hxxps://www[.]chiark[.]greenend[.]org[.]uk/~sgtatham/putty/latest[.]html

Resubmissions

11/06/2026, 06:13

260611-gytgdshz6t7

11/06/2026, 06:04

08/06/2026, 20:36

08/06/2026, 18:52

08/06/2026, 18:30

08/06/2026, 18:05

08/06/2026, 17:54

08/06/2026, 17:44

Analysis

user interaction
yes
max time kernel
521s
max time network
516s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/06/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
Sample260608-xjaczad15s

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5240	putty.exe
4692	putty.exe
1356	putty.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254183574675481"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7F0972D3-8099-426D-B65F-E04BDDC1F954}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5240	putty.exe
4692	putty.exe
1356	putty.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1260	4612	msedge.exe	87
PID 4612 wrote to memory of 1032	4612	msedge.exe	89
PID 4612 wrote to memory of 1072	4612	msedge.exe	90
PID 4612 wrote to memory of 1072	4612	msedge.exe	90
PID 4612 wrote to memory of 2420	4612	msedge.exe	91
PID 4612 wrote to memory of 2420	4612	msedge.exe	91
PID 4612 wrote to memory of 2420	4612	msedge.exe	91
PID 4612 wrote to memory of 828	4612	msedge.exe	93
PID 4612 wrote to memory of 2752	4612	msedge.exe	94
PID 4612 wrote to memory of 828	4612	msedge.exe	93
PID 4612 wrote to memory of 828	4612	msedge.exe	93
PID 4612 wrote to memory of 2752	4612	msedge.exe	94
PID 4612 wrote to memory of 2752	4612	msedge.exe	94
PID 4612 wrote to memory of 3960	4612	msedge.exe	95
PID 4612 wrote to memory of 3960	4612	msedge.exe	95
PID 4612 wrote to memory of 3960	4612	msedge.exe	95
PID 4612 wrote to memory of 880	4612	msedge.exe	96
PID 4612 wrote to memory of 880	4612	msedge.exe	96
PID 4612 wrote to memory of 880	4612	msedge.exe	96
PID 4612 wrote to memory of 4660	4612	msedge.exe	99
PID 4612 wrote to memory of 4660	4612	msedge.exe	99
PID 4612 wrote to memory of 3528	4612	msedge.exe	101
PID 4612 wrote to memory of 3528	4612	msedge.exe	101
PID 4612 wrote to memory of 2700	4612	msedge.exe	103
PID 4612 wrote to memory of 2700	4612	msedge.exe	103
PID 4612 wrote to memory of 1104	4612	msedge.exe	104
PID 4612 wrote to memory of 1104	4612	msedge.exe	104
PID 4612 wrote to memory of 2464	4612	msedge.exe	106
PID 4612 wrote to memory of 740	4612	msedge.exe	107
PID 4612 wrote to memory of 740	4612	msedge.exe	107
PID 4612 wrote to memory of 2944	4612	msedge.exe	108
PID 4612 wrote to memory of 2944	4612	msedge.exe	108
PID 4612 wrote to memory of 2472	4612	msedge.exe	109
PID 4612 wrote to memory of 2472	4612	msedge.exe	109
PID 4612 wrote to memory of 2544	4612	msedge.exe	110
PID 4612 wrote to memory of 2544	4612	msedge.exe	110
PID 4612 wrote to memory of 4264	4612	msedge.exe	112
PID 4612 wrote to memory of 4264	4612	msedge.exe	112
PID 4612 wrote to memory of 4264	4612	msedge.exe	112
PID 4612 wrote to memory of 1872	4612	msedge.exe	113
PID 4612 wrote to memory of 1872	4612	msedge.exe	113
PID 4612 wrote to memory of 1772	4612	msedge.exe	114
PID 4612 wrote to memory of 700	4612	msedge.exe	115
PID 4612 wrote to memory of 1772	4612	msedge.exe	114
PID 4612 wrote to memory of 700	4612	msedge.exe	115
PID 4612 wrote to memory of 700	4612	msedge.exe	115
PID 4612 wrote to memory of 4180	4612	msedge.exe	116
PID 4612 wrote to memory of 5240	4612	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe6ef2c188,0x7ffe6ef2c194,0x7ffe6ef2c1a0
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,393181122737031366,1023998066652270235,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,10581948762131098595,7423002458922816397,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10100651465126051584,16801467108465622779,262144 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,7299365940821446750,7669749700648846129,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,1126166316305685970,1350676763196877149,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,16818458437765073963,15267926180937858216,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10523984985138736771,5132824656844907878,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,5649083300904721518,4306314219898822883,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4044338760759323315,11297814312201395806,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8535589019034736997,8882698829405250679,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16089212202740304084,6515620539104180667,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17639358366715798961,2730789580177176221,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17639358366715798961,2730789580177176221,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10662114751875523825,8153355513563148127,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,2214303315355740064,4697403454877014581,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17987035175406371530,16131593564778633521,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14733423046909678709,14494671193833423327,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6292,i,4309448239740333288,3841148079206852452,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3443399188048520621,12252336106801384812,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,16577033532169222516,17985265850796943278,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6500,i,8274800019704348172,3282217159331235815,2097152 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,4017241813536587880,17739317694546195206,524288 --field-trial-handle=2440,i,4668578975315224023,2498356798849137459,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:4180
- C:\Users\Admin\Downloads\putty.exe
  "C:\Users\Admin\Downloads\putty.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Users\Admin\Downloads\putty.exe
"C:\Users\Admin\Downloads\putty.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4692

C:\Users\Admin\Downloads\putty.exe
"C:\Users\Admin\Downloads\putty.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94ab3e2f04ee58605e6973863c1cbf025485a2f24e1eca1401396ccc0c39732d
MD5 3469dd0cb8c12dcddcc655dc4e6efd4c
SHA1 12843979e4ce9b3ae8fb6df0a5ab659a78f632a1
SHA512 d0b837d69d349741f211c37d1aa774b38930a190d535bddd120c79acad43d1717e03c96ab6247b877e75d53683c1755ec1afb236846dfa644701433cf98a9a69
TLSH
T18ED02351B4263EE3E539147F10739516440DC237C362734775951C4DCDA518574C79D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0d1fe6d8606a6e6445c63a7096de591af900b39b7f414153279c6687a84a7ff7
MD5 867687178378b652a91b28d43f98f96d
SHA1 11b710e3ee1933ff9f6e7b64f4972903306249ca
SHA512 b014e0862be5e1edd56a71c45a55baca935275aa22fc4e78c3e03b863b1006fd0f2bc2bde708c95c251224dcaf24f6f79a38071d1792013842af7da13b9829e5
TLSH
T12A712B302206C46DD3B3C23274E22EF3B47544CAF9AFAE7551A4AD783581B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583256.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583256.TMP
Size 3KB
SHA256 f32c7c3b7826a4821d3c4cea4b4de87d9983189784d34383c3d143f254480084
MD5 bccbe79f2eef2bb4cda598edf6aa23c6
SHA1 0be0d4f6c92c49375da95e1d1b087986c7161530
SHA512 b86ed59dd56fa0b966c056cc9df63ee0480787631634b1f7a8a4e0f3df307050c4672887b928bc032b7eea4f3f7f891f1515566cedd39737c86dc166f9c4f1f7
TLSH
T11E714D302206C46DD3B3C23374E22EF3B07540CAF9AFAE7550A46D783581B51AC1E5D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0161662ba87498f6973304112409f193fac171b0ecd495c1d8a1ecebbb0b808d
MD5 e4b92368b7a978a312d05df403617d22
SHA1 cfa453aee764e9fe5c2f803e6a838abf1cd1a2be
SHA512 cd6d68c7534094ae8928ded1de82a063d57cf538d8891188d4b098ff725a6acc62b50284939eaa0ff9a3a4c66909bc9edab067f0c11b6b45d1639c427b685d45
TLSH
T18F31BFF3C2D885AD894156F0BF28AE1BCE2D0904532C3D5AC5E4EF1B97E2871D14049F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e8b044e814edbaac5eff51bf417a4413e9685270d6b3bbf9df2929f58f5661b3
MD5 c5d9a29577fa7aca417fbac1d1caa07d
SHA1 90e6b5c9c96f8498e0cacd88bbb9641bd3588a09
SHA512 d29626cc5664094bf7b5412907fa7a17a9c74b45f18098b0cf08c06774ec193e0831c79b0da6229c8b501e18f93fedebc9c7ecad5158ab8cb87696f9b0654350
SSDEEP 192:sxZzRlyM/jK1Ml8C9d/fFs9/WpVFS8QuAjaIdpp8MHW6+WN120X86AF/YAmlABIh:sxZzbld/fFsJWvFS889Hb1BM/7O
TLSH
T1FC62E902AA34A977CCDBD20DF955BF53D6F90462A2945D44AEFCDA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2bc4ca7738a0d395267c87eaaf49bcb38d8d39e302809af001aa973643672e42
MD5 2af0eb1d02e8bd5d8521c2ee0b2f4833
SHA1 3d70bd1dc5af4648410ba73b93336ef120c10b11
SHA512 5878864f002f6cbbee1e2f22cf893cb33beab621dd0a0adaddc25ce3417ea8bd7088ad345b60bccbb153cfc7a694a95bb7e625f240968c35d83581c46dac2ccf
SSDEEP 768:fgsjsqx797pLuLXJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV06v54Ll6AR99:fgsjsqx7rEXJlWvJD6Tu1jad254LAs99
TLSH
T142F20B3B6D0CCB7E4F844E9CED2A7E9A6DE8018B96D8C95447FA840C03C76EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8ca746de21d8c80d0419d10826dd4134e974ac0a1e0bb92c7992fd1ce7a4dbe3
MD5 b9f282d4d5d46f1bce499b85842c7c85
SHA1 4d65aa58763e0489f4b5d404f1443eb4c48902a4
SHA512 7d8fd01816bc9b3134d6528e84e607bc5aa65977efbe5f98b42d9ba8495223ddb572ecff952abc59c9a1441ab03db3878cae9a3445962383c564c7ea3711883b
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhmi0tamMWY:ExTjHOJz3
TLSH
T120E18A1671364652397E28A8B3A685775F4236633008B46F3FB840B54E6FE125DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6176c45e5ebe61e4fd3643b8f6bb09ded4114a61821505d475262920e3837a14
MD5 47cbe333d685d0b164fedfea2df44855
SHA1 33453673f7cff42216ff8d20855433b0f01faab1
SHA512 c457a9be486fe075fe9f312d57be2cfd9f615267c31402ebd5d77e04211b7fef37d510c67219ea961bc141b7284ab6ce6d7c466d411c3bebe1080d11bdadd2a0
SSDEEP 768:Tj+9RJSaHEOj9aFNtSmC6KsWjJoKNucLvp:29RJTcC6KVjJoKNuovp
TLSH
T1A0C25BB298695CF704E1E4C9A603F2272DA41037D9895E4CE6F9BF3D308FAF82316416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e6bdcb06da7c6b4e78f8ed3d53619da0f82d1d0ba890e4a13becef8f118412c
MD5 1a21aa3a861106c58a3cb038f247a08b
SHA1 58356cc70d07ecaa25b51b0e77ecf0fbb7ef8595
SHA512 0c83b68f8c215074f10d0ee1eee903083763117b5bee9c87a8e2723079db4f1bdc0861c8dbbc70f838a34ea150c6b34c7a5aebf259e7f85c244a2312152774fd
SSDEEP 192:tONnd6JkRtQmiUyR+GW+RNEOmAeR1h3aRAU6:tONd6UrCTW+RNEOzo1U6
TLSH
T1DC02E835AD382C7B9EF2AE0AB58B37175FE4206BB9856F84DAD81F0C01D765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd7076d94d607d9f30903880a0b3c5fa9ab7635cacb02ffec44a1a2e82f4eb89
MD5 f28d253094157c4452099d745700897b
SHA1 215121a55c4bf8b82322279847ba61fbafb300d4
SHA512 add4bd69ef0d0a4b65f821cf324aead29f92900773fdf9924d4ef4e82a3acd57263d807c96d5715b3eafe15edbedbe50c530330d3c4a0641ecbfea4d8abca192
SSDEEP 192:tON+6JkRPQmiUyRlGE+RNEOmAeRi99apVcFDqqVU6:tON+6URCwE+RNEOz/9a0xVU6
TLSH
T12A12093579382CB79FF2AD06F58736175FA8206BE9856E80DAD41E1C01DBA9C130A936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ced109b13e2ec11975473cb423f5b201f642a6c5b7506230f7ec5ecf3eb34977
MD5 5dde6ef1749b85528274a9b6311fb577
SHA1 bfd932d0ce333d4518ae2436b79c13b7adf17348
SHA512 27f8e25f7aa05f66fd95ce669925f9edfbf95811d454483d3771c088a95af8ac85286695a6423b4651e29c709f6ed9da044a644a205aead85e1216bb464018ac
TLSH
T11D41F85CBAF91118B3B77E1AABF7B96E447BB8772F16C45D00010D4E0A36A40D9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

PUTTY.RND

Path C:\Users\Admin\AppData\Local\PUTTY.RND
Size 128B
SHA256 255316c77463c359a528b00d1f3d85d1138ce57f242bb5b931074f7f7be2dd88
MD5 e75ca767dd9739aa90b14f1937400a29
SHA1 db37c3f7140abf7fb26dde2a0fd4f546f733df91
SHA512 160003a0ebfa884b289285bc92d41aea3395fc8c600e01fd69f3f58941be9a78e07d76204ca5d385154bccbe4a5813fbbd6162220f45ba93f9c7b4ebd5c2cd94
TLSH
T1A9B02BA660881492CD8978C6CC422141D05567DC01458CF23C402058240C409033360F
MD5 SHA1 SHA512 TLSH

Submit Download

PUTTY.RND

Path C:\Users\Admin\AppData\Local\PUTTY.RND
Size 128B
SHA256 2bbe256205ccf9df9c44eebefd01e9921929045f0c472951bfad30f0c46b7c51
MD5 3413dc432fa2a4b2963b458e350018ef
SHA1 adc907fe8c1007d456b503505e730bd102912bf2
SHA512 bdbdadc32ecd566dcbc8449cae8c6600319c40a0e4979430102fb227da13d75d46ca7c15315b765b5e0e1d71de024efca01167924809faef6847c91d8124a6ef
TLSH
T13AB02B0C0A473044043A14C02AB0AD28ED601200E8532CF35009100C0A626252003E0C
MD5 SHA1 SHA512 TLSH

Submit Download

2c285bf1-fb45-4685-a8c4-73d9c12ebcd8.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c285bf1-fb45-4685-a8c4-73d9c12ebcd8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec9f911-e4e5-444a-b3e6-bf777c14a056.tmp

Path C:\Users\Admin\AppData\Local\Temp\9ec9f911-e4e5-444a-b3e6-bf777c14a056.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7c3fd39b-3207-4e91-b94e-d020aa9eed8f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4612_1004606299\7c3fd39b-3207-4e91-b94e-d020aa9eed8f.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4612_806706076\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

putty.exe.crdownload

Path C:\Users\Admin\Downloads\putty.exe.crdownload
Size 1.6MB
SHA256 7056ca2f6a9f3c525845b116c7bf564ced3284a4083ea80d7e9ef51a16f612c4
MD5 751adc0b31a17f79d479c3b7a274c6da
SHA1 5a6860bc33f3e965c333ae8c593b90ad6a9459f1
SHA512 d197871852517dd3ba7cb4bfe4fcac940cf2a28f3053576a17a8d30f0536ee252cb3e03aee0a8c434056ae99eaebc05bfdeaa9793fbf7e7e3a29ef790abbd6b8
SSDEEP 49152:VOavQKlTbj+6dxyKUKtZGRXvWq/artnqoaaHSDwC:V1dqC1HtGT
TLSH
T19A85BF17B29610EDC06EC17887565122FA71BC850B34BAEF17A467262E22FD06F3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads