77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EZFN Launcher_1.3.3_x64_en-US.msi
Size 7.4MB
Sample261024-trm29azz2k
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1196	EZFN Launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File created	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1070066160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_364957864\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2564_914780746\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\be\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_364957864\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{ED5C5759-EE42-4338-83F8-E608577764DA}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_923416825\protocols.json	msedge.exe
File created	C:\Windows\Installer\e5a3365.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_364957864\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_923416825\manifest.json	msedge.exe
File created	C:\Windows\Installer\e5a3367.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF8CE435BBC2D0E9EC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\ms\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_823299998\_locales\my\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI3809.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF643748186124C86A.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EZFN Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EZFN Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	msedge.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\shell	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\PackageName = "EZFN Launcher_1.3.3_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Version = "16973827"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\URL Protocol	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\ProductName = "EZFN Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\PackageCode = "60959306AC750F547825A0F9396B9C69"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\shell\open	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{516EC3DA-4A0E-4DD0-A4C7-D15E1923999A}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\ProductIcon = "C:\\Windows\\Installer\\{ED5C5759-EE42-4338-83F8-E608577764DA}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\shell\open\command\ = "\"C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe\" \"%1\""	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\ = "URL:org.ezfn protocol"	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	msiexec.exe
4860	msiexec.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe
1196	EZFN Launcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5972	msedgewebview2.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1208	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	1208	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1208	msiexec.exe
Token: SeLockMemoryPrivilege	1208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1208	msiexec.exe
Token: SeMachineAccountPrivilege	1208	msiexec.exe
Token: SeTcbPrivilege	1208	msiexec.exe
Token: SeSecurityPrivilege	1208	msiexec.exe
Token: SeTakeOwnershipPrivilege	1208	msiexec.exe
Token: SeLoadDriverPrivilege	1208	msiexec.exe
Token: SeSystemProfilePrivilege	1208	msiexec.exe
Token: SeSystemtimePrivilege	1208	msiexec.exe
Token: SeProfSingleProcessPrivilege	1208	msiexec.exe
Token: SeIncBasePriorityPrivilege	1208	msiexec.exe
Token: SeCreatePagefilePrivilege	1208	msiexec.exe
Token: SeCreatePermanentPrivilege	1208	msiexec.exe
Token: SeBackupPrivilege	1208	msiexec.exe
Token: SeRestorePrivilege	1208	msiexec.exe
Token: SeShutdownPrivilege	1208	msiexec.exe
Token: SeDebugPrivilege	1208	msiexec.exe
Token: SeAuditPrivilege	1208	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1208	msiexec.exe
Token: SeChangeNotifyPrivilege	1208	msiexec.exe
Token: SeRemoteShutdownPrivilege	1208	msiexec.exe
Token: SeUndockPrivilege	1208	msiexec.exe
Token: SeSyncAgentPrivilege	1208	msiexec.exe
Token: SeEnableDelegationPrivilege	1208	msiexec.exe
Token: SeManageVolumePrivilege	1208	msiexec.exe
Token: SeImpersonatePrivilege	1208	msiexec.exe
Token: SeCreateGlobalPrivilege	1208	msiexec.exe
Token: SeCreateTokenPrivilege	1208	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1208	msiexec.exe
Token: SeLockMemoryPrivilege	1208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1208	msiexec.exe
Token: SeMachineAccountPrivilege	1208	msiexec.exe
Token: SeTcbPrivilege	1208	msiexec.exe
Token: SeSecurityPrivilege	1208	msiexec.exe
Token: SeTakeOwnershipPrivilege	1208	msiexec.exe
Token: SeLoadDriverPrivilege	1208	msiexec.exe
Token: SeSystemProfilePrivilege	1208	msiexec.exe
Token: SeSystemtimePrivilege	1208	msiexec.exe
Token: SeProfSingleProcessPrivilege	1208	msiexec.exe
Token: SeIncBasePriorityPrivilege	1208	msiexec.exe
Token: SeCreatePagefilePrivilege	1208	msiexec.exe
Token: SeCreatePermanentPrivilege	1208	msiexec.exe
Token: SeBackupPrivilege	1208	msiexec.exe
Token: SeRestorePrivilege	1208	msiexec.exe
Token: SeShutdownPrivilege	1208	msiexec.exe
Token: SeDebugPrivilege	1208	msiexec.exe
Token: SeAuditPrivilege	1208	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1208	msiexec.exe
Token: SeChangeNotifyPrivilege	1208	msiexec.exe
Token: SeRemoteShutdownPrivilege	1208	msiexec.exe
Token: SeUndockPrivilege	1208	msiexec.exe
Token: SeSyncAgentPrivilege	1208	msiexec.exe
Token: SeEnableDelegationPrivilege	1208	msiexec.exe
Token: SeManageVolumePrivilege	1208	msiexec.exe
Token: SeImpersonatePrivilege	1208	msiexec.exe
Token: SeCreateGlobalPrivilege	1208	msiexec.exe
Token: SeCreateTokenPrivilege	1208	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1208	msiexec.exe
Token: SeLockMemoryPrivilege	1208	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1208	msiexec.exe
1208	msiexec.exe
1196	EZFN Launcher.exe
2564	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1208	msiexec.exe
4860	msiexec.exe
2876	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2876	4860	msiexec.exe	90
PID 4860 wrote to memory of 4576	4860	msiexec.exe	96
PID 1208 wrote to memory of 1196	1208	msiexec.exe	99
PID 1196 wrote to memory of 5972	1196	EZFN Launcher.exe	100
PID 5972 wrote to memory of 5352	5972	msedgewebview2.exe	101
PID 5972 wrote to memory of 912	5972	msedgewebview2.exe	102
PID 5972 wrote to memory of 912	5972	msedgewebview2.exe	102
PID 5972 wrote to memory of 912	5972	msedgewebview2.exe	102
PID 5972 wrote to memory of 912	5972	msedgewebview2.exe	102
PID 5972 wrote to memory of 4804	5972	msedgewebview2.exe	103
PID 5972 wrote to memory of 5268	5972	msedgewebview2.exe	104
PID 5972 wrote to memory of 5268	5972	msedgewebview2.exe	104
PID 5972 wrote to memory of 5268	5972	msedgewebview2.exe	104
PID 5972 wrote to memory of 3748	5972	msedgewebview2.exe	105
PID 5972 wrote to memory of 3748	5972	msedgewebview2.exe	105
PID 5972 wrote to memory of 3748	5972	msedgewebview2.exe	105
PID 5972 wrote to memory of 3748	5972	msedgewebview2.exe	105
PID 5972 wrote to memory of 3748	5972	msedgewebview2.exe	105
PID 1196 wrote to memory of 2564	1196	EZFN Launcher.exe	106
PID 2564 wrote to memory of 1600	2564	msedge.exe	107
PID 2564 wrote to memory of 4708	2564	msedge.exe	109
PID 2564 wrote to memory of 4752	2564	msedge.exe	110
PID 2564 wrote to memory of 5316	2564	msedge.exe	111
PID 2564 wrote to memory of 4752	2564	msedge.exe	110
PID 2564 wrote to memory of 5316	2564	msedge.exe	111
PID 2564 wrote to memory of 5316	2564	msedge.exe	111
PID 2564 wrote to memory of 5704	2564	msedge.exe	119
PID 2564 wrote to memory of 5704	2564	msedge.exe	119
PID 2564 wrote to memory of 5704	2564	msedge.exe	119
PID 2564 wrote to memory of 6068	2564	msedge.exe	113
PID 2564 wrote to memory of 6068	2564	msedge.exe	113
PID 2564 wrote to memory of 6068	2564	msedge.exe	113
PID 2564 wrote to memory of 4380	2564	msedge.exe	114
PID 2564 wrote to memory of 4380	2564	msedge.exe	114
PID 2564 wrote to memory of 4380	2564	msedge.exe	114
PID 2564 wrote to memory of 1048	2564	msedge.exe	115
PID 2564 wrote to memory of 1048	2564	msedge.exe	115
PID 2564 wrote to memory of 1048	2564	msedge.exe	115
PID 2564 wrote to memory of 4664	2564	msedge.exe	117
PID 2564 wrote to memory of 4664	2564	msedge.exe	117
PID 2564 wrote to memory of 4596	2564	msedge.exe	118
PID 2564 wrote to memory of 5704	2564	msedge.exe	119
PID 2564 wrote to memory of 4596	2564	msedge.exe	118
PID 2564 wrote to memory of 5704	2564	msedge.exe	119
PID 2564 wrote to memory of 4792	2564	msedge.exe	120
PID 2564 wrote to memory of 4792	2564	msedge.exe	120
PID 2564 wrote to memory of 4792	2564	msedge.exe	120
PID 2564 wrote to memory of 6016	2564	msedge.exe	121
PID 2564 wrote to memory of 6016	2564	msedge.exe	121
PID 2564 wrote to memory of 6016	2564	msedge.exe	121
PID 2564 wrote to memory of 820	2564	msedge.exe	123
PID 2564 wrote to memory of 6348	2564	msedge.exe	124
PID 2564 wrote to memory of 6348	2564	msedge.exe	124
PID 2564 wrote to memory of 6388	2564	msedge.exe	125
PID 2564 wrote to memory of 6388	2564	msedge.exe	125
PID 2564 wrote to memory of 6384	2564	msedge.exe	128
PID 2564 wrote to memory of 6384	2564	msedge.exe	128
PID 2564 wrote to memory of 6424	2564	msedge.exe	129
PID 2564 wrote to memory of 6424	2564	msedge.exe	129
PID 2564 wrote to memory of 6408	2564	msedge.exe	131
PID 2564 wrote to memory of 6896	2564	msedge.exe	132
PID 2564 wrote to memory of 6876	2564	msedge.exe	133
PID 2564 wrote to memory of 6560	2564	msedge.exe	136
PID 2564 wrote to memory of 6560	2564	msedge.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\EZFN Launcher_1.3.3_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files\EZFN Launcher\EZFN Launcher.exe
  "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --no-proxy-server --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1196.5276.9018523779894233833 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x120,0x7ffb051a5fd8,0x7ffb051a5fe4,0x7ffb051a5ff0
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,1694672181072294054,15287675966052349334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1744,i,1694672181072294054,15287675966052349334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1744,i,1694672181072294054,15287675966052349334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3264 --field-trial-handle=1744,i,1694672181072294054,15287675966052349334,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f /prefetch:1
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4132 --field-trial-handle=1744,i,1694672181072294054,15287675966052349334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c78890a7e39b9f2e432c8e00354cd2a555baaf8f
      4⤵
      PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffb05abc188,0x7ffb05abc194,0x7ffb05abc1a0
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,5603388990626220091,1987882277859811402,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
      4⤵
      System Time Discovery
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,7411035548121426232,7806807660728286305,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2020,i,1378237561281404096,10349964732079664691,262144 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,16388966314958886918,18145685270658887381,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,2373437545515548907,8023547790865664611,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,6510573808908227440,7554791808059038547,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10507624433122819110,3702988440345404114,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,15474605981231324999,11027689496772114174,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:14
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10130823398875786060,6269383560917509491,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,7202050066604578863,16410152665775745961,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5776,i,9493529774472971737,10701628596474637917,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5124,i,702902299149521672,11233353806731182946,2097152 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2266052071211274924,14575189544199357403,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2266052071211274924,14575189544199357403,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,1677703374435651570,3665860287393350867,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,11890759495592208192,4109039089459971454,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,8169595070001890370,13629515341695776233,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,15056199513979121523,5567682547653973464,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,5426579297142222404,13213774251519526037,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,8200666743221911651,774631600604551783,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,8554391010027589445,1551733247807464131,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,12547638007686104560,13801820206343303985,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,4080985981667773858,14068877919730043087,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,14006075695169648693,16366441346158411568,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3084806595165039961,11549723966493084488,524288 --field-trial-handle=2680,i,9216028113889277479,17584910789943888901,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:3764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 06EEE6F04312FE463FD5EE76A7DDA7B5 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2876
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a3366.rbs

Path C:\Config.Msi\e5a3366.rbs
Size 10KB
SHA256 909c209bfeece6e0a2ab9465bc06071e982376ca78c0300f3a1ed5bacc4f69d2
MD5 83f8c6392df6b56e553ebbdded8c2d8b
SHA1 9244b01ed9c77e853d7ddd6185b6557331fca977
SHA512 4f163584fdc995d9b4dbf63cd5736681560258fa724983569d7b4d75fa37ddd8bd337a6e64ec81530720dabffc084ec24a3557d644784e6e338ce1c041fa3f1a
SSDEEP 192:XSDCeCSCQCfCNgC3bOCJeMPPeG7yMPPeT+7d/iFLDWyi0/z/5hppSP:X5VRvaFKAMAtjUrk
TLSH
T1B6220E42F20481D2FCD61B71E30727553FB3D7CA630A574705AEA9718F86B942FA82CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 11.4MB
SHA256 3dd8c79514ac61b139d7236a9e760bf8ad4621519e72d78f3631c9a322a923c7
MD5 96d67208707f94c6780dee71fca3dc8f
SHA1 f4e93c415653eb1f055a8a3b207de3eaf0021580
SHA512 b3722d8802cccd8d63052a577607b32a48210135df7a353159cb8d53e7f4aaf73673c7d308bb557f978c9efb97e9a9643e8d78d4e47135c2ec1b5c596a28aa5e
SSDEEP 98304:afpRPMP+ImHjxdyD66ComQOBYM5FB46uIbvvnU1gwZuXbfbVSOS5naiNHT62ReMO:sYV9CVXbfbVUnf42RWg1Nsep8BLHPNM
TLSH
T197C6AE03F29181E8C0ADC478835BA637EB32BC8D4525B25F1BE44F612E66F60AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 1KB
SHA256 1c15971f4046a77466daa1709f7c3b55b3fc40158facb76a465ee5c1ea4d9111
MD5 85a1bdf019740c26b8bcecdb17211e31
SHA1 8b85a0447364d4c710a00e05961b8e8e2a1d40d4
SHA512 9860ffab7ab031fce365851de2b6645b89480122b10f885ec3d8c7073f799f1cc50128f8efecf444ddc98196bda2db266786474fcd536d44e05ec12633d196d8
TLSH
T1A141BB202BE56B5EE3778B319D318B019B23FC06B1288F1E9186D1830925500DA79F7D
MD5 SHA1 SHA512 TLSH

Submit Download

~ZFN Launcher.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\~ZFN Launcher.tmp
Size 2KB
SHA256 1a847a66d454248bb31204ef3e6b3aec35ee0c02e79044ccaad169418799fc6c
MD5 0a0c68420e476a53e67d7e6bd046b171
SHA1 3528a9a46df025ce745d357c4c561dd7a15579f8
SHA512 2d2546299845ec20e70957ea4a35cd3f35191d86dcb106e4d400702d3048951769a4587104ac716115410fc60993da80bd9e5d531ef68bdfcce7c5b6c28d9d7e
TLSH
T1B041AC206BE56B9EF3764B3699318B019B72FC06B5288F1E914AD1820929500DA78F7D
MD5 SHA1 SHA512 TLSH

Submit Download

builds.json

Path C:\Users\Admin\AppData\Local\EZFNLauncherV4\builds.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4b3f06f2-2c59-46ba-aaa9-3933ebe74e7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b3f06f2-2c59-46ba-aaa9-3933ebe74e7b.tmp
Size 42KB
SHA256 97e962c8b78aebfb0423ca95ab41a8dfa01d352cee1ca032462151119683026a
MD5 d1920407b6aca0fb38ed4d9d614adcbd
SHA1 c7cf126b968df26e3ec3e9080ea172c4152d340d
SHA512 260e2d3d39d97d9ca00168c45cc09ec212c935fbb0e4238366f8b670348a76bd78d95df8003df49000f7cfe50b6fa7e33efcf8ea855c39cb4b0eb560e8e26fb6
SSDEEP 768:fFdF3QwgkheSspmtdEjztKOeRFZD1fTos7Rjk66Lj:/F3zNqY1fT/RYBv
TLSH
T1F0133AF5A8D78933D8AE9743A33D7D46AEBCD163B5884884B7845D0CCC866BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4da30e58-b778-458b-9c8e-1b5316441cbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4da30e58-b778-458b-9c8e-1b5316441cbe.tmp
Size 40KB
SHA256 aeff91fea67b7381e04e4b84136e9ce8794d0437fa2353ea22d4ba34216fe185
MD5 ffd6d60ffd5461b351f0dc8db465107d
SHA1 6f5d317b780d7d68b8d5d9a843202ea55b9afe22
SHA512 8df55604c6f2af75181135ba9ee9d82d021629a71cfbd3f348e68a8b2d769c04dfeed6d525fdec93d0fe35359450b40c97dd42311ed0a29ead2aa5ed537e82f3
SSDEEP 768:g/UxvxjgC+k3iTeybNbspmtdEjztSOeRFZD1fTos7Rjk6um:NZj3+k3iCuUY1fT/RYDm
TLSH
T18303BF39B8D89C239CF6E244B24A7787BEF414B388C95D9855D95E0E0887BED134B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e1321a1-6657-4f14-bf4a-76737528a147.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e1321a1-6657-4f14-bf4a-76737528a147.tmp
Size 37KB
SHA256 92bc6c63f32cd4a084e17531464218e4d03b0613d8c8536e5b651ab622d8b040
MD5 2599e4a43ece7e1c73c42a4daa7d1e43
SHA1 5d136b45c04d1ec31ef402d6274e8b3eb386929d
SHA512 603c38617d622877ad95e44e764ab73e02930848bd787a1479d48d255c31d03bcfcd715591eabe5753426d62a60a47c20b971acb1afbf2d137e2e835a6414992
SSDEEP 768:z/UxvxjgC+k3Nx/ybNbspmtbOeRFZD1fTos7Rzg/+Pu:GZj3+k3NpJY1fT/RcKu
TLSH
T1B003CF3AF8D45D338CF7E244B20A764BBFF455B395C91A9809ED2E0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a24cc3b-279e-4806-b53b-c8dc4259cb11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a24cc3b-279e-4806-b53b-c8dc4259cb11.tmp
Size 33KB
SHA256 f81664fa4d7770335c05e27b7ccdabbe6125b2eec0497317bda1d605cbba8ac5
MD5 405263e0a8c512c920c01ab4df6b2b2b
SHA1 4c2e79d1f367b8eb610f89443fb055941b8e3873
SHA512 5b2dbd253caf2de3e62f92ca3e1601e1764a334b8db3afc08320ec4e307f469f6d3cc0c0062b8abee26402209590e35862b29a5b68a1ab9d56020d68b0e760d4
SSDEEP 768:dI3ibeybNbspmtdEjztCOeRFZD1fTos7Rjk66Lj:dI3iquCY1fT/RYBv
TLSH
T198F29F35B8D49D234CF6E241B24A7687BFE451B3C9C84D4895C96E1E04C7BEE274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

19eb2017-0eac-42f5-b4b8-367e9c67740b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19eb2017-0eac-42f5-b4b8-367e9c67740b.tmp
Size 12KB
SHA256 e7636bb2a7796acfbd43aeb876b0646642373fcba236279c9a6bb52bba051f08
MD5 6f24019f6543bf96d02913bc193245c5
SHA1 9dbcdbd7273afb3a8e1d434d95b4990901175734
SHA512 8566f481f475b9a1ebebe44efc5b8b2fc28f0e9d49a9ba2f89d40a2bd26e178643ce337f1f32dd0340c54db09b7fa0118293a680fe3e018d726d8c5ab2646278
SSDEEP 192:sxRiRRCO/f/s0/+ZZvVmzoA8paC/g6+WNYip/zMN2EtMq3eDfYGGdIgD1/HJ:sxRiyO/f/so4fR/5z/6v9p
TLSH
T1AE42D856AD64697B5CDBD219FB55BF53D2F82032A0901F48E6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d923aff-99a4-4f76-ade4-a63fc2eb0bf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d923aff-99a4-4f76-ade4-a63fc2eb0bf1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2641f87c-175a-48fb-a0fd-d9b71559e1a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2641f87c-175a-48fb-a0fd-d9b71559e1a1.tmp
Size 12KB
SHA256 df1a0d0fead28bf1b5154ed5ffe5e7881690dfac7ac4cd545db15b257f7f8db0
MD5 19eb566b4e2ab414bb61b8d851df4a17
SHA1 ad2a2374f9c231530ccf4db0fecce8962ba7b689
SHA512 fb6884d94e597d4c08324ac299786337fca7643bba0c27763e404ba8c334cbb18c293205ab0df9ae84b18e7a28f8c3f93cf32637f59edbe4bd56985e0cd0dbfd
SSDEEP 192:sxRlRRCO/f/s9+ZZvVmzoA8paC/g6+WNYip/zMN2EtMq3eDyUGGdIgV/HJ:sxRlyO/f/s94fR/5z/68Rp
TLSH
T15342D816AD68A93B5CDBD219FB55BF53D2F92032A0D41F44E6FC891C04EB6ED620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

518e2ac3-9267-42c2-9275-efaf4a79bde4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\518e2ac3-9267-42c2-9275-efaf4a79bde4.tmp
Size 12KB
SHA256 e881049e9105913b1e699c0a6cca78b2310345552d236f9184f03ed2b47259c1
MD5 c1a785426379db337bfb71389cd2b1eb
SHA1 c1f74ede4e5709cfe5b23bab8b9ec9001393f4be
SHA512 1a903004205089ab51099f62c754e1993bbe833b1a0561dc573539f89e8daa34f84761df9d4cf2cc6b25050aa81fcae49eb3700ab4d6fbc53f25000c2e31a482
SSDEEP 192:sxRiRRCO/f/sI+ZZvVmzoA8paC/g6+WNYip/zMN2EtMq3eDyUGGdIgD3/HJ:sxRiyO/f/sI4fR/5z/68rp
TLSH
T15342D856BD64A97B5CDBD219FB55BF53D2F82032A0D01E44E6FC891C04EB6ED620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

912ca0ca-d604-41f8-a63c-c6ce9cae1487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\912ca0ca-d604-41f8-a63c-c6ce9cae1487.tmp
Size 29KB
SHA256 a3fb369b5e539d315cba0e484b678c937df65b172fd68c2228a6fb2383a40e55
MD5 a00c54c14dad64a64adf1050d70b40a0
SHA1 f5f696d98086ca031f9d0657a85c356cad6e6f53
SHA512 5560d0ffe6c4db2342e2b2fc923b972b6d43d706f891f7ff69417ea0a0e30669ba82fc305ef4baea670b798741f3be22d596613d56cb556f6e62fb10e017ec67
SSDEEP 768:SzYbsR7pLuLj7UWgasfM68F1+UoAYDCx9Tuqh0VfUC9xbog/OVufw8WSEroGibC:SzYbsHEj7UWgasfM6u1jaNfwtSPrbC
TLSH
T14DD2DA7B640CCB7E4F804ADDDD1A7A9E6DA802CB96D8C98447FE941C03C67EB511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 37ebb0967976afb4f236948be505e9ee2b354022c8114d78ea80fa4d234a8807
MD5 59d6ec3397e45fbc9b349f9215607789
SHA1 f1dcde70c7a4f8495ea3985a45974b2d54d6063d
SHA512 3d0262aada2f335e6928363f80210bab58000d093a656e9f38564478de0040b8827292a5dd772749baa3e1cd4d0c8726b2a5ba4268e1f099ecdbd0387b8f657f
TLSH
T138E026C848CCC23EA78DA497016C530CC7902B5BA2C0796E1745CA8AB04F140A3A76D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bd70ff82866c8235ef38621b14b0aa8847702926465eaa6d6129c8dc71547351
MD5 831be2c090092364cb5a35c325aed317
SHA1 712a1f0a4c034f925ad24fd9b404f5abaf23af14
SHA512 0cd2feb03b61a5f042c7726bb78323598cb7349001310e2f8faec74a7b15ba442267be49640d6140ee135fa3755a652972bdd63487a7511decae4afa8563a454
TLSH
T10071BBD566A994A0C77C803054EB6F9F373A8171695F9EC61558C0FF9B463E2C328C34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3da0873bbaf187b15cd1489a0d7e2290f25daebf2ce59b092d12cdf4a0cc6467
MD5 831101305ecd8d6e34c1a23080add154
SHA1 c1262115f7e1afc79ce110b8ecac82160bfbf5db
SHA512 54f1ac238cfeda8355276e58736465b564f34726526002810ee945b9557b63bf2e62e15b5879985e498ac942f4ad83387148e995a09eca8618b832ea20e38302
TLSH
T10251A6C5667C9091C77C943060DB1BAF373A86B17A9F9EC21569C0FE5B4A3A7D208C78
MD5 SHA1 SHA512 TLSH

Submit Download

ca943012-1cd3-4854-9c63-2323b2d8181d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ca943012-1cd3-4854-9c63-2323b2d8181d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3fd189a4-dcae-4c08-8728-217ad46971bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fd189a4-dcae-4c08-8728-217ad46971bd.tmp
Size 6KB
SHA256 05f490e7cb372b0147382f2bb4454e310862904ad42e7e1109a42bb36f579a9e
MD5 7b71f5579dee8ecb88bcdde8cc93880f
SHA1 97e5eb1c4fdc4cfe8a4234c408ac362d7ee80fa5
SHA512 f1d98c7f3a7f43743029ae5e52f89c12494014e2478a69d6f6f484dcefdeb4b4f1dca6d6e155fee80e1065ff11f4041b809aab1acf364fb13fe9a6e8dd73c503
SSDEEP 192:DD249J5hRRgVaZjhsxjf40IbqcU6vEh9VdeZGiT:DD24L5hRRgVaZCxjf40Ibqc3vM9VdeZ7
TLSH
T1DFD1EEF3C3E486ADD90152F0AB187E1BDE2D0995832C3C5A85E89E4B93F2470E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f19bff1-6835-40b7-80d3-e1da09d2eea4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f19bff1-6835-40b7-80d3-e1da09d2eea4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bd73d382-ef8e-449b-ad74-36b52072f91b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd73d382-ef8e-449b-ad74-36b52072f91b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b86cb592-8762-4231-a570-95a7c95e57be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b86cb592-8762-4231-a570-95a7c95e57be.tmp
Size 38KB
SHA256 d35c894640a345cc47897bb57fa619d9687c44cbcdbf134c2923658ccb69a6db
MD5 872d4aa72b7d61e7f02a3e773f70576b
SHA1 29e4d83a5d36aa0b6869446d3011eff31d585c00
SHA512 5692661d37d5b80974c931183d38db8562dcbd73483310ca090993142b55e5b86203531299b2ef5d61c73b752264f6cd2aaa4efaaf7c2ac9af3662988dc6fd4b
SSDEEP 768:h/UxvxjgC+k3Fm8ybNbspmtdEjztbOeRFZD1fTos7RCk/+Pu:0Zj3+k3F1uxY1fT/RDKu
TLSH
T13403B039B8D89C335CF6E244B24A778BFFF414B389C95D9849D96E0E0487B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24cfa265-24fd-44f2-81ee-c44d26761013.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\24cfa265-24fd-44f2-81ee-c44d26761013.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d11710b5-4158-4cea-a05e-bbcd635b542d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d11710b5-4158-4cea-a05e-bbcd635b542d.tmp
Size 33KB
SHA256 dc6c7fbd95cfee3f5a2d5ca63460b2fd53584bf46377f917061e489f37ed0522
MD5 adb666f4cbe2ac3065de7362d7a55c1c
SHA1 8403ea9af86704405d4634fd3122180eb922ce00
SHA512 c3029518ae56e43c9db42cf0af41b2c8afd39ef35ea08ca8cb357abba46cde1cce2cb5d3d9e88b10e4723682a2fc9454a1f654f203d27e8ac6906c11eeb73832
SSDEEP 768:qI3BbeybNbspmtdEjztCOeRFZD1fTos7Rjk66Lj:qI3BquCY1fT/RYBv
TLSH
T122F29F35B8D49D234CF6E241B24A7687BEE451B3C9C84D4895C96E1D04C7BEE274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12b8cfcf-fb55-4adc-84d6-4cee82f60e83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\12b8cfcf-fb55-4adc-84d6-4cee82f60e83.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

43300eb0-014e-4f4e-8261-8d5855d1b0d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\43300eb0-014e-4f4e-8261-8d5855d1b0d1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MSIE054.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE054.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7597e4e-1b65-463b-b789-bf594d98933e.tmp

Path C:\Users\Admin\AppData\Local\Temp\f7597e4e-1b65-463b-b789-bf594d98933e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2564_1703491673\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2564_46641856\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

6bd8afaa-a2ae-4a86-9dbd-68690507aaa4.tmp

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\6bd8afaa-a2ae-4a86-9dbd-68690507aaa4.tmp
Size 15KB
SHA256 30cfb9ac7c9836d0effc134437814bb201c0be0f3cf19b4b688d165e6c484134
MD5 4408210cc8ff180e95e01ca8bb66d449
SHA1 60d919149e546e15ff9b213f5ed916a9f1d876cb
SHA512 b3aae5b3b43f3769447e9084066fac3b42ab721f007d1bc44dcc7d5af4287af45e95fa03766205e0cb8c8417cdd229a2994c74e5d85c42ee7eda8c1296fb2f41
SSDEEP 384:X+OBqImmJvGBLx3NaFMJFnNBSnXDWMU8g6rZ:mcvGtlN61Uyt
TLSH
T1E072AE3A2CB66E273CB7C50EBA8A6787CB65615380C03FE9DDEC5F0E516B4841352866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36a8e48510b22e7806a8fa86bda582649dfa69a8a16fdeaa04a1a79a11f47170
MD5 3a9a70b61b0bf79c2ca6a96efb17d389
SHA1 207a981d849e4cb46b70b20f72c0940730f922fe
SHA512 73da440b0adfcc70b9d62bdc09402fd94209422d93f1f9bb7d5fda03b23df41f996b6b9795eaa079308cbb7fe48aef183fcacfdf2557e21876c3792e9709e3c1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9a0c5193385ba3095fc40f13267a6062cbb0c47d4d2bc5def15efe118a8a0cb0
MD5 7d35d211b748cb0223f4e7df382003ff
SHA1 86a2d817a08af9dc83557bd7c9d93b400ba88117
SHA512 0a67550a1b6c81f8ec3dc81fdfbd90ca052738c271dc184a523875e441e163ef8902f608f53375366bf54cd50ef987c41470698c6257e343e30c3aef3e29b0c5
TLSH
T146D0121237150238C05031330342B5082450D50B400680445828C96D1B164540912441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 9fc7e7927f4ee86277e422dd482e46d99061d41762567ebe553b79ef347f3b06
MD5 2b73a7699f9ac6e19e0a78365cacdff8
SHA1 6e4fdbff0e4daf2724eeb2421da5705f937afd08
SHA512 91a689afef3067b038aec97f4d9b8d467405f66d8ecbfdcd5f42d78b70767aa06c8db7e2617a09c2194095b2bf21aa88001481e5f9ca0e0b4faade87998230d3
TLSH
T1E621850C06E329D1DF48A67771553F9759615D27BC5003171B54053738F37EAA2F1432
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 968a9c950944fcfa206a73e8cbac827d92fae98bfac3f6d80e8df53f4e6fd7ca
MD5 34053728877539d5f71215977d9491f8
SHA1 f9456d38d5e087af8b9a42f56a77316b8717c3a9
SHA512 e7ee66212e9e8828add622d50b4c80e82cb56726b40d85d4bb0c77dd31f2a8cc24ec5c312b2a2063248c50ea190027cd1ffffcc2c01ed09d9789a37c71fa10af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

e104ad20-a4fb-4d86-b84f-d0af7fbc3dd8.tmp

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\e104ad20-a4fb-4d86-b84f-d0af7fbc3dd8.tmp
Size 601B
SHA256 ce90afae4355f75c67647bba2f03ffa774dccfd26978c057778631f5229ef741
MD5 f4d786fd0519d68002afbaa724554d43
SHA1 33593efd66145ff948f039f6ac362f65bd0723e3
SHA512 8c36747f146eebab9ffb451346cc6cdcb4bbf5025ac785d5fdd8cfbabb52fd49925e926322376ebf5b287618c48e6ce8dbaca3a6b25af1548160647f83da20c6
TLSH
T1EDF0ACB2D6D581BF89561AF80A20781BCB4E080842B83C59C7E9EB974BD2535D51614B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f931746a-f0de-4765-9707-a72550ea2d61.tmp

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\f931746a-f0de-4765-9707-a72550ea2d61.tmp
Size 6KB
SHA256 d32a5929688294a23a43f5e7f41f8a6a9184dfe0cf9574f3a49001fc8f0c0574
MD5 5d26b73390eadec7d8b1c068038c7815
SHA1 bb96b2e8db7bc0f2c4da5e04080c3fc92ba6220a
SHA512 cec7d537e4c280eb32e421dadeeaabcdb8d03afd994f3cbe15b2fd828256fb1502ab23454c4c262984725bd6fe627438e319a983c63ff69513b19d5073113141
SSDEEP 96:stc/dM++dPBs4b9okRo5h16ZPhs7/x+6Mhmuecp/1jl1eje+K+gvyG/28XM1C7K:stQObquo+hsV+FNdRQj+TG6K
TLSH
T148D1B7425E24797B4CC6E519BA39BB47E2FAA03274D11E58E7FC462C14DA6DC2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 1KB
SHA256 4a5ec825ba09308aef2a70c89e494e61ad24719b53bb245b375d0efec860d5ce
MD5 ca4f94c3cc7a821de67d4d6f4fd1c507
SHA1 b2c0c651c96b6a7b95317679a10ce7c57cab82bb
SHA512 3d8f4ef6d97d0a23d1d99557d2a7b561e2966c94d560cdd7f49f7d887fe0c99c882f18a1675d73576f81888b5d0991ab468c368dd2a2b3b9491165801c994609
TLSH
T1A62165B3E8D01F33BCA272492603A6875F31102751501F04A6ED1B2801D35DCA52E837
MD5 SHA1 SHA512 TLSH

Submit Download

bdb56ecf-0190-46b6-b667-9b694c35e999.tmp

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\bdb56ecf-0190-46b6-b667-9b694c35e999.tmp
Size 3KB
SHA256 c34f4276ef4cb4aca84ba01bd9b1632d690870825526d0b9edfb6ae92e5f6ffe
MD5 51cb7e43ecf237c41a4a1dc84125e2e4
SHA1 e9dfcb765cba130bdcec99c9bf03c0ddae203dcc
SHA512 2fa4f8f709047b72eb57699694eec5f955a4af1c255e7a0c46cc5fc6f38f40b67577a9b3a95a9be3277638f59bbbfb26bcbd95e370d0f9ddfceb06e3e1c94a13
TLSH
T12C618437A8A0AA275DF3D604B9472B02A7A15023E5953F95DAEC1F1C00D73DC1356C27
MD5 SHA1 SHA512 TLSH

Submit Download

dca53397-9e74-4c9d-a4d4-c2c8bb41dbda.tmp

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\dca53397-9e74-4c9d-a4d4-c2c8bb41dbda.tmp
Size 2KB
SHA256 491e57189dc6e7bad8ee77f15df77f85903a7c1ed65063898a9440f9b3c81512
MD5 e791ed40f79c3337dea678b54ece084c
SHA1 f2d6c5f78de1fb3c582b99e3d53e8f575e9f9a7e
SHA512 0b73b6e20239519f330a7f62a63ac3b1d059ac20a9bfaad0052c4948afd7d4232521808ebae20143d5edd317eeaa709e14a4af08a945f7df5261fd679dcf0dd1
TLSH
T1FC519433EC506B3799F2960879077B53CB366062AA912F509AED1B1800D769C230AC37
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk

Path C:\Users\Public\Desktop\EZFN Launcher.lnk
Size 1KB
SHA256 f3b419ffad2743ae4d9b3b145338e16f46b936c5423394431e90389715d9ee71
MD5 c5c584c93a005691ec671c65d6be2ac5
SHA1 51ae2e6b93829b2c814a7da937a795cde2f825f3
SHA512 f4ecdfbf291da894716d78d6d08acd638bffa6bf1329a0c7c46c97c24caa7dc8218ef78d022301af19a04404da71e7acfe00e67cd6fef1d7a48aa9c57660b266
TLSH
T1C0115C201FD52B9EE27B8B3558354B104B67BD0A757C4B1D50C6E2435A64104CB39BBD
MD5 SHA1 SHA512 TLSH

Submit Download

e5a3367.msi

Path C:\Windows\Installer\e5a3367.msi
Size 7.4MB
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_1070066160\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2564_923416825\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_364957864\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 80eb0be9f54182ee38e1f8ee4156e9a56870986474d4b837f1190f4bd1ac76cf
MD5 009516e1fdcda36a97b26f9269e0575a
SHA1 dffd63574a4a6e9f5ed0275e4e2b48383a252d17
SHA512 8e2ce212f43ad6910758135f90eb2beea181e2edfa6c67aca3d4b80d4e9917a9ea0b3efde78647b4a3e137c72b84b4f1ceded806ea960072e928fcbc20018ce5
SSDEEP 24576:FFo3DMPqdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeE:qHk
TLSH
T1B457042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c2a59ef3-95c7-41e4-9755-e693c24ad2be}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c2a59ef3-95c7-41e4-9755-e693c24ad2be}_OnDiskSnapshotProp
Size 6KB
SHA256 3c95dbfaf09a7f215c66b239a15131a1956a6c01171075a7cfbfbd74d9d16718
MD5 0913496bc63469d99f3d63539b67b38c
SHA1 3418489a2d620009a16618feef33995314ce806b
SHA512 fc799344e550966416a1892ebe0953fdc78c035b8cfb3c8154ca8a009da6d9bb869dc56e1e95ca1a6a16f7e27bb2fd87d279c455d209710a9fde46e3c8b1d729
SSDEEP 96:FHoFNvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:tEb++uVmN
TLSH
T1F3D198184AF54711E2B3AB3128F58557A837B911EF33CB8E0198638E6630910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-65-0x00007FFB28610000-0x00007FFB28611000-memory.dmp

Download

memory/3748-94-0x00007FFB28610000-0x00007FFB28611000-memory.dmp

Download

memory/4860-41-0x000001B46C880000-0x000001B46D224000-memory.dmp

Download

memory/6780-1001-0x00007FFB298E0000-0x00007FFB298E1000-memory.dmp

Download

memory/6780-1002-0x00007FFB296C0000-0x00007FFB296C1000-memory.dmp

Download