705d7004b8e684c4688086f79ecc821f8a03719190b5863ed16fc0f4175d7d4a

Analysis

user interaction
yes
max time kernel
95s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260522-pnffsaaz9q
SHA256 705d7004b8e684c4688086f79ecc821f8a03719190b5863ed16fc0f4175d7d4a
MD5 cdc5edbf5c0a8e4db813ffecb8682acb
SHA1 743237e72eb4cf711fbbec88d7c949a6e95bae47
SHA512 7a01a094bd7b6a2ce505992a99af4e453241ba62ca4a5c75be4d0bbd853f0e0322b529fc9b75e3f31dceb31b8a6514ab98489a8d75dd4c1fed6026613c47007b
SSDEEP 3072:5YsgAkHnjzxQ6KSAiTOHL88aW+LN7jxRLlzglKxf2n17:dgAkHnjzxQBSAzr88CN7DBxf2n17
TLSH
T1B9643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
415	raw.githubusercontent.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1561894477\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_686685233\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1561894477\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5152	4496	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nyx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239265201053677"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{FD31F2F7-E27C-4696-BF14-F7AE0A7A92FB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nyx.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	Nyx.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4732	3752	msedge.exe	80
PID 3752 wrote to memory of 2368	3752	msedge.exe	81
PID 3752 wrote to memory of 3636	3752	msedge.exe	84
PID 3752 wrote to memory of 872	3752	msedge.exe	82
PID 3752 wrote to memory of 872	3752	msedge.exe	82
PID 3752 wrote to memory of 872	3752	msedge.exe	82
PID 3752 wrote to memory of 3636	3752	msedge.exe	84
PID 3752 wrote to memory of 1224	3752	msedge.exe	85
PID 3752 wrote to memory of 1244	3752	msedge.exe	86
PID 3752 wrote to memory of 1224	3752	msedge.exe	85
PID 3752 wrote to memory of 1224	3752	msedge.exe	85
PID 3752 wrote to memory of 1244	3752	msedge.exe	86
PID 3752 wrote to memory of 1244	3752	msedge.exe	86
PID 3752 wrote to memory of 1120	3752	msedge.exe	88
PID 3752 wrote to memory of 2096	3752	msedge.exe	89
PID 3752 wrote to memory of 3140	3752	msedge.exe	90
PID 3752 wrote to memory of 1120	3752	msedge.exe	88
PID 3752 wrote to memory of 1120	3752	msedge.exe	88
PID 3752 wrote to memory of 2096	3752	msedge.exe	89
PID 3752 wrote to memory of 2096	3752	msedge.exe	89
PID 3752 wrote to memory of 3140	3752	msedge.exe	90
PID 3752 wrote to memory of 3140	3752	msedge.exe	90
PID 3752 wrote to memory of 2796	3752	msedge.exe	87
PID 3752 wrote to memory of 2796	3752	msedge.exe	87
PID 3752 wrote to memory of 2796	3752	msedge.exe	87
PID 3752 wrote to memory of 3432	3752	msedge.exe	91
PID 3752 wrote to memory of 3432	3752	msedge.exe	91
PID 3752 wrote to memory of 4168	3752	msedge.exe	94
PID 3752 wrote to memory of 4408	3752	msedge.exe	93
PID 3752 wrote to memory of 4168	3752	msedge.exe	94
PID 3752 wrote to memory of 4168	3752	msedge.exe	94
PID 3752 wrote to memory of 4408	3752	msedge.exe	93
PID 3752 wrote to memory of 4408	3752	msedge.exe	93
PID 3752 wrote to memory of 1528	3752	msedge.exe	96
PID 3752 wrote to memory of 1528	3752	msedge.exe	96
PID 3752 wrote to memory of 1528	3752	msedge.exe	96
PID 3752 wrote to memory of 3044	3752	msedge.exe	97
PID 3752 wrote to memory of 3044	3752	msedge.exe	97
PID 3752 wrote to memory of 3044	3752	msedge.exe	97
PID 3752 wrote to memory of 1536	3752	msedge.exe	98
PID 3752 wrote to memory of 2488	3752	msedge.exe	99
PID 3752 wrote to memory of 1536	3752	msedge.exe	98
PID 3752 wrote to memory of 2488	3752	msedge.exe	99
PID 3752 wrote to memory of 4564	3752	msedge.exe	100
PID 3752 wrote to memory of 4564	3752	msedge.exe	100
PID 3752 wrote to memory of 4564	3752	msedge.exe	100
PID 3752 wrote to memory of 4872	3752	msedge.exe	102
PID 3752 wrote to memory of 3028	3752	msedge.exe	103
PID 3028 wrote to memory of 1600	3028	msedge.exe	104
PID 3752 wrote to memory of 3884	3752	msedge.exe	105
PID 3752 wrote to memory of 3884	3752	msedge.exe	105
PID 3752 wrote to memory of 3884	3752	msedge.exe	105
PID 3752 wrote to memory of 3512	3752	msedge.exe	106
PID 3752 wrote to memory of 3512	3752	msedge.exe	106
PID 3752 wrote to memory of 3512	3752	msedge.exe	106
PID 3752 wrote to memory of 5428	3752	msedge.exe	108
PID 3752 wrote to memory of 5428	3752	msedge.exe	108
PID 3752 wrote to memory of 5660	3752	msedge.exe	110
PID 3752 wrote to memory of 5660	3752	msedge.exe	110
PID 3752 wrote to memory of 5804	3752	msedge.exe	112
PID 3752 wrote to memory of 5804	3752	msedge.exe	112
PID 3752 wrote to memory of 5796	3752	msedge.exe	111
PID 3752 wrote to memory of 5796	3752	msedge.exe	111
PID 3752 wrote to memory of 5184	3752	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffdbeddc188,0x7ffdbeddc194,0x7ffdbeddc1a0
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,9118492994557199347,16118420240274590974,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,13353968312916189547,18195496379514870090,262144 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17537244420882416852,709184933487026490,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14843645864876323962,6626695784875883397,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,13315129768687788054,17433166751321878793,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,18402678985208985704,8492333231739914903,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,16137534202026291976,16937706424201944358,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,943530449887839888,13335820473559517442,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,7401501654843956369,6958933993909225113,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11558291525577776488,13331173053645673311,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5548,i,2004067672350234551,8745691731070342791,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3668,i,16109913885099510341,1862653576366886123,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3588,i,1213436814092905770,18345801554776342120,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5344,i,5710264694429125006,18033169705200406087,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15976613286976771290,2084446744326413249,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11574568144631269926,18266004656399598676,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5696,i,2342252516787370358,905908009652182224,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,885247254909142126,13556214488845622495,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,885247254909142126,13556214488845622495,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,13174192960361803032,3415849489766764749,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7348,i,677513222010540937,9093756610256170082,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7472,i,5104768320825575466,2373181575090897387,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,16442494363647890498,18027402539333984219,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,9599139958456500734,1640362960963770291,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,4427288774232675420,7446802704135705424,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,16506843983279257850,5769635941223744773,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16019280384910173005,17017719073953085339,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,4659439518941772211,11155084694659442484,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,4007399927322241107,16749619119840345547,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,9546265803942985160,3834844011589329613,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6260,i,10082504585944178829,7765418409161043633,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6264,i,2556521678294813731,18042994010873058137,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4472,i,16148941282625103477,11757545864244117511,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10169775972480821781,6340679315522046274,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7812,i,6056614239800778498,16469140124135853948,2097152 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,3166401491830564522,3808808515646261015,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,8357523919516017526,15198992547315242607,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7728,i,12681452138544687201,11838698830774099951,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,2129375389864254634,6117037535531219635,524288 --field-trial-handle=2136,i,8822406181608272580,11669407594081958686,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:14
  2⤵
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3968

C:\Users\Admin\Downloads\Nyx.exe
"C:\Users\Admin\Downloads\Nyx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 2792
  2⤵
  - Program crash
  PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4496 -ip 4496
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b9b2e787bff8ef07aaf8dc41b35307c7c27a735e7d7ceb08a7a415a3e0bf278d
MD5 6b1b71135b132fc9820aba7909379913
SHA1 203a3bbcdcbfad5b9fcc3b862338d849bc46335c
SHA512 ee8ea33ab55fc59728e89ee58318e93e1e10697a037488e782e474fdd2fcdbd8c32e1d9bb596e518f23ae71ef00bc569552d7a2f5359f8d6ad520cdac9122bde
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T170B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e87fe39054f537b5ce78348b4babde4d8c6397e0a36bd784c3a5b1bfa707f57
MD5 d65e2740ecaeb2e49851afa1492be262
SHA1 ece0a1978076fcb2a08790d204ac2e6948f243a8
SHA512 8cb6a8aaa2df176a73b3bf83f1ab62dfcdf4f9e1790cbce37f766ec3124d1e3e5c4cc05ff4a54e42475e98769ed2777d4ac046e8c6ca47b045fb7c8bb8405335
TLSH
T18CD0A7237A6CA890E2BA4132C122C70057A911E655675A45F254C82D897A0D06AC96C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cc98afb0afceb278504e0db65df38fff84519a2b0a945365a43d254fa573480a
MD5 4b9b296d00b75614f2aa7e42f8cb8bb3
SHA1 6701cd70a4b380c511736135a9b77720e4a51f31
SHA512 130aac3ba5d5167ecac43f6fa9ebfddff053022874de24046a47b31b1a878c6556a295573bc3bd04cb59062787ef8ff88a586f528f11eb6ebbf083a44c35c47f
SSDEEP 96:4NHLFp4bWzokRxsMv5V21OtLAYbrFvuUHm:4VwbWskRxsMvb2cFbtTHm
TLSH
T18D816C3F02A24401E3D84670E4F66916373D41D68B631E094268D63FBA2EBDBD837C4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2eba1993196a6e7b3b03fbfa5142ea1877b0381919c230eeb2c3afa890f0f427
MD5 faf6e92752651b2267ec7c969246245c
SHA1 50c138165243d1a97acaeda9478fdc55deacaedc
SHA512 38d10484682c077a15dcee2224cd2c3f26fc8124eb10a161b42faebfa8e923c8b1ef8e7846712893751db3aa010e7a6cb694d047dc46cb087386106c3c0a89af
SSDEEP 96:naN4HRFrH4bcoan6a6z58RfsMvUKVBVCItLmbrVvukUHz:naNKzYbcoU6a6d8RfsMvUSBPmblkHz
TLSH
T17AA15E3F42A25921E3DE0234D4F61816333C64E59B5B1E09421EC63FB92EBD79837C09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58996c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58996c.TMP
Size 3KB
SHA256 bb8fa76f73f53d52a0a6945fd1a83695e86e24a31f0fa376e676247b6a27fb4d
MD5 0ab6ea1cba66cdb705090afd868a78e9
SHA1 c6e53314beae898350b0f9a219437038c686e23d
SHA512 c8e1ef8e5c63bffb7317b5afbd0234d579f6240019174b586d8e28b5657c984875a4e991b660baa35ec69e3595b7b0bfa06bcf5ba50d21d4efc68f1773e94cd0
TLSH
T11271B43F02428802F3A047B0E4D26118377E50D58B632E591668DA7F7A2EBE79923C4D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 ab704236bddab5dc1924f9323efff7e1fb60a1e2203cd1bdfd0779f58e5844bc
MD5 0df4b6206c1bd0200e1492979f2ee9aa
SHA1 44a96d5f56f120c4d82d4880e9f2fc2fd65483f1
SHA512 e1479c5e2e2227babfee5c29d547e0b94f28d7618ddee041e96e6507007984fe15172b2fe9fc387ba88b483ff762edbf5f28d024025754962b145251dc3e30b5
SSDEEP 384:DB3GNRzVeMFnw2WAxasPm+LOBfLQfxcLASgPvaerBR1XZmZYZKQvhZLbn7KT5zLa:oEKTf7oe1yiYDBC
TLSH
T1B8A2EFF7C2E9866EC81117F4AB146E1BCE1D0659832C3C1589E5EF4BE3E2072E19964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7812c8c09ad48a79cfa797552df3b87a99e89f2bd577770f7a2ce46390ab76ea
MD5 489d3abe6d12a4fcaca09a49be0c16e9
SHA1 583e484e2e529720c9d733f007d3ed10074ba8d8
SHA512 b017888f8c0a2f739e7bf1eaf3bd4ed253d0d5192d946de71858461f70de0126f05dc5c8fca1056177db7a1656eade7eb15b5d74b85c6370032af957a436a53b
SSDEEP 192:zZKRwyM/jK1Ml8Mpp/fasEeNuSEdpyCmfyp/W6+WNss5g6/X8PxDtEQsVIvsBzSZ:zZK6xp/fasZNulh/bY6v8GVAwO
TLSH
T1B262B753A638197B8CDBD21AF551FB17D2F5147392940E84AAFCCA1C00E6AED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 02b36db4c0dd560ad53ed31e6bd223ffb08b4c34e94347897029672abfe596c1
MD5 fba940d9a4caf43518f8e911bc9f442f
SHA1 ae1b8d0effed8a181ada2fd7449c66acab36299e
SHA512 0999079200f1246fc0de4c4150605cadb976bc849829384abac7fc2f2b0cc88c74063b3573bc5d96f859b57a1a9797b4a9b2a212e684f304d505176e4c435c1b
SSDEEP 192:sxZKRwyM/jK1Ml8Mpp/fas4eNuSIdpyCmfyp/W6+WNss5gCcC//X8PxDtEQsVIvy:sxZKyxp/fas9Nubh/bY0/v8GVAK5
TLSH
T13F62C753B63849BB8CDBD21AF550FB27D6F5147392940E84AAFCCA1C00D6EED6206C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e92f43a9ec8e4896f4369a49e296edba38d5648735900fd95d7c7397386d72f1
MD5 7d5a33674cb27db6de38bde7308b86aa
SHA1 19f5b95fcbc0cd2e8f494fa7508589082988eaea
SHA512 152451f74eda519693b24ffd6658a097f8167e96a9a0b17c99ed71bf8e96939c9af8ae9174beacb74bcc79d4f025037198918b162012c2f0952cb0ca34d10da8
SSDEEP 192:sxZKRwyM/jK1Ml8MYp/fas4eNSLIdpyCmsyp/W6+WNss5gCYuJ/1PWfDtEQsVIvG:sxZKyAp/fas9NSUS/bYQJ9XV1rb
TLSH
T1A872C853B638497B8CDBD21AF551FB27D6F5157392900E84AAFCCA1C00E6EED6206C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b9f3669759a591a56c41db59041bfb707c74577ce4f0d2b4212960797e1b4503
MD5 f0666253fbfad003cbc375d483828d7d
SHA1 0f9056fd66eee694685d301c8512fd73a51cd16e
SHA512 d96a7723b00a4e7baf8c911a2287669338052de545ed6d020d565191c47d184383bf9b8fd91e214e067203bbc24cf54c87204ef62b657a4a40f1fc76004f16b7
SSDEEP 768:n0l1j83r2YmWRmeKQDC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3iALl/C80/g8roc+:n0l1j83r2YmWRmeKQDCu1jaKiALpCN/E
TLSH
T1E5E22B3B640CC77E4F844E9DEC26AF966ED801CBAB684D5447EA494C03C73EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c667437c640326e8455587fe4a870331fea2c52188b7ab52313f2634ba540529
MD5 e2e9ac4afb0ad75bb775d2042e617c29
SHA1 11018e34da403868471f75d0ff531c7c216643b2
SHA512 90f87307147e14724983b6d0504f8eee5f3b50616257a19993cfbd6e7e53f4855fe3a6ef038d090829806e8d1e61a39cefc1feffe03b78f71f3a7ec75fc350ec
SSDEEP 48:KkUIHKtecXypIILKBak3yFdIVKeIoHypMIzK1yca:KkUgKtemqIAKBaGudSKeIqKMwK1y9
TLSH
T123C1F40671BF62463C3D7508B2618B6B4B4272A33069A5EB7F9840B60E67F244DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fc1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fc1e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c78b343e4c518e75c7066f40f47ef5d0f4936f5f799ae4e3de651f5e22f564aa
MD5 4781f60c328cd97a55de2f69ede34335
SHA1 3c395e3add4c3e416b9c88cd11313c664e7f12c9
SHA512 25fb88f3f54300b96e6f578c8e423e8845f28fa3c614f1e25c9148d8444f3474dff74b3a17db95e4a7e284b3db7de8b52b53e0c6ceb458db5c84669ef263506e
SSDEEP 384:nNtNnNnb9j8NATqR3jnXgX532V8m/fX58S+2IM4hg2GlP7VtHFN:NjZbliZDg+5flIM42lPJtHFN
TLSH
T1B4927D35A938AC678EF3AD46B11B76132FB451B799C42E80DEED5B1D008B69C130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a88b8c1fd677864fd7233a4c7d1221c1ca95933f9049f8355ef2554afd0e10d5
MD5 b5a672a18bd4b17ed969fd92c31395c0
SHA1 c5dcde0151444b44d12dc368a4d21b4f0746fcbf
SHA512 d919aa74af5df81a7d6f5dd70e2a29804068fc41e5a595b72dec174d659412a97205805ba6782e8041eb20abdbb4b64ddfb79b2fbfc52e5b1b6f942d89558cbf
SSDEEP 192:6GNL6i5fQmiUyGdYO7X5zPr25jzorm/Qaj1tBU6:6GNL62hB2O7X532V8m/1vBU6
TLSH
T16302D935A9746C7B8FE3AD45B58677235FE4102BEA996F40DAEC1B1C00C7A9C1306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9477f3eb951eef30617550c1821d4fabf280b3efa738c34b1685d219ce25023f
MD5 096dbe05264431b22dbd3b703e1b5563
SHA1 40a554de39bd840df76bb4a65097ba35d0e2b0f9
SHA512 8af8afe326a781b4d1cfa39cb75048d99148ac2ad5991adce212e3d252c7b0b198f5b92ba90de5e86db8dae59ebfe5976f0a698bc521b688c5a69076bb834d0b
SSDEEP 384:nwiFktNnNnb9/8NA8TUNTUlIl4qRKbXdDf4QX532V8m/fX58S+20aM4hg2GlP7VV:LFkjZbtVwgvaSg+5fl1M42lPJtHFN
TLSH
T17FC21935E964DA6BAEF39BC2B216B652AFF011A785C85DC0DEDD5E4C00876DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50277f55e149914cc9525d87e3c229f5b7ed123f82fbd0d196dccf449afdb1b1
MD5 6de7ea5e8a0492b54515150388ee5251
SHA1 aafe15dbbe50266c4a22ce11a304fb1a5429f9a4
SHA512 c6e35de1fb70484864b61e324714909c608c11eef71ede6467a3c6b70020b9a8bc69cc586b90359f2448e2ada14e10de150c4bd891e48ce9ea6e1df8159d8349
SSDEEP 192:6GNB6i5bQmiUycYr7X5zPr25jzorm/fX55+S+2YGQ1r/C4U6:6GNB62Nir7X532V8m/fX58S+2KM4U6
TLSH
T1BF12FB35B8787C679EE3ED56B08776135FE5106BDA896F80DAEC1B1C0087A9C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d771ec37cec1b52c172e5e151d0b617cd44bcdf2c1497f7e1d849a7e8871aa28
MD5 d0107d4a6276b830548b796d65a01de6
SHA1 a2f66e3b7565a332b2195df2f636577f1b95671e
SHA512 d8ed30dd8ad0a3b7365d1cb978b9375492caa1fc17cc141b599eb4e56d9fe3e1b778a3039605bfb5482528d4bdef2a51569aca36c6c7a926ceae5e87652c3761
SSDEEP 384:nw8NATqR3jnXgX532V8m/fX58S+2IM4nH:wiZDg+5flIM4H
TLSH
T170421A35A878AC778AF3EA46F15A76135FF4107B96C81E80DAED5B0D048B69C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 44d4148ffa090f259499f98835dccd8abf8d2ae2325b8ef8af35116211e8d9f3
MD5 f88685ecddf739bd8d099335a3cd602c
SHA1 11025cdb5102970eee6ae38170b99a69792cd95a
SHA512 905816a82aa453825ef83c3ab96ccb4bbd91526516ae5500c3010c8f275fa8ee88c3a97c01bdb61045801eb8e97f920be25a0ba9342d01956bf0d656f495a03c
SSDEEP 384:ngtNnNnb9j8NAUqRqbXgX532V8m/fX58S+2/GM4hg2GlP7VtHFN:gjZbl9ig+5fleM42lPJtHFN
TLSH
T10B927D31A938AC678AE3AD46B11B72136FB451B795C82E80DEEC5B1D008B69C130BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

08f86e24-cadf-46b2-bd57-a5a5699b14db.tmp

Path C:\Users\Admin\AppData\Local\Temp\08f86e24-cadf-46b2-bd57-a5a5699b14db.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77f3090c-0a3c-481c-8f93-076949855440.tmp

Path C:\Users\Admin\AppData\Local\Temp\77f3090c-0a3c-481c-8f93-076949855440.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3752_1281743905\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1afcdd9b-95a4-42a5-ac9a-4d6304a202b0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3752_299849965\1afcdd9b-95a4-42a5-ac9a-4d6304a202b0.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nyx.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Nyx.zip:Zone.Identifier
Size 309B
SHA256 d6f611671057debf3b1a005f061cbf01aec806797aa6f3663df85e054d2edebc
MD5 6048f753290a9bb46235b1c848244acb
SHA1 9091a00cf69b6d76ffcc9f760a3ce6bee19a5f57
SHA512 50207a45005c52e7b5000d6cd8e85e42e01a2051899dd4aaf44f3aba96ac330dd5ed1583de1924e9f51b5bfcb38ab9152e1a6be57218bbc342bc41278027805c
TLSH
T160E07D53A850C0048E65159977BF5B5D679A6DE05960D1A8EC01845BF80C3E9C1C1C23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_1561894477\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_686685233\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/4496-848-0x000000000E780000-0x000000000E7B8000-memory.dmp

Download

memory/4496-849-0x000000000E1C0000-0x000000000E1CE000-memory.dmp

Download

memory/4496-847-0x000000000DE70000-0x000000000DE78000-memory.dmp

Download

memory/4496-846-0x0000000009060000-0x0000000009606000-memory.dmp

Download

memory/4496-845-0x0000000008060000-0x00000000087C4000-memory.dmp

Download

memory/4496-839-0x00000000009F0000-0x0000000000EC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads