hxxps://cdn[.]discordapp[.]com/attachments/1464641311242981627/1509688470753251348/CloudRedirect[.]exe?ex=6a1a1674&is=6a18c4f4&hm=a3d5d54a4a34cfb020b309c94b2d4c85d49f00585ccbd743a9eb23ffaa4eb526&

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/05/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1464641311242981627/1509688470753251348/CloudRedirect.exe?ex=6a1a1674&is=6a18c4f4&hm=a3d5d54a4a34cfb020b309c94b2d4c85d49f00585ccbd743a9eb23ffaa4eb526&
Sample260529-bdlcdsfv5v

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	5020	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1400	CloudRedirect.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_446850863\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\ranked_dicts	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1559340641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_28773075\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_446850863\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1559340641\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244901423925708"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{E3AEC68C-56C1-4243-A2FA-E45A710EEF87}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2304	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	CloudRedirect.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
2304	vlc.exe
2304	vlc.exe
2304	vlc.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
2304	vlc.exe
2304	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2304	vlc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5364	4832	msedge.exe	81
PID 4832 wrote to memory of 5020	4832	msedge.exe	82
PID 4832 wrote to memory of 3756	4832	msedge.exe	83
PID 4832 wrote to memory of 3756	4832	msedge.exe	83
PID 4832 wrote to memory of 3756	4832	msedge.exe	83
PID 4832 wrote to memory of 1484	4832	msedge.exe	84
PID 4832 wrote to memory of 1484	4832	msedge.exe	84
PID 4832 wrote to memory of 4328	4832	msedge.exe	85
PID 4832 wrote to memory of 4328	4832	msedge.exe	85
PID 4832 wrote to memory of 4328	4832	msedge.exe	85
PID 4832 wrote to memory of 5860	4832	msedge.exe	86
PID 4832 wrote to memory of 5860	4832	msedge.exe	86
PID 4832 wrote to memory of 5860	4832	msedge.exe	86
PID 4832 wrote to memory of 408	4832	msedge.exe	90
PID 4832 wrote to memory of 4760	4832	msedge.exe	91
PID 4832 wrote to memory of 408	4832	msedge.exe	90
PID 4832 wrote to memory of 4760	4832	msedge.exe	91
PID 4832 wrote to memory of 5872	4832	msedge.exe	92
PID 4832 wrote to memory of 5872	4832	msedge.exe	92
PID 4832 wrote to memory of 5868	4832	msedge.exe	93
PID 4832 wrote to memory of 5868	4832	msedge.exe	93
PID 4832 wrote to memory of 5868	4832	msedge.exe	93
PID 4832 wrote to memory of 5756	4832	msedge.exe	95
PID 4832 wrote to memory of 400	4832	msedge.exe	96
PID 4832 wrote to memory of 220	4832	msedge.exe	99
PID 4832 wrote to memory of 220	4832	msedge.exe	99
PID 4832 wrote to memory of 220	4832	msedge.exe	99
PID 4832 wrote to memory of 5024	4832	msedge.exe	108
PID 4832 wrote to memory of 3544	4832	msedge.exe	109
PID 4832 wrote to memory of 1832	4832	msedge.exe	110
PID 4832 wrote to memory of 452	4832	msedge.exe	122
PID 4832 wrote to memory of 452	4832	msedge.exe	122
PID 4832 wrote to memory of 5960	4832	msedge.exe	124
PID 4832 wrote to memory of 5960	4832	msedge.exe	124
PID 4832 wrote to memory of 3652	4832	msedge.exe	125
PID 4832 wrote to memory of 3652	4832	msedge.exe	125
PID 4832 wrote to memory of 4876	4832	msedge.exe	126
PID 4832 wrote to memory of 3556	4832	msedge.exe	127
PID 4832 wrote to memory of 3556	4832	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1464641311242981627/1509688470753251348/CloudRedirect.exe?ex=6a1a1674&is=6a18c4f4&hm=a3d5d54a4a34cfb020b309c94b2d4c85d49f00585ccbd743a9eb23ffaa4eb526&
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffaa020c188,0x7ffaa020c194,0x7ffaa020c1a0
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,11128198168523820722,1249221354254646109,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15233684357611204182,15192867111952733367,262144 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,2795649944991126051,16839047419993596971,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,10980997289081184577,12765809965994767288,2097152 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,182346712826818577,2387721767905619055,2097152 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10052611292329044959,12226834761715065840,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,11746600602295970705,11084229125794783891,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3747671950942748295,16022241830238494548,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5468,i,10557235765950131068,3495978328434966605,2097152 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,15230486712512616167,4293888996410999872,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,15230486712512616167,4293888996410999872,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3350041444641922360,2784190422214334971,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3564,i,1316559200322261457,15667368249329250308,2097152 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1948207199583713796,8588274124129337723,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11390892799217800989,5281427614323680025,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12041050513605872287,5775249532260510596,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3277068116231481319,15720593909526161667,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4439040058444439789,10395821028572370671,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11560022188434990113,7952504534738190753,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=776,i,6775553361985352036,14007293139380914483,262144 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,12019290104716694842,9715881189098835392,524288 --field-trial-handle=2292,i,1368020063477138760,8543272928630431083,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3328

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyResolve.aiff"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2304

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyResolve.aiff"
1⤵
PID:4504

C:\Users\Admin\Downloads\CloudRedirect.exe
"C:\Users\Admin\Downloads\CloudRedirect.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a8da465873a4895e8e3a2bfacccce9f7ada175010b85e062e124ccc7b4c079be
MD5 84d21652a8c127c640f3fe3b734d0eca
SHA1 106e9588c91dd64c23b23ae383242fd92d2e6ebf
SHA512 a43148888d7c0487a5c6a8bdd515c13e0e63bbf797905237e191bd10eef4ac98f7bb07d389e61d8189cd3d934cb17e9b9762b165dc1623da502ae5ef25124160
TLSH
T144F0F9B6C921EC6708FD1B5960A50B06E75013172B50848F7A3D420D4FB5637469686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b1e4490d-4f32-469c-9e90-25815538f8a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1e4490d-4f32-469c-9e90-25815538f8a8.tmp
Size 2KB
SHA256 418eeb290be88948572729c1d0e8331deaadbff5d2c6bd20d3006089fb60c06c
MD5 d535db91214363d383c6cd42c26867b0
SHA1 8f83e4d914342d0006b442a8aa08882f4e3c05b8
SHA512 ed5958a454c230297f42bfdd884acd508cc38c0e403097428df6d1855d58b2f310c7a4476bbc23acb506b0b099ccc2449f4a29d49a08ec30f1bbc81f4796bb2f
TLSH
T1D4517BF782E8866EC90156F4BA187E1BCE2D0954432C3D5A89E4AF5BA3E3471E18194F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 86bba74314a14414d514d15be5935e16f3660277911021a6f7240bdea0aac68e
MD5 d091513d650b549cef9e23b4fe659194
SHA1 f1fe097d75de7ed94e484ce3cafd4ac2eadd7c0e
SHA512 b6fc70667ba5a204077355b3452e5d38366978dc540aaf68488377568bf6d0bc96a89ded07fc968b448b099b7c9e1fb983d765ce62c1f78545a6a30d7a04a326
SSDEEP 192:sxZt2RIyMqZjK1Ml8UQejb/fLsRQgmCZtJDzodpLHW6+WNGYq/yrIg5wCXiJ:sxZt2jqOb/fLsqgmEtJYLHbGGVX+
TLSH
T1B172D716AA344977CCDBD609BA467F93D7F9156392804E44A9FCCB0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 75093369d2eb9aec4a90e7cc66c9f7275a50d129612ef7c87d4693340a9b0f44
MD5 0a28800729c2d66d1a1d67b3203c2987
SHA1 d3d7d65178e7da5916921ab8e4234806c68076b0
SHA512 eb229dcc49e77694c73ddc94258765dc3af31f947472b629b74123bce0037c1e202da2740bb675ccdb2d21c724f9d88c6a10f900620b8196165796a31242ec27
SSDEEP 192:sxZt2RIyMqZjK1Ml8Mjb/fLsRQ7CZtJDzodpLHW6+WNGYq0yrIg5UhJ:sxZt2jbb/fLsq7EtJYLHbGDer
TLSH
T18B62E816AA345977CCDBD609FA467F93D7F9156392804D44AAFC8B0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ec78baa16c77072dade9667bd3de6f193604089c10203987530a95c4cfbd18c6
MD5 efe269a9bb0c0f17e34968e492d31467
SHA1 d4d1e3278a0441d3587a423c43eadef3314fd090
SHA512 f5eee49c9ac3977fd9ba352dff21f19ea46c87781abc4b9f632a2730bb1357b7275d82687e7b5079d456fcd098c32ae1addcb45eb589788187a688eba92e6ed7
SSDEEP 192:sxZt2RIyMqZjK1Ml8M9b/fLsmPQ7CZtJDzodpLHW6+WNGYqwyrIgjhJ:sxZt2j1b/fLsmo7EtJYLHbG/jr
TLSH
T1F262E7166A345977CCDBD609FA467F93D7F91563A2804D48A9FC8B0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 28929e7ebeadee7b58c572f4a5d680951e345722c2f50b19e72aa6277c30cf4e
MD5 7db6256d150c273badcf18b8cf00eda9
SHA1 000aa0d2064511163855886458d842159aa4a324
SHA512 b934f232c8a4ae579d1676667b7969ec9c65eac4a6da2280b11c8398aa83ab8a65a0393ec32650dce9ab88a8e5e9eea14d27b766fe3f120ce0f4c93d4c67f6f0
SSDEEP 768:+IM2tRw7pLuLnF5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSf1sLl2cNV9ro1:+IM2tR8EnF5WvF32/u1jaff1sLUcV2lP
TLSH
T178F20B3B6C0CCB7A4F844E9CDD2A6E8B6DE8028FA6D8895487F9444C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 25553948e6d27e23592b2676e9bc55fa72cdd6d1e605012d7d3b277f94c1aba0
MD5 9197e081a5decd0abd860eae43986bcb
SHA1 f6931f3a4975818c4e104f506a2ffb71753bc1c7
SHA512 dde80856ec7cc7d15db5b6b5c29fc4695379b46856bc3faa1d86ef6d8f85cf7b29dade4136f31233d4a015cbbcd0cc4e88ddf5d217922f5056b6a75794683827
SSDEEP 192:KrFjPXY9/gfrWThFLh/DNTVl3sRI8qu6bW/IEQ1ECTUEviMtPG:K5jfYlgDWNF1/JTzFpG
TLSH
T109B25E17303B12027CBD2808A796D677DD8232B33159E66F7BA804A64E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dd723ef0bd2f6d44b0e55772906f58b7627151af0456fa2c7bad20cc92153eef
MD5 c4dc94ed3e3dd184676028801e968024
SHA1 28dab2de7cb96eb60fb83bd4a1fb7c2170e04a0c
SHA512 4a72f113784e02af58d539c0cda2575b69b772730b58049811c3597a56455ebf3c7f5f0b0ae19920f85703714467c972de2a478ed107d28a488650b8612d0eb0
SSDEEP 384:n6iF9CcmyWCs3sN18TUNTUlImkrn7fWm6miBf+UGo/duAinve4KV8p0/Lpty/7IS:xFccps3OwgkFGofinvI8p0/L0
TLSH
T129B27D36EC69CABBEDE74FC8B34B2A07EEE0116785D899D8DAD85D0D00871DD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 431ea8cfbb25064fc547cf567cd6ebb785650a801b6998736696c0be08740f80
MD5 f6bcce1df3f38a1abe8b195d49eb5920
SHA1 a64e78ef73347a8706608c0bc4be393c52a93965
SHA512 4ffb02d89a5c1a2b935db478895904406359b6b527b1703b6c75fec2107a8bfef7c1c47d462b92156dfbdc5f4b17b92910a1d30e763d87acedc6272081e1d9c3
SSDEEP 384:ndiFNtNnNnb9wsNx8TUNTUlI4Aon7fWQWguiBf+UGo/duAiZI7Vo9dYkPjuhfgtD:UFNjZbeawgbUGofiZI7sYkPMBC
TLSH
T122D24B36E864DABBEEE78FC9A31A7602EFE44157858859C8DAD81E4D00C75DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 888a33ea3fa1ea577e06443dc8a95a44027ae53b5ffa3b322bfbf9cb077ed7bc
MD5 db38417b682d65357654b7edf324b444
SHA1 81c31b64fef58a889c482a4c954b3af1a9520eb6
SHA512 c63201200193710f0056061082e96c7bbbeaf010c0f2c0b7aa904ddbec796f3e63da6882f477fc495ab98e552bb2a2726ce5bb5adf283eeb23b667c6939f88e1
SSDEEP 384:n3iFNtNnNnb9wsNx8TUNTUlI4Aon7fWQWguiBf+UGo/duAiZI7Vo9dYkPjuhfgtD:yFNjZbeawgbUGofiZI7sYkPMBC
TLSH
T162D24B36E864DABBEEE78FC9A31A7602EFE44157858859C8DAD81E0D00C75DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 497b8d51e0c28f52bd45371921a4fe900136e4acf6b73141503744a1a8f7f184
MD5 fd4ca507afe4b04a8fea219ac5cf6bee
SHA1 1955c6540d3ae478c499381f01ce22fa4b54886b
SHA512 ff6e8fc321bf8f450a6a9c9e2e686d3dbe26cfa92a6ac5dc20c22e8d910d805da0a3328df67da0cd5229ed38fdba113e4e1640fbb3961255d1102f0e6d47fe37
SSDEEP 384:ndiF9CcmyWCj3sNx8TUNTUlI4k5n7fW3WguiBf+UGo/duAiZc7xsW8Aty/7Igz:UFccpj3awg5UGofiZc7q73
TLSH
T110B21936E8A9CAB7EDE78F89B74B3603DEE4516785C899D8DAD84E0D00C71DD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7a9e9bbd848883e5fe1f779906ad784b3801f8f9a1432527165381c564722cef
MD5 1d5e36f3cc8d837d2ce2746ca3e6166f
SHA1 3561841c9af380c45f5bb8a2f5da02ef503c4d3d
SHA512 0714bfdab654289524aab029611dc3ef3e04386fac782ed11cfc02d7c4918e5af4851f134ee4dc36cfef6b62b204f8c5712218626a8fff4412b04a94d99bf318
SSDEEP 384:nSiFNtNnNnb9Z1sNx8TUNTUlI4Aon7fWQWguiBf+UGo/duAiZF7Vo9dYkPjuhfg5:ZFNjZblawgbUGofiZF7sYkPMBC
TLSH
T115D24B36EC64DAA7EEE78F89B30A7602EFE4415785C859C8DAD85E4D00C75DD1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 30cfb0e5e09b7ddc11125aef380fd2677a0baa395080688bfbfa443971d53a4c
MD5 deb27b0604e0da138fa68699869ef200
SHA1 14edd6e9fabc2deb7b2d71c6fd2b6790dc573d77
SHA512 e7eb530abd3eeefb1c0041f6438728db4355da265fbf3aeced1d7fdab4509f2fe0e93defa6c7f747bfad1cbc576579ec992bfbf59d78451fd1580e5a580ddb58
SSDEEP 384:ndiF1tNnNnb9OsNx8TUNTUlI4kon7fWaWguiBf+UGo/duAiZP7Vo9dYkPjuhfgtD:UF1jZbwawgRUGofiZP7sYkPMBC
TLSH
T193D24B36E864DABBEEE78F89A30A7602EFE4415785C859C8DAD85E4D00C75DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 56bc8b3073cf24d511be0cb4cf4c1a12d70c81111f78086b03aaf651bdc3a492
MD5 129679e30ba5feee9c787bb83b77fc51
SHA1 8c2fb444a5b6d9d98de2ad783f25fb31eac47301
SHA512 df5c683fcd05df66d1d0326c692661abab6f43c7e8e72ebd3bdaca12ce8dd5df44b31f204be3b2db49e0133e794b262e32aa15b89af62d477713dacaa1820e56
TLSH
T1114182E04C3D2AD0E0BE0ABF749B34FC95D8C32AF5A4307D2C18EA98067961D698403F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1abaa9fe94a8bcf62fbfaf39f41f8632a696dc6f75ee9927cd31707f20fa0e6a
MD5 cf5215d00230d0c63cadb75a7ee617c1
SHA1 c9db762eaba63e782e2d88c6460c6bdc1a77ed68
SHA512 d376d54a4be32a15b59c87d676e27988e6242681bb58bf4a0e4eb74ea19e86120be487d4169f75a2d8aaf67a01ec4dab41dfe18659c2a57ce7794cdbacee477a
TLSH
T1113161E08C3C2AD0D4BE0EBF348B34FC81D8C32AF5A8313D6818EA98063910D658043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7b95c875cee3c1ffe4258e13e09e731de42506d76a66f4cb709cc0e5506039ed
MD5 c0e92a682cb0afc4d2063232598244e3
SHA1 70f81d2a6ba744aee4b36350ceb1a29ab201837e
SHA512 ae8921bba000ae4b31e86eb8a32a26188c36f5126c5e151802848df9a494dcacdcbdd34999cb86207e4abb83752ba2e79cb0e1f4a90928617433b44b4b7f9963
TLSH
T1773141E14C3C26D0E4BE09BF308B34FC95D8C32AF5A8307D2858DAD9467961D698043F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 29d04f12069e941298145e96b783dfeeba5f3168039a7fc8a4b168e06225e965
MD5 764876b355101891b311ff9fa5800452
SHA1 ac4e77335fb84ef06b3b3b6875a1c0c9848261cc
SHA512 ab94ae3a06d6599e0e9f6bc85ae36a886a9f6e2509d4f40651e48bbc102056ad788d29aa4ff0c4d67727ead0a4d12637af65c171a9bbd058109b1a4601aa4ea7
TLSH
T1FD412A5CBAEA0158B3B76F1B5BF6686E447EB9272E07D49D00110E4E0667E40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json.tmp

Path C:\Users\Admin\AppData\Roaming\CloudRedirect\settings.json.tmp
Size 25B
SHA256 79966448ed13f89a0f88ce74dd9be08641d4a6ac91655b5334a20323cd1d6e69
MD5 00dd9171e453c88c3424d4880570c9ed
SHA1 c340921f3288b3761b879e72660ab67587c3b009
SHA512 a40e2a3f88adfb7154f81d8ddee34e9df042340229a4db324cb95c6dd77a0836416bc1abe69525bc9ef9f079d5695a16cee34d48558426230a90574612345a66
MD5 SHA1 SHA512

Submit Download

CloudRedirect.exe.crdownload

Path C:\Users\Admin\Downloads\CloudRedirect.exe.crdownload
Size 9.4MB
SHA256 26ccb360ffb3aca0de3bae38bb17c391e7b7eb3a320f1140492d00635e95e65f
MD5 c77e7b84765a78704ecc8797690598b1
SHA1 1d84de543469fad78409544ea75250cac5f2ebfb
SHA512 8416e8524a3eac151a0dff77efbdb25252f998cf8cc4108c4d8bfa611bb1cb2a021dac09b329511f42063f7186a8444f62f04b60b9055ac79215935e79d949c6
SSDEEP 98304:sLpjBk+KpjwuY/qF0s9xe/+FOvSmaRf+UcDN9NppBLxAHDfyLrZlp:slBk+SgiB9xz8N9NppT
TLSH
T1A0A69F2E17DD0D35C3B7837DCEA0B7225A7928161341AB974F4B9B2D086A2C4CEF525B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2304-307-0x00007FFA73C20000-0x00007FFA73E65000-memory.dmp

Download

memory/2304-301-0x00007FFA8EE40000-0x00007FFA8EE65000-memory.dmp

Download

memory/2304-278-0x00007FFA90430000-0x00007FFA906E6000-memory.dmp

Download

memory/2304-287-0x00007FFA8F4B0000-0x00007FFA8F746000-memory.dmp

Download

memory/2304-295-0x00007FFA8F1B0000-0x00007FFA8F1CA000-memory.dmp

Download

memory/2304-298-0x0000028FDE4C0000-0x0000028FDE6CB000-memory.dmp

Download

memory/2304-279-0x00007FFA910C0000-0x00007FFA910D1000-memory.dmp

Download

memory/2304-280-0x00007FFA8FC60000-0x00007FFA8FC79000-memory.dmp

Download

memory/2304-281-0x00007FFA8FC30000-0x00007FFA8FC52000-memory.dmp

Download

memory/2304-282-0x00007FFA8FC00000-0x00007FFA8FC2B000-memory.dmp

Download

memory/2304-283-0x00007FFA8F870000-0x00007FFA8FC00000-memory.dmp

Download

memory/2304-284-0x00007FFA8F850000-0x00007FFA8F864000-memory.dmp

Download

memory/2304-285-0x00007FFA8F830000-0x00007FFA8F841000-memory.dmp

Download

memory/2304-286-0x00007FFA8F750000-0x00007FFA8F822000-memory.dmp

Download

memory/2304-288-0x00007FFA8F3C0000-0x00007FFA8F4A8000-memory.dmp

Download

memory/2304-289-0x00007FFA8F2D0000-0x00007FFA8F3B3000-memory.dmp

Download

memory/2304-290-0x00007FFA8F280000-0x00007FFA8F2C1000-memory.dmp

Download

memory/2304-291-0x00007FFA8F250000-0x00007FFA8F27F000-memory.dmp

Download

memory/2304-292-0x00007FFA8F230000-0x00007FFA8F248000-memory.dmp

Download

memory/2304-293-0x00007FFA8F200000-0x00007FFA8F226000-memory.dmp

Download

memory/2304-294-0x00007FFA8F1D0000-0x00007FFA8F1FD000-memory.dmp

Download

memory/2304-296-0x00007FFA8F190000-0x00007FFA8F1A1000-memory.dmp

Download

memory/2304-297-0x00007FFA8F170000-0x00007FFA8F181000-memory.dmp

Download

memory/2304-299-0x00007FFA8EEC0000-0x00007FFA8EF58000-memory.dmp

Download

memory/2304-300-0x00007FFA8EE70000-0x00007FFA8EEBF000-memory.dmp

Download

memory/2304-276-0x00007FF6CE4D0000-0x00007FF6CE5C8000-memory.dmp

Download

memory/2304-277-0x00007FFA910E0000-0x00007FFA91114000-memory.dmp

Download

memory/2304-306-0x0000028FDC690000-0x0000028FDC6A7000-memory.dmp

Download

memory/2304-305-0x0000028FDC640000-0x0000028FDC68E000-memory.dmp

Download

memory/2304-304-0x00007FFA8ED50000-0x00007FFA8ED62000-memory.dmp

Download

memory/2304-303-0x00007FFA8ED70000-0x00007FFA8ED8B000-memory.dmp

Download

memory/2304-302-0x00007FFA8ED90000-0x00007FFA8EE3B000-memory.dmp

Download

memory/4504-244-0x00007FFA90430000-0x00007FFA906E6000-memory.dmp

Download

memory/4504-249-0x00007FFA8F870000-0x00007FFA8FC00000-memory.dmp

Download

memory/4504-253-0x00007FFA8F4B0000-0x00007FFA8F746000-memory.dmp

Download

memory/4504-255-0x00007FFA8F2D0000-0x00007FFA8F3B3000-memory.dmp

Download

memory/4504-256-0x00007FFA8F280000-0x00007FFA8F2C1000-memory.dmp

Download

memory/4504-257-0x00007FFA8F250000-0x00007FFA8F27F000-memory.dmp

Download

memory/4504-258-0x00007FFA8F230000-0x00007FFA8F248000-memory.dmp

Download

memory/4504-259-0x00007FFA8F200000-0x00007FFA8F226000-memory.dmp

Download

memory/4504-260-0x00007FFA8F1D0000-0x00007FFA8F1FD000-memory.dmp

Download

memory/4504-264-0x000001E4FE3F0000-0x000001E4FE5FB000-memory.dmp

Download

memory/4504-265-0x00007FFA8EEC0000-0x00007FFA8EF58000-memory.dmp

Download

memory/4504-267-0x00007FFA8EE40000-0x00007FFA8EE65000-memory.dmp

Download

memory/4504-268-0x00007FFA8ED90000-0x00007FFA8EE3B000-memory.dmp

Download

memory/4504-269-0x00007FFA8ED70000-0x00007FFA8ED8B000-memory.dmp

Download

memory/4504-270-0x00007FFA8ED50000-0x00007FFA8ED62000-memory.dmp

Download

memory/4504-271-0x000001E4FE600000-0x000001E4FE64E000-memory.dmp

Download

memory/4504-273-0x00007FFA73C20000-0x00007FFA73E65000-memory.dmp

Download

memory/4504-272-0x000001E4FE650000-0x000001E4FE667000-memory.dmp

Download

memory/4504-266-0x00007FFA8EE70000-0x00007FFA8EEBF000-memory.dmp

Download

memory/4504-261-0x00007FFA8F1B0000-0x00007FFA8F1CA000-memory.dmp

Download

memory/4504-262-0x00007FFA8F190000-0x00007FFA8F1A1000-memory.dmp

Download

memory/4504-263-0x00007FFA8F170000-0x00007FFA8F181000-memory.dmp

Download

memory/4504-254-0x00007FFA8F3C0000-0x00007FFA8F4A8000-memory.dmp

Download

memory/4504-250-0x00007FFA8F850000-0x00007FFA8F864000-memory.dmp

Download

memory/4504-252-0x00007FFA8F750000-0x00007FFA8F822000-memory.dmp

Download

memory/4504-251-0x00007FFA8F830000-0x00007FFA8F841000-memory.dmp

Download

memory/4504-245-0x00007FFA910C0000-0x00007FFA910D1000-memory.dmp

Download

memory/4504-246-0x00007FFA8FC60000-0x00007FFA8FC79000-memory.dmp

Download

memory/4504-247-0x00007FFA8FC30000-0x00007FFA8FC52000-memory.dmp

Download

memory/4504-248-0x00007FFA8FC00000-0x00007FFA8FC2B000-memory.dmp

Download

memory/4504-242-0x00007FF6CE4D0000-0x00007FF6CE5C8000-memory.dmp

Download

memory/4504-243-0x00007FFA910E0000-0x00007FFA91114000-memory.dmp

Download