redline | hxxps://flipn[.]app/Set-up_Pass%F0%9D%97%AA%F0%9D%97%BC%F0%9D%97%BFd-%F0%9D%9F%8F%F0%9D%9F%95%F0%9D%9F%97%F0%9D%9F%90[.]zip

Analysis

max time kernel
118s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2025, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://flipn.app/Set-up_Pass%F0%9D%97%AA%F0%9D%97%BC%F0%9D%97%BFd-%F0%9D%9F%8F%F0%9D%9F%95%F0%9D%9F%97%F0%9D%9F%90.zip
Sample251114-elk85seq3w

Score

10^/10

main discovery redline infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

main

46.224.4.226:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2256-1261-0x0000000000E70000-0x0000000000EC2000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 1 IoCs

pid	Process
2984	Set-up.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 2256	2984	Set-up.exe	138

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134075665132710249"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1466988471-277302908-4206077581-1000\{2AD9C534-4CF0-4A3C-9BB9-3785BE5E0173}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1466988471-277302908-4206077581-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe
2256	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1828	7zG.exe
Token: 35	1828	7zG.exe
Token: SeSecurityPrivilege	1828	7zG.exe
Token: SeSecurityPrivilege	1828	7zG.exe
Token: SeDebugPrivilege	2256	AppLaunch.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
1828	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2104	4748	msedge.exe	83
PID 4748 wrote to memory of 2104	4748	msedge.exe	83
PID 4748 wrote to memory of 2900	4748	msedge.exe	86
PID 4748 wrote to memory of 2900	4748	msedge.exe	86
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 3176	4748	msedge.exe	87
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88
PID 4748 wrote to memory of 2080	4748	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://flipn.app/Set-up_Pass%F0%9D%97%AA%F0%9D%97%BC%F0%9D%97%BFd-%F0%9D%9F%8F%F0%9D%9F%95%F0%9D%9F%97%F0%9D%9F%90.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffdbc63f208,0x7ffdbc63f214,0x7ffdbc63f220
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3500,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4232,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4280,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5304,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5108,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5752,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3432,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3564,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3564,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6828,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6968,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7132,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7092,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7024,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7140,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4296,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,4291567542619690068,9846350611986551605,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5928

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Set-up_Pass𝗪𝗼𝗿d-𝟏𝟕𝟗𝟐\" -spe -an -ai#7zMap8073:116:7zEvent24319
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1828

C:\Users\Admin\Downloads\Set-up_Pass𝗪𝗼𝗿d-𝟏𝟕𝟗𝟐\Set-up.exe
"C:\Users\Admin\Downloads\Set-up_Pass𝗪𝗼𝗿d-𝟏𝟕𝟗𝟐\Set-up.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5784c6833749b9ac3dd753596be4db5d8f1ab56d3fdb201bba85600619a0c6d6
MD5 3fa1d86f00548427b5dbe798ae69af49
SHA1 3370b12d545ab8dc9f49d7b0637f55fe5f39937b
SHA512 be3eea2b258ff7ed0d58f318f5ff398ed6f8b13501a1665ad0335b2839c2a98ea9eb41baf2ed374ddd7db48cd2e577dcf66afb21befaecee1371bc0750b6409f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 77b9845b49cf404747b0609e86d9fc6367f13588d229a455bee79edec14f3f01
MD5 6872ab63ba8d4de5a28987bd95669b9d
SHA1 715289699a84c31d15d7eefccb87082da8daf1d1
SHA512 758c4cb173f2494e04473ca907831a2c63a833adda2dd1692c418acbd3b1c54be6e539428af7da0f86ab7eedca142be248f87db39e816b416fafe2cab004cb89
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7f6b3c7c19db12a6804b4c11870ad94ffe743d3250f282b71307ee0e56cee84
MD5 f367d2098edfcc220315ea4057923835
SHA1 b25ee1d56aeea44da5d2af45ce5cb6908280b229
SHA512 6df1db83f1e3b33598cd5a0b29a9ee2294479096946d6123d071e135877541e02dbdc82822a1f9deb2d8698d53f58612a87cca19522d4678a4d705ce4662b39c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 90100a0dc0968e1b33a748692511c1a63fdc6f4cd99ae09963930acb29296548
MD5 d5cf8fa48e15568760c012f97c94a89f
SHA1 c2f7b06764ca87ad481575552b6cf911a0443dc2
SHA512 ab9cc35a19636a300d70852d83baf8ef5c6c6d0cdccfadf033461f87f0f82c46bca26b5ab931e57186703acd432e7eba0377bc60182e04fdaf5033e21db9807d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d4a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d4a5.TMP
Size 3KB
SHA256 8824653e696a77c08062857a43b91dbd3074a08813f2a8ebf9e62aef8c8bff51
MD5 61622b16ce9dfa5b3c532eb560465ff3
SHA1 3a632f85e6a41ae7f2f64eca9d27693213ea796b
SHA512 251c699fa09c0b7e87db639b35f5d7e2d870b8fadc703bea4a059f60e67a2ff5ae4d00230ea04c3092036b3f05d354ec9ee1c2ca28402e0bbb41f7be8dc3ec30
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 1ac562b695b3f5cf5c5501c5871cfd8d105f10c889ae0cb3cb9a2d0469925f15
MD5 bb210fcf1bd88fc0664189a3c3d290c3
SHA1 2b55ab5dca2c8b21c0e34dbf5ccecfd61a17839b
SHA512 7feff83201e13a165d3e260d24c4e2cb0bd083cda997e2de4761f4d2fb7e70e735e7ae89782c498e180598260d8c64160e0b1b35ae2bf312386afd062b9d94de
SSDEEP 48:T9LopFMatSaw/auUOt8BH3L71Lwnxrd8CZwB+cmWOyLD1m/:NeMatUaAKbxaxrqCiBvSO1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e7bd4dd1c615b7c0a9743f556818689bb389e4ed395765d4b68481bb3ecda77
MD5 57190a88b24b95a2c9c07574fa978b74
SHA1 ffa15ec886fa2609f7c3c69ae70a969375717c9e
SHA512 84e95988d8ca2e1201dae4b694c5e1a7756cd505df7ae1ab07dc7e106ca11e1d49618158a3610f38c2f9ac4c575cadd9f2723030c0d7e4f79e4b7c3179d396bd
SSDEEP 192:sVZRnyMh/K1Ml8Mu8sffvgJSHf0YckfVPIZ8pxTSHY+WN4ezwzb3DTTGyJNcIgdJ:sVZvm8sHvgs0YckfVf4HShwvCuAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 eb3acf23ac03f358bb326e19cbbc08a6d471e0d1503bf2ab595ce3140ac20503
MD5 34cfe96d618e8cd05b5c7157d0f1b262
SHA1 189cc34fc8628bc7e0b0c3c8b1bed18fb82017ce
SHA512 2472144d849308e305683ca4f3dfd2d258a1c7d736cba634f4ffef62344a7ab253b7b744a42c36dcd3c726e7f8d2bba5230d84fd92e5f9292fbbc49db88607bd
SSDEEP 768:P7lG4KJ7pLuLbDJWF1nRP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVR098LluM9mUroP:P7lG4KfEbDJWF1nRPu1jaq098L0sm/qq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 99ada27b90f9cf4dd45f81f027fa5aea1d8bdd563151684aa0872c5bd097688d
MD5 05790733dccd487750c619539da18b19
SHA1 919363ef8c68fc791ca6ba34fcf74416e89a829c
SHA512 f792eabf7c8994d97fbe8c03c863197bdbcfaed8e81b22b7ad76a6b38e79b47e101879afeffda0f3721719c72b7925b738ce044cfdc725561f7410b07eb4d672
SSDEEP 48:e3Kugy18KDVyNiKdklK82yxbKeWmjEQmq:e3KXW8KhOiKilK7SbKg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 7df0527c2f05431dd70fc81b9b12eab11d13b797d69623f406e56df721557073
MD5 cbe9623a36e0bd9d838e85da1f9cc654
SHA1 a8831e3a4b3d46ab19a3e4af36fecfdb1f929d3b
SHA512 53a3b109e4180f62e0aa87065e533d6e3cee93be325cc33714f2a84004e8dd715671941bf5f8e60e5b41e4bd3f1f500c5ff54d9cb2633a0ac3a949852046424d
SSDEEP 192:51moNnfT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:b7dfQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 a3c582263e0cc1c90a80f75d38cc9bb74ccf7170af34ebf860ebb8e76372316e
MD5 2dc238a4603f08a8f4bf9c17267b2084
SHA1 a68b50488660e0267e4a3b9574b62e77d89918b4
SHA512 0bf7652acaefaba411324d362df8788185e60341c00495892029c609a6e46b590e96a11247979a3f0e5d9a15bd3c766358b08859264f6d4d1988bbfda746d17e
SSDEEP 192:BONbyYnHaWiRUyUENh27FkmJgMFVG4wY4tgwaUz:BONby0GZNhSkmJgMFVGDJ7aUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d8b8741bc0afd69386d5f1a76ce402c967bf2c0b06b52a6ff1c284b146bb8c53
MD5 948abdacbb10ba2ea9e3a76183fb4fdd
SHA1 6ad856edb71ac9b815ad889c1b5fc69c5ffcbbdc
SHA512 c2bc09224c4bca6ac31c17b0bd75f3c975ec132486a4e62faff81e8a6ba5e22eba157e731b813013fa2bb6d7037953c71675d6c9f62f335b4316d0fc432e7f7e
SSDEEP 768:IYfJSJLdOuDwLAKYcSrJg+gYJ6ZbfPB4c5F:IYfEhOuu/SFTrMB4gF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c248e7897e501bd396ad407de54041853f5460deea419f9b6559751b9444050f
MD5 a09d6b6855ce4979ba4e528477838dae
SHA1 4ec5d379a0bef6317f1ae700190b32e7d22bad86
SHA512 a95ad1fee53efda3d69d417cee09ecb9b016b3941f9ae98d81395dd4fed42592c0963baf44c32df63013793d37dc40cbd855dabb2810f401a9d16486d885a406
SSDEEP 192:BONbyYnHHWiRUykEVh27FkmJgMFVGYJvCZbnMYrtsmtUz:BONby0zlVhSkmJgMFVGYJ6ZbMaPUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9edafa6fc95dc372784dd501c8ff4e46003265e753503a3a7683eb227370fdc1
MD5 59c96bfdfd665094cc2abf63f67e5a0b
SHA1 a82162927efcf632121adbbf0227deb250e83e48
SHA512 9c296d961b8de941dc7e97b8284ed326d06c778afb23b74d5a6ab8fccac4404e5083607e5157cf320c94d9401fbc1586c2d0621ec3087e9f76f5278c01598ad7
SSDEEP 768:SYfJSJLdOuDwLA9PcSrJg+gYJ6ZbfPB4c5F:SYfEhOupESFTrMB4gF
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 afdaba9436631355abb591073f92096ef39c1599f3ab302b792c32b8d1d645bd
MD5 0bfd8362ca3fd663c5e3d6c82c247aca
SHA1 295864278e8ecfbb709ce4e916ec5708c81e271d
SHA512 37ca5c1e67611f4c625f418188430007e4f481bf01afbc1a98d3e6faf51d7bd96630c0a48e76cec97a36082ff5365cac7a7102b7f7098dc71966da32085ec941
MD5 SHA1 SHA512

Submit Download

010a7ec3-0cce-4110-b042-44aed160688f.tmp

Path C:\Users\Admin\AppData\Local\Temp\010a7ec3-0cce-4110-b042-44aed160688f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

38b1f5b8-10f4-4eda-886b-0d23742bb552.tmp

Path C:\Users\Admin\AppData\Local\Temp\38b1f5b8-10f4-4eda-886b-0d23742bb552.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

7ec8acc3-01eb-4068-b783-a8ec5703f058.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4748_1303612886\7ec8acc3-01eb-4068-b783-a8ec5703f058.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Set-up.exe

Path C:\Users\Admin\Downloads\Set-up_Pass𝗪𝗼𝗿d-𝟏𝟕𝟗𝟐\Set-up.exe
Size 2.5MB
SHA256 095fc129e02853ccd1507a37f48d431c0b5cc800a0a0c0fb8e93be928192e15d
MD5 f8195cf4deb50e6cef668686c4ca73ad
SHA1 92bb325a0981e2d72f522fd0335e8c56c2e5a77a
SHA512 7c40a1bbf8df7e1f5892c0d83e67440e3c06e571b3b2c42c94da684baeb17a3562f3c44fd9a6915dbe9acc32b6a386d0cfdc90ae2b329d8f54199c47772c6972
SSDEEP 49152:F7eiYmuSjQ9iCc1kEqE5oQ2rSC0QCyN32V8CG5bVRwVh:FZQ9zlVAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2256-1263-0x0000000005620000-0x00000000056B2000-memory.dmp

Download

memory/2256-1264-0x00000000057F0000-0x00000000057FA000-memory.dmp

Download

memory/2256-1265-0x0000000006C30000-0x0000000007248000-memory.dmp

Download

memory/2256-1266-0x00000000085C0000-0x00000000086CA000-memory.dmp

Download

memory/2256-1267-0x0000000006C00000-0x0000000006C12000-memory.dmp

Download

memory/2256-1268-0x00000000084F0000-0x000000000852C000-memory.dmp

Download

memory/2256-1269-0x0000000008530000-0x000000000857C000-memory.dmp

Download

memory/2256-1270-0x0000000006680000-0x00000000066E6000-memory.dmp

Download

memory/2256-1271-0x00000000093D0000-0x0000000009592000-memory.dmp

Download

memory/2256-1272-0x0000000009AD0000-0x0000000009FFC000-memory.dmp

Download

memory/2256-1273-0x0000000009320000-0x0000000009370000-memory.dmp

Download

memory/2256-1262-0x0000000005BD0000-0x0000000006174000-memory.dmp

Download

memory/2256-1261-0x0000000000E70000-0x0000000000EC2000-memory.dmp

Download