hxxps://cdn[.]discordapp[.]com/attachments/1546624508629221467/1552360279889682512/OFDT_checker[.]rar?ex=6abb426c&is=6ab9f0ec&hm=fb6295654cef16cd287f56602119e62d13057d312d895865b38080b7f1125a81&

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1546624508629221467/1552360279889682512/OFDT_checker.rar?ex=6abb426c&is=6ab9f0ec&hm=fb6295654cef16cd287f56602119e62d13057d312d895865b38080b7f1125a81&
Sample260928-s3aevsysby

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{E5393C4E-D8AC-43A1-8C0B-3290BE0BE1C1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5812	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2000	OpenWith.exe
5812	vlc.exe
5064	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
952	NOTEPAD.EXE
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe
5812	vlc.exe

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
4740	OpenWith.exe
5484	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
2000	OpenWith.exe
5812	vlc.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe
5064	OpenWith.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2444	892	msedge.exe	85
PID 892 wrote to memory of 5152	892	msedge.exe	87
PID 892 wrote to memory of 3088	892	msedge.exe	88
PID 892 wrote to memory of 3088	892	msedge.exe	88
PID 892 wrote to memory of 3088	892	msedge.exe	88
PID 892 wrote to memory of 2408	892	msedge.exe	89
PID 892 wrote to memory of 2408	892	msedge.exe	89
PID 892 wrote to memory of 1420	892	msedge.exe	91
PID 892 wrote to memory of 1220	892	msedge.exe	92
PID 892 wrote to memory of 1420	892	msedge.exe	91
PID 892 wrote to memory of 1420	892	msedge.exe	91
PID 892 wrote to memory of 1220	892	msedge.exe	92
PID 892 wrote to memory of 1220	892	msedge.exe	92
PID 892 wrote to memory of 3668	892	msedge.exe	96
PID 892 wrote to memory of 3668	892	msedge.exe	96
PID 892 wrote to memory of 1224	892	msedge.exe	95
PID 892 wrote to memory of 1224	892	msedge.exe	95
PID 892 wrote to memory of 1608	892	msedge.exe	97
PID 892 wrote to memory of 1608	892	msedge.exe	97
PID 892 wrote to memory of 2900	892	msedge.exe	98
PID 892 wrote to memory of 2900	892	msedge.exe	98
PID 892 wrote to memory of 2900	892	msedge.exe	98
PID 892 wrote to memory of 3156	892	msedge.exe	99
PID 892 wrote to memory of 2380	892	msedge.exe	101
PID 892 wrote to memory of 960	892	msedge.exe	115
PID 892 wrote to memory of 1208	892	msedge.exe	116
PID 892 wrote to memory of 1208	892	msedge.exe	116
PID 892 wrote to memory of 1208	892	msedge.exe	116
PID 892 wrote to memory of 1060	892	msedge.exe	122
PID 892 wrote to memory of 320	892	msedge.exe	123
PID 892 wrote to memory of 3396	892	msedge.exe	124
PID 2000 wrote to memory of 952	2000	OpenWith.exe	126
PID 892 wrote to memory of 1624	892	msedge.exe	136
PID 892 wrote to memory of 1624	892	msedge.exe	136
PID 892 wrote to memory of 208	892	msedge.exe	137
PID 892 wrote to memory of 208	892	msedge.exe	137
PID 892 wrote to memory of 5268	892	msedge.exe	139
PID 892 wrote to memory of 672	892	msedge.exe	140
PID 892 wrote to memory of 672	892	msedge.exe	140
PID 892 wrote to memory of 672	892	msedge.exe	140
PID 892 wrote to memory of 4084	892	msedge.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1546624508629221467/1552360279889682512/OFDT_checker.rar?ex=6abb426c&is=6ab9f0ec&hm=fb6295654cef16cd287f56602119e62d13057d312d895865b38080b7f1125a81&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb6536c188,0x7ffb6536c194,0x7ffb6536c1a0
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,476642138273302154,15184316917264191184,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,6733488772443289719,12935706062117239591,262144 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,7286863652034827213,995579475902966012,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,18289329009342938917,13072748447041550839,2097152 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,12783370797938696326,7697990395345285538,2097152 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,2884173177645298832,5682304652312595077,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,8051941345871289342,153057472705086224,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14945647380630599838,12431648950301655399,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5560,i,18231854663178917636,15635461621900330311,2097152 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,8247807870651416628,10360069415229008184,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14744668576422643738,16004102600871034237,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14744668576422643738,16004102600871034237,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10895624278980214646,11960998310116597851,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10895624278980214646,11960998310116597851,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3732,i,14443109193519114178,17278258391370980412,2097152 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5734458368682476793,1748860679074658560,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,15298928362847591367,2671962587011016794,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,14684003412156668232,6174565077123972697,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8410749272060324418,7322217894727855331,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5916738478225823877,16746200177523953979,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3876337501730111018,2867605828342053035,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3876337501730111018,2867605828342053035,524288 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5716,i,16144486891417555226,16208048464199989525,2097152 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7068,i,16490357789774153591,10475445952318494757,262144 --field-trial-handle=2336,i,16374191183562536105,10128070826225104113,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\OFDT checker.rar
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3952

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\OFDT checker.rar
1⤵
PID:2240

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\OFDT checker.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e1b877eccffa4033a86251fd1ac836a1083702977339f2bc19730b9369b0e7cf
MD5 04b20b5e848c2bc410b459233c02eb8a
SHA1 c77f4815742b7a22968e85b0db6d7210449d0355
SHA512 26e65359330d9af5d13fde249389697992fbf8376c5a1138b9f0748d2985a486d8cd3f700b3183a0fcb8e54ca246f10e73b9eb612c85317c6219097f4f8e3ecb
TLSH
T1ACF0F9B5CD25AC3B08FD5B2950645A46EB51135B2780888B3B3D810D8FF1A3B858695C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d8ba8e7b1df613d56bde8972a94a066c2024e7169a9a7b0741e4a9e2564c49c
MD5 8328ea4c6d25756ba3fc0bd6cbb70c30
SHA1 8ac4f72bfd88c9d19dc8e0555d8655b4560ace82
SHA512 7594411022376efdb6df41fda7b1249ab83bdade7f3d69e81450453af5fa48316c60180d982eb1ab2a81212cc8f3df7679afaf3a7dbe3a02540228052ad43a72
TLSH
T1F1417CF3C2E8866EC90156F0AB146E1BCE2D0954432C3D5AC8E4EF5B97E3471E181A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eaf11e87917dde3f237738975526c197a48302b4406b50ee21ebadd9d1ef306e
MD5 10d2780545adaeb5431e15910cffbdb2
SHA1 3160e53fbd16c6e6835e56eb171620438301c760
SHA512 925cf658a9bcc0dabed2160f69e0a43a8be1a1bd97dfadb4cf38182edda61ce1202e12458167c8cdac34b6547b545f2e915c9cd054e52668dacac46220f7a7b3
SSDEEP 192:sxZbRQ9R/fXsjQZZeezodpLHW6+WNGYbITtYF1RIg5y8J:sxZboR/fXsjOZeFLHbGFhYJIg
TLSH
T1EE42C615AE28A97B8CC7D21DEA55BF53E7F91033A1941E48AAFCCA1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 51a7de1a5e01363c68cc8ed3c2a1690f31dee64b541740a2724226b1bc9c19fd
MD5 eff57f3b32517a4eba667280140869b6
SHA1 c57de66127003176ae032df18ce99c2ce3322138
SHA512 25768a84fd7f356b41d5b4e083d74c6838d4a3fc613f381cd5ce162af603b89eabaf44f6f7a1ed0983dc1f7f331b531152c6afc9cd19da4ef27bee7c0e70d4b0
SSDEEP 192:sxZbRQ9R/fXsMQZZeezodpLHW6+WNGYbIAtYF1RIg5y8J:sxZboR/fXsMOZeFLHbGF0YJIg
TLSH
T1F942C615AE28A97B8CC7D21DEA55BF53E7F91032A1941E48AAFCCA1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 60bc18db6ad55dbab1c3bb01f901c7b542d634b7769e7d2a61a1cfb2e3a82cf5
MD5 6e2cd8b32ed1e190ea5f78efeca6f312
SHA1 9d9a6c8ef18c059a6bd44f4ee71718c3cbd15250
SHA512 811fd4637883abcd633bebaa2499e83e2d28cd11d271867f851d885c785933f15340bb44d99eab8227d693c57b612b210b0aab61663151e2721c361050033d7f
SSDEEP 192:sxZbRQjR/fXsbQZZeezodpLHW6+WNGYbIAtYF1RIgj8J:sxZbeR/fXsbOZeFLHbGF0YJjg
TLSH
T1E542C715AE28A97B8CC7D21DFA55BF53E7F91032A1941E48AAFCCA1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3b60ab0c71d155b58ca9474e769e69e7840b595628a8ffb402fc1abff4512b8e
MD5 525e6f847272c0e732145feb4286bb8b
SHA1 676b5b331a53cbd00996a2ee61079d48e2e137a5
SHA512 ea6fcb0cb6d55fbfc2eedd176a1f11f3a3a2d715c774bb8aad07ac6a8466e1ff4256adf16b98da01e5bdd7a7565720fa7847e3296a6097a4f1dffb08bbf7b6ac
SSDEEP 192:sxZbRQjR/fXsjQZZeezodpLHW6+WNGYbIXtYF1RIg5y8J:sxZbeR/fXsjOZeFLHbGF9YJIg
TLSH
T1A542C615AE28A97B8CC7D21DEB55BF53E7F91032A1941E48AAFCCA1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f88f1a2442d97117cd4fcc024c0e27075cca31ff9d85d380855d8ccc109bb637
MD5 d7d6138d41982a872ca7cb49a1c514ba
SHA1 109b0d41bb864f3da39eda01bb7e657e0ff115f9
SHA512 dfdb36cde568aeaabbfa7910f4109d1d145fc8999cfb8e39a31f053718e709ab4e42d7583ce67f91ad02a02bfa50850067fa4c85e4a2cfebd0ddf40b213e4869
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXil72:OtfFvpopPxrB4Rhfix2
TLSH
T107B2241571BB021138FE690C81B5971E464232B33258EB2B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c88a6ec0a6d20bab276d3d1980c9cb7d18150687a959be487bcf9b98728d24b9
MD5 905a3eb18defd80baac3da46d128b968
SHA1 e62be8dc5c751d3c1a330ea309304d4915bd4b58
SHA512 a9d4dcede41b9de78b38fb4ae3280bc058c0573addbf13a12304122c13b5a98f92649673b2d713d3445b4e554a7bf6f5284e99f914c187af5ee6c1e105c07bdf
SSDEEP 384:nsiFPZcIvsNA8TUNTUlI4Z5mgyb64zf8BeX1vDzIoJopUNtgOIwZOypugL/7Iz2k:XFHvhwglhsBeX1bzIo+UNXsmk
TLSH
T1EFC24B72E8A8CEBBECEB8BD5B74A7A03DFF0015396889AD4D5D85D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c78dbd95c80a7140837d6bee727307d9788b11a0e4e43609908f02eb25f17707
MD5 9c6e113d46ef728931ab92a54fe941f9
SHA1 6bcdcf9946214538810e2e5168dcc6f69d49e6a8
SHA512 99ac8e29b162808c466625a13103a3f477e706b5cd536f9dece3caff971c83bfa5ae744456e95faeb4ebe46d7fbe6130eb242b745bc0c9572155550581c1571c
SSDEEP 384:nuiFPZcIXsNA8TUNTUlI4Z5mgVb64zf8BeX1vDzIoJopUNtgOIwZOypugL/7Iz2k:FFHXhwgl+sBeX1bzIo+UNXsmk
TLSH
T1D5C24B72D8A8CEBBECEB8BD5B74ABA03DFF0016396989AD4D5D85D5C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5c48a9a2ecf31a0f806da0e8fa180475dede5fd0e1e1e0895ffeececf4e87da6
MD5 e9e7a7e63d0921a5a25b32d80fa674a2
SHA1 5310ad0b3d0f6038219351c066bcfa740332efcb
SHA512 aed6c6a00e4cdc6b34954fd5777cd363c1779ba0b06d0fb3868bb3e26217e0e63e365f8ba8ac5ff411a653beef6da2a3d59ee53a9baee10f7333673bb3e0fa59
SSDEEP 384:nsiFiZcIm3sNA8TUNTUlI4O5mgxb64zf8BeX1vDzIoJoHUN8VPgL/7IzzoB:XFQm3hwg0usBeX1bzIocUN8ti
TLSH
T177C23A72E8A4CABBECEB8BD5B74A7A03DFF00163969C5AD4D5D95D1D00871AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9da6b02a86ec3d8d7711fa44a4760ed32f96b272007f1c2c04671d74bb9a6415
MD5 6b9905b7dd5a78fd8f9c09bd772b1c61
SHA1 46cea9a8396467e77b3d83098f4b81cad04ce4c0
SHA512 1b3d4fd4dce22bce03f85a24b76020a71772e964793a80cf759f953361dedbc2104753996ec71b1f3b9e1351c27201dfe21421131bd97a9d46eba95383aaff70
SSDEEP 384:nsiFPZcIXsNA8TUNTUlI4Z5mgVb64zf8BeX1vDzIoJopUNtgOIwZOypugL/7Iz2k:XFHXhwgl+sBeX1bzIo+UNXsmk
TLSH
T11DC24B72D8A8CEBBECEB8BD5B74ABA03DFF0016396889AD4D5D95D5C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a4bbd5b1705f25a412d72abb302074905a7fc42a8127c0418b9fadc80e011032
MD5 2d9dcd65f6e7901a7c0fa2c038e8e281
SHA1 78903b28363f4dad787044bd1dcef1ae525836a3
SHA512 8e7a9f66be41bd70fc855019dee934c7c512d770803cea01ec5e7c0df079f9d4365b78026b690657e881345a38470da17339d27ebd643c029fe281375fdcbda1
SSDEEP 384:npiFiZcI63sNY8TUNTUlIm25mg57n4zf8BeX1vDzIof+E7O6R2FeobgL/7IzpoZ:AFQ63FwgSIJBeX1bzIofT7TRkm
TLSH
T123C24B72EC98DABBECFB8F99A74A7A07DEF00163859C59C0DAD85E1D008759D0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d79d9b0d19dc70bdf9f7e1ea324179b7a813f310569759bec54211403063ff62
MD5 de73efb798a9f726eed4b815d136d676
SHA1 9eb934e727ce3baa8253626bec6db8613ed44011
SHA512 edbd9aceb9e30c90d493485a47dd761a912bf82f298161b0ff9b796caf04088c4990715fe429fa7cee3f530bacfdf16316281d5527ec9eb908dc4c786365a265
SSDEEP 384:nxiFPZcIVVsNA8TUNTUlI4Z5mgyb64zf8BeX1vDzIoJoGUNtgOIwZOypugL/7IzX:YFHbhwglVsBeX1bzIoPUNXsmk
TLSH
T178C24B72E8A4DEBBECEB8B95B74A7A03DFF0056386989AD4D5D85D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 32ead41eeeef127aa6e0794068c8d3f00ba0ece699d3ed24e878a17aea3459ed
MD5 f18f7067314c89728c8b050a13f19c11
SHA1 0c95be755691a52199ca8c4957786d977fe9d489
SHA512 d00a322cb53e0656aa76f1c2e1e1fe883f9f849a8e33ae3babe6a5d21348e5869044e1bbc31ad270158af6c745ae1b16b573af28f78dbe053ce2960fc8415338
SSDEEP 384:nxiF1ZcIVGsNi28TUNTUlI4Z5mgWb64zf8BeX1vDzIoJoEUNtgOIwZOypugL/7Ij:YFNET2wglpsBeX1bzIoFUNXsmk
TLSH
T1FDC24B72E8A4CEBBECEB8BD5B74ABA03DFF0056386989AD4D5D85D5C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c82569dabad54c037aae05bdb335b4890a0a47f8b15b0c9e55a2748aa0f86f9a
MD5 fab4b903821274aff916540cefbc9fe5
SHA1 134fb36c0f9647f8686eb3fd79c878f169146768
SHA512 e7ab72b7cf3342e57efde6ca22753498977f5467164ce690888e06b77f38f04cc50f42238a2d1dc8871415bb54e71923c8f4a55990e70a4b3d280b2e95ff20ee
SSDEEP 384:nxiFqZcIVbsNi28TUNTUlI4Z5mgfb64zf8BeX1vDzIoJo9UNtgOIwZOypugL/7Ij:YFItT2wglEsBeX1bzIo4UNXsmk
TLSH
T1CEC24B72D8A4CEBBECEB8BD5B74ABA03DFF0015386989AD4D5D85D5C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fda9154ff1a4f057f46f75cc22d32ef99e0a63f5abb4c31a3c09ba21a7b780ce
MD5 b275a3e899edf45d32fc435a4c176789
SHA1 c5513ce5557f7bc83ec1253defdc1ddd8690e622
SHA512 84b37c800b582143280b220e4de3b1c5037f779d6801b8c93fd9467a5e0fb1c5f65cddf5978ccc358d949fa057b736b597b88f8ecc5e708121af9ab7387928f1
TLSH
T1AC412998B7E91148B3B36F1A9BF6686D483E79372F0BD49D10010E4F4A62B41C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

OFDT checker.rar.crdownload

Path C:\Users\Admin\Downloads\OFDT checker.rar.crdownload
Size 21KB
SHA256 377cd7430bb9d51192ecfb4bb8204ea378a5baea0767acf498928a00c214b80e
MD5 34c48625b165faa073a94a05236b6173
SHA1 d9235a15c78026a748631cc4100b23fdad0d6e95
SHA512 961b03ad9a688bf5ce466079800ff497b8947e8a43d4e513d48028a4df60d26b27c155e7e4d2cbebf720f65e2cf925c31dd0e2c26d7a343b234fb90ce079c036
SSDEEP 384:K65CkZQLBl5JWxgq0CZu+1p1eu81iNbgbYf4TyE08TgIOjD45CqD4Sly60q:vMFJL6lpwRmgT08TgIOjDyPD19
TLSH
T183A2E14C881E9A840BADD1740B388B2FFC476C9C556DF3C6F029216439B66109DB2DBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5812-317-0x00007FFB71D20000-0x00007FFB71D54000-memory.dmp

Download

memory/5812-316-0x00007FF7E6400000-0x00007FF7E64F8000-memory.dmp

Download

memory/5812-318-0x00007FFB620A0000-0x00007FFB62356000-memory.dmp

Download