TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 6978dedaa2fb885fbed92ee75e31352a85909c752fbd8fd93f67f53b3926195e
MD5 72743fcfbbba6bf1db9bc0a67a26f2ae
SHA1 97905c61194f6490d5caf719e4d7c2c3f18b6ea8
SHA512 6cf302eebc0969df4fe5adddb4a2efcb9f7e7712c1769c0f9ba7f80bc5040abe188c102f52cf0f9f67077ec6d7b7a64a3c1533b721053b51e5d8e0afed0b2028
TLSH
T12F41CC96C2E4C66DC9026AE027307917CA3E091992283E278DDEEFDA67D20B1E12110F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3f1d.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\Network Persistent State~RFe5a3f1d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 fd7f57a56d20ada08bf7fa57d20c49bc8913f9eea9816fcd74fd62a14c209721
MD5 942a73bb74e3db2d20bfe3e8f88e4e07
SHA1 a5c66e9ae52c9422f278aecccd0ba4f58f20bd05
SHA512 3f895255bf9f654871439a6c342c24792ceb6ee345085a99d57c8e8ce893555f880e4bdd93eca83dbc60a41ab09f1064597866ce50f60a7858edffd915fdc3c3
TLSH
T18711486396BEA4B7602A0C670E887C155ABBA836064354F5DA67866C70C19E3120BC33
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 54884fd9474529b349fbece6b153908e6e69fe828f5d389d944f17db49616cbc
MD5 20258820a04b84887348d50095e9bde9
SHA1 7e7f6cf34cd3e0e2addd8ec6eb8db9b645381c2a
SHA512 ff70e7a3ecc4d49475b8226ba538e6832b0d41b9a9dcf5d2a4b2cc323542a3f87e31f5ccd799c86b670f76ff88126112a96d78680ed45309c42813f0e75881e5
TLSH
T15011486396BFA5B7702A0C670D887C095EBBA836064354E5DA67866C70C19E3120BC23
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 4080f43065a2c9ed246e7645c3a3f315d87609b0b818e69189cc06ec082f4e7d
MD5 1375e883c4ecb079b45469045b066d8b
SHA1 1d14e5e202116a489146c553a877986be2c9411f
SHA512 575dcd3b69ccaf62aa8d1cafdb8a38a2ea7afa907d169bfbda7167840df37d102dba5916a51feeaa01c969d3826b47109ab10bc5f56c521a677c9de4f52a3dfc
TLSH
T1F0114862867FE4B7612A0C670D887C055ABBA836064364F9EA67867C70C59F34607863
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 5c746fd7b851b667c3055c5bf2ef3b0e3b33c18256f4b1a4851ef129ccb3234c
MD5 2f2c9e6edf86d69a02de439e4274964b
SHA1 da18efc4410b6c69c591ca09c064b0e2229b47cf
SHA512 2143aab8c83873cecba550016aac7e7c375fb11c491e063b7a4242bbcf12c3e6b9d7faa87521002b8a38dcd1cdee6ab5f1ea35b847f35695835a04ee8e9d2e46
TLSH
T173114C6296BFE577603A0C670D84BC055ABBA839064354E5DA57867C70C15E3120BC23
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 ad36a5e4dba929e7eb0b618e2b32253593567157bdd99b11d9e63c3e98fdf2f5
MD5 0a584d5f402ab4abe21c4a31aae38630
SHA1 8ba714382f18504c7bf306c384483135e6736063
SHA512 a7050837e9816e65da0f5394387247f249925c2660f0f36c089c7246fc5906602e776f4b66224f54cb7cac503dd07b7e76ee4d19dda53989bd3212ec528d438a
TLSH
T1BA11486296BFE4B7602A0C670D887C055ABBA836064354E9EA67866C70C59F3520BC23
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59865d.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Network\TransportSecurity~RFe59865d.TMP
Size 856B
SHA256 10b928967de66794df3e6c6ecb91a43d6e90627d30528d396d580af7dfe544a0
MD5 68f802c4d3376026127ca3de230cd5d5
SHA1 4c106cfc627db221bc7e674eeadf5ae4214e5020
SHA512 f02439e57aece1ece9b7d52b631c1b25ac66d4d3f14fa4df30b8a1acc86dd9b2f3fca427b92bc9ea8c828e8a3dd26c15f0243d95442dc9dd63f4174d66d86ab1
TLSH
T197114C6296BEA47B602A0C6B0D847C055ABBA839064354F9DA67866C70D19F3160BC23
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Preferences
Size 6KB
SHA256 0621e8ac932bf77b3bbb465da343d2338dec384441653e2b35464826325044dc
MD5 b70e5f2777fda18cde8ecdd62ed1430f
SHA1 6ebe254fa05d6824599753c31378d903e8d225e1
SHA512 8529a447b04ce0aad719e2ca459c40c1f1c0b53a19f9b1c834f97526312c8fd65d78751f8d63aa685d01bbf6679025d2c8b4c433b7f656ecec7ebd19125f4d8d
SSDEEP 96:stY052EXcb972ffzZ8i0vhEiktVm/7qx+WVHMSm+uecJe0jM1G/7G/qQjso+gBI4:stY0g+fLZ8paBY/S+WiTe0oikqAy6MC
TLSH
T161E1B642AE28A9B74CC7E2197A35FF16E7F5106361C44ED8ABFC851C05E66DC230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a2dd.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Preferences~RFe59a2dd.TMP
Size 6KB
SHA256 5ed1d972883dc00b9602660587925052898de35aae1961f3cd5cb9b015110c7c
MD5 743e9ad487ce541e0520bd9f5ab8156e
SHA1 17059255b4f2d2b03208e1fa7c6f9a8caf77c08f
SHA512 3191c556ed0444bb2b513bd84b5f5a2f8b4b03281acb5bb1d36db00e991c0dc6c640277ac4d47b13009caa8fcf6d47f2e333bf1b0db3ae713e77103cf2cef18b
SSDEEP 96:stY052EXcb9m2ffzZ8i0vhEiktVm/7qx+WVHMSm+uecJI21i1G/7G/qQjso+gBIB:stY0gpfLZ8paBY/S+WiTI2wikqAbR6M8
TLSH
T1E6D1A5425E68B9BB4CC7E219BA35FB16D3F6106265D44ED8EBFC851C08D66DC230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 1KB
SHA256 9ca31d4449a33751d58352009413827adb084beba452db1661fb2151f6c2f8ff
MD5 fc0eee4cf0faed3219eed1f269d03656
SHA1 94b77d043b89507d8665d093f62ecce3b7c68488
SHA512 d3169913096b61c8812b26643278ce3f475e6d30ac48f95217b2b4859443eddb24c813e7e67e621d8d0c701b9eb3b0f0d15476b6d05dd5b502a599e104c72a28
TLSH
T18F31B532F0947B7258825991B7436F436F210067D1918E8815DE0B1812E76BC7336E2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 2KB
SHA256 634efb266e2225a435b40b1f7bcfbd34a9650c4403bac346fca59190e544f3cc
MD5 8d8774a1484f6c9acdb1b9d2c987dd30
SHA1 6214c04ccad755970d02ed87156fd8d5d6ec4c0f
SHA512 38d2a9726277393bb6e79fc9ba100fe547045fb195f2d0449a680a2385c01ad05eb592d3cb85d194e3e8d5e9006063dea9ad876f5fddb30345dbc49b8371ce86
TLSH
T19D519632B814BB7789E34984BA863F13AB3251A7D6925F9459DD0B0C01DB67C2312C6B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 3KB
SHA256 7d2c4e171b0492be986616a78d5f72d5d04a06d789039ad8aa13a580fa79df19
MD5 a702b68d8632c29cd544bda682b1e2a8
SHA1 79dd6eb1313a5f75bc0eb868cedc6ecadadc8232
SHA512 99d12b6331d5e7154dfe5af613d4826db2fab29cdbd8c6328119e00d209f72a46d4d47f2a586fc65f3a1bd1dc2c00a17f543715462fe586786f407f9e07b5799
TLSH
T158719632A964E6774DE39940B9862F16B7A11167E5D16FD8C9ED0F0C02D73A82352C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 17KB
SHA256 95c39d3a3f16401d42604dfea809c13ec9dda975792a66e3022d92aea3a83864
MD5 a8c34a5939f4449aad237a4173add5f2
SHA1 083683dbcb032c5089684d930871d80eeefffb16
SHA512 fdef81c64c62aaa51f8f05c595b92e4594aac4497ce915776c045b5a1831f1fd5a9b440afc231aa4946294651147f18558a805f8cf9f1edd67a7b405682799b9
SSDEEP 384:zh+aQikB+z/xvxjg/qhEYNbZl71xRjc6locU9ze:Q/UxvxjgC+61xK6loxFe
TLSH
T162828E3AE569BA3758F3A6417A092B8BDBB144A390C55EE84DED5F0D06C73EC0307D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 16KB
SHA256 db1a8c7255ee948221d37f89a02b105c352afa78b0f8f5e2c376775b82985345
MD5 7c9e1fe310f5f51f39a81fcbe0542cd2
SHA1 97ab281853b582cc588d1dd72d96564b810bedd8
SHA512 e0417e5bc6447b752f879acc648fe551f58fca0041c8435bae63562b6021400c70bf5db6c321405467e78d3b5889c6ee247fa39546935d8f81da18d6df329d29
SSDEEP 384:zk+aQikB+z/xvxjg/qhEwNbwA71xRdocU9ze:P/UxvxjgC+Q1xDoxFe
TLSH
T10C729E2B65687E3795F3E9017A490B4BDBB584B390C26EAC49ED5F0906D73E81302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State
Size 16KB
SHA256 747b721c6b65a4d2f52eac700cd1ecff6441887d25995b17ccf52876079c307a
MD5 e9ba7e28d521390d350b0c7a2b225168
SHA1 372cbc496e0f293a3e187f8db0496097c943bfb5
SHA512 ac33289258e1a24f397edcadce9471c266567e5f85899849ad38a364d9d278e563737eca621893455dd2a369e1739b4b57468bc8b27a8ff91c2c21f1420056f9
SSDEEP 384:zt+aQikB+z/xvxjg/qhEYNbwA71xRdocU9ze:E/UxvxjgC+Y1xDoxFe
TLSH
T1C6729E2B65787E3795F3E9017A590B8BDBB584B390C26EEC49ED5F0906D73E81302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592580.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.portable\EBWebView\Local State~RFe592580.TMP
Size 1KB
SHA256 c299ddbb97cf80c5d19b8fa1ceeb98e174448d7c71de9565c1ac86e20e26b57b
MD5 9d42be319d34eb2117a62b7aa97ad615
SHA1 248ac1d10286fa585859d7f0a60b7494f271bcfd
SHA512 5679ede2e50ea2ab66fef21336dfae61df61b459ed0bab9cb1405f1c9eb7ecd564803124b3481041195802af3d3dc3d0f0331e4f3cef2ccc108b8ee2c972d85c
TLSH
T1AD21B433E098BB76A88148A1F743BB872F610167A1908E4C55CE071813DB9FC6336D77
MD5 SHA1 SHA512 TLSH

Submit Download

D3DX9_43.dll

Path C:\Users\Admin\Documents\jjsploit\D3DX9_43.dll
Size 2.3MB
SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
MD5 7160fc226391c0b50c85571fa1a546e5
SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
TLSH
T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WRD.dll

Path C:\Users\Admin\Documents\jjsploit\WRD.dll
Size 2.0MB
SHA256 4066920b058335b1741c897c8b90afed2f34ea4456f65f3865adda23aa4bbaa6
MD5 c0e1c503d794486f97b3480a965486a2
SHA1 22c1ab12a51752905cd69c6da56cd022c37a7550
SHA512 a07cf4367b1fbdccfab7766ea9f428cf97b7ee982696433ca309944f8dad1a4699c8f4e823d4ff0fd7f45b8835e2864edab439247e6696ffab3079630d5de26b
SSDEEP 49152:LgIIJP++tdy0l8Nyjto9KHdw01IrA/HX2JG:LgIIXXF9q0
TLSH
T13D959D57B25900F8C1AAD1B8CA5B9A17FBB13C594360A7FB12E4A6212F17BE14F3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
Size 4.5MB
SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
TLSH
T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
Size 802KB
SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
MD5 51b0d5f42a82f6fa8739b403e9b8b81c
SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
TLSH
T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-138-0x00007FFEBF6D0000-0x00007FFEBF6D1000-memory.dmp

Download

memory/2548-25-0x00007FFEBF6D0000-0x00007FFEBF6D1000-memory.dmp

Download

memory/3840-76-0x00007FFEBFBE0000-0x00007FFEBFBE1000-memory.dmp

Download

memory/3840-75-0x00007FFEBEBC0000-0x00007FFEBEBC1000-memory.dmp

Download

memory/6200-1649-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1661-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1660-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1659-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1657-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1656-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1658-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1655-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1650-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download

memory/6200-1651-0x000001C6025D0000-0x000001C6025D1000-memory.dmp

Download