e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.exe
Size 4.8MB
Sample260626-p2ndjsct5k
SHA256 e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9
MD5 1f65544978b8ea0e745e573b8ee9684b
SHA1 139c7a9f824bcf6db4407f38413ef817ebef64a8
SHA512 0b79789e4d018cf21e37138b2cc326c328f9d55bd9fc6c18ac478aab93dc323827723f9dec4a2409e6474a25f1cb2f37cb96f59d633c0b8986c9885ac2e1023d
SSDEEP 98304:aZNPk6sokUUS5iWlAXIxKWX/XBYFLOAkGkzdnEVomFHKnP:adsoXiIQEfBYFLOyomFHKnP
TLSH
T13036AE85EBED44C8E4AA9076C927892BC673BC541235431F10697F5BEF733120E1EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4400	SystemSettings.exe
3876	SystemSettings.exe

Loads dropped DLL 2 IoCs

pid	Process
4400	SystemSettings.exe
3876	SystemSettings.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1603202657\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1949819751\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1949819751\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1953651437\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1603202657\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5824	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269517882929428"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{D0C51092-DDC0-4C74-AB49-73C8DBE32D66}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4400	SystemSettings.exe
4400	SystemSettings.exe
4400	SystemSettings.exe
4400	SystemSettings.exe
3876	SystemSettings.exe
3876	SystemSettings.exe
3876	SystemSettings.exe
3876	SystemSettings.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4652	e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5100	4652	e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.exe	89
PID 5100 wrote to memory of 1708	5100	cmd.exe	91
PID 1708 wrote to memory of 5564	1708	msedge.exe	92
PID 1708 wrote to memory of 4868	1708	msedge.exe	93
PID 1708 wrote to memory of 5824	1708	msedge.exe	94
PID 1708 wrote to memory of 4868	1708	msedge.exe	93
PID 1708 wrote to memory of 4868	1708	msedge.exe	93
PID 1708 wrote to memory of 3184	1708	msedge.exe	95
PID 1708 wrote to memory of 3184	1708	msedge.exe	95
PID 1708 wrote to memory of 756	1708	msedge.exe	97
PID 1708 wrote to memory of 4884	1708	msedge.exe	98
PID 1708 wrote to memory of 756	1708	msedge.exe	97
PID 1708 wrote to memory of 756	1708	msedge.exe	97
PID 1708 wrote to memory of 4884	1708	msedge.exe	98
PID 1708 wrote to memory of 4884	1708	msedge.exe	98
PID 1708 wrote to memory of 4536	1708	msedge.exe	100
PID 1708 wrote to memory of 5684	1708	msedge.exe	101
PID 1708 wrote to memory of 4536	1708	msedge.exe	100
PID 1708 wrote to memory of 4536	1708	msedge.exe	100
PID 1708 wrote to memory of 5684	1708	msedge.exe	101
PID 1708 wrote to memory of 5684	1708	msedge.exe	101
PID 1708 wrote to memory of 700	1708	msedge.exe	102
PID 1708 wrote to memory of 700	1708	msedge.exe	102
PID 1708 wrote to memory of 700	1708	msedge.exe	102
PID 1708 wrote to memory of 3092	1708	msedge.exe	103
PID 1708 wrote to memory of 3092	1708	msedge.exe	103
PID 1708 wrote to memory of 3092	1708	msedge.exe	103
PID 1708 wrote to memory of 576	1708	msedge.exe	104
PID 1708 wrote to memory of 576	1708	msedge.exe	104
PID 1708 wrote to memory of 4492	1708	msedge.exe	113
PID 1708 wrote to memory of 4492	1708	msedge.exe	113
PID 1708 wrote to memory of 2652	1708	msedge.exe	114
PID 1708 wrote to memory of 2652	1708	msedge.exe	114
PID 1708 wrote to memory of 3408	1708	msedge.exe	116
PID 1708 wrote to memory of 4264	1708	msedge.exe	117
PID 1708 wrote to memory of 4264	1708	msedge.exe	117
PID 1708 wrote to memory of 3804	1708	msedge.exe	120
PID 1708 wrote to memory of 3804	1708	msedge.exe	120
PID 1708 wrote to memory of 2188	1708	msedge.exe	123
PID 1708 wrote to memory of 4264	1708	msedge.exe	124
PID 1708 wrote to memory of 3756	1708	msedge.exe	125
PID 1708 wrote to memory of 2716	1708	msedge.exe	126
PID 1708 wrote to memory of 2716	1708	msedge.exe	126
PID 1708 wrote to memory of 1760	1708	msedge.exe	130
PID 1708 wrote to memory of 1760	1708	msedge.exe	130
PID 1708 wrote to memory of 4780	1708	msedge.exe	131
PID 1708 wrote to memory of 4780	1708	msedge.exe	131
PID 1708 wrote to memory of 5880	1708	msedge.exe	132
PID 1708 wrote to memory of 1092	1708	msedge.exe	133
PID 1708 wrote to memory of 1092	1708	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.exe
"C:\Users\Admin\AppData\Local\Temp\e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "C:\Windows\Temp\e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.pdf"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Windows\Temp\e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffd2160c188,0x7ffd2160c194,0x7ffd2160c1a0
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11610704786827674097,342351881985845232,262144 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1888,i,8016666149279884368,17988250773994032918,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2552,i,11322297767230722162,10144701460702199215,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,6072524136826162077,18164867106505763026,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1007523384485931549,9479271353987360940,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2034790061084457945,493266723260738323,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,13691153323070105977,7027814192465620586,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,7282556547925842417,12959052676571101852,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5192,i,9539436041565844388,15069426685384225855,2097152 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:15
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5272,i,10093410578058981159,2874177379265086871,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5856,i,6619712408679131012,10889824166531452329,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5844,i,7694729932117111712,13019714956767597042,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5592,i,13658501423185511458,14132713897250253326,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5592,i,13658501423185511458,14132713897250253326,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6692,i,8687905215617773354,8119504835817913693,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6784,i,3471880186980335864,2504932715265075652,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5068,i,17503035205910719594,12214756018513363135,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5048,i,9094462262895397072,4493254894720352674,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5032,i,15261384096078698879,2649071679469676369,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5916,i,216849783610098486,9292254524159124131,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6580,i,12761262986093023793,11184088166001257108,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:14
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6588,i,957571491390317121,12353175758094369412,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,12743842060335339535,1205738589088979551,262144 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6160,i,9380539053656032750,6236948966746326833,524288 --field-trial-handle=2316,i,4985252420740287360,7046183767277185551,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2884

C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.exe
"C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3876

C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.exe
C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2710a4334e232b2c5074ed144fa45969e9d124ee2b5f48e8c79d6f67b96b1110
MD5 6cfdd7f96a17d37ea1da8c812d7f6798
SHA1 2319fcac1f8d85e4d3a3a5918a3b2c1de4201122
SHA512 c63106fd1f6f6ffb010fb4401f3869b85e10c6d1f6df9ebf05fd2bd3db49912a781dc5891a998893f383b77da853f255029d418bc3e8dee9a6c24f56eeb8a3b0
TLSH
T1837140D9E86CCDA2DBD331F583E566ED7B74DC0B91172E5120DED17C8987B1A6203089
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6638437d5f2c89863fe50e647a4847ac23d105939742e45956e880a74551b87c
MD5 505b7a3d6db7ec0a99d8601af3e8e3e8
SHA1 23817498bb544c3e40cb478ed2e15aa124c11fd6
SHA512 35b5b8b53cc819189f284aaab9b1aa3f0e92d593e17e821ad3b5e98e426894cfa75401eaa0af7c4a98be5526e2bb1176a802dcbf216f45ba11647790d97bc4cf
TLSH
T1D541ACF3C2E8856DC91156F0BB187E2BCE1D0954832C3D9AC9E4EF5B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f5233d124cd33197be7289d22ae243477dfd0751482bd4bc5a5a6d79a2173be7
MD5 1b3dd85e6cddc3369e62b4c6b5e3740a
SHA1 34fe158b11a0b662417fe68e5ddb0c15cefaab23
SHA512 bf221086330f1a6ca84a4cc5b738ed85b850a64ec6f344c37723e7416a18618e9974981228c9169bfc58165cb319d72f375a5065a072b5f3121e60b3c01da4da
SSDEEP 192:sxR1kRgyM/jK1Ml8wc+/fpmsTBES8HZ/RzoA8p41/g6+WNIYZfOwIKG6IgtJ:sxRO2C+/fksN18508/5IsOi3
TLSH
T1D162B815AA249937CCDBD20DFA557F53D6F81573A2901E48AAFCCA0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b651073eafbcfe85b2a28910c3da98bb58f3bf32341232605bd7ce3254570ef3
MD5 cd87f6b1694bc01edb5d76069a0e3bed
SHA1 fc220d3062f76de417f250268375298ba413fe0a
SHA512 3fcd4552896f6fec1d4b0f9f3c2f5acda083ab0debaaf8bc223e24de6efe44632d4a0e351fc0fd4fa3f43ac90a987203c116d69db1ff3526318d4743608e584d
SSDEEP 192:sxR+kRgyM/jK1Ml8UQXc+/fpms0BEf8HZ/RzoA8pe1/g6+WNIYZbOwIKG6IgDSJ:sxRV2qs+/fksQ8850S/5ImOiC
TLSH
T1E062C915AA249977DCDBD21DFA51BF53D6F81573A2901E44AAFCCA0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88205221969b295d31a0347ff0bd2638176589418e88efeb2dae3ee6752b9853
MD5 3676e5f4e00041be1081dc383681f35f
SHA1 f63bcdf1553a98836d22dffcecb81017f7806626
SHA512 fb2530331fe2cb66d54c60ad570e7d818eb36cfeb262364561f247317af8dcdcfc90db9a14375b9b321d224e816d43c573db9288d7843e22906a44a0ab1a5db3
SSDEEP 192:sxR+kRgyM/jK1Ml8wc+/fpms0BES8HZ/RzoA8p41/g6+WNIYZfOwIKG6IgDcJ:sxRV2C+/fksQ18508/5IsOik
TLSH
T1D662B815AA249977CCDBD21DFA55BF53D6F81573A2901E44AAFCCA0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 fd4ba3c397062b5bed07390d5136db6013dd431ca0ac24b8c8ef5579285b2a3a
MD5 b8179320a9f6cd343ac194735e78cba7
SHA1 8069d4a206dec5f6f1f4cb891f343286247c7486
SHA512 9b2668722bca7a7805ab9a91a02d1348bb71b8ddfd24148ea0005e65e9806f15558cccfdf9bb99d52333619d222b917d5ce17c61d4d873c711890c070280de8b
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV6DREkTqQero7o4:eOEtpZE7ZIWgKgf16u1ja9D2/Q188Zf
TLSH
T124E2DB3B680CCB7E4F804A9CED297E9E6DE801CB96D8C95447EA840C03C67EB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

926bc65e-3aab-4e6b-84df-cc1b4e79b3c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\926bc65e-3aab-4e6b-84df-cc1b4e79b3c9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 964de4fb54761e2a4f55dacc0b770849352a635ab109d688f90abe9ea312fe2b
MD5 36c6e2ddc68a6bbd5e5f68f76c324510
SHA1 9331b40e5de160d0014cb8ce0a4110214234b328
SHA512 145efdd0c3b3215fc96e42a59f33181f501914fe6f0852ff36f289a4a0fdfb5f52ce9943c6aa2ba563e39cbe2b45bdde710d95e40f2c382c8fe1d8c3ba67323b
SSDEEP 768:EjaeqD4MlshiLdMma3sgPfcOTfBVYV5R4HTytYYqgHvPgCyjWtxjTo:EqcjhIdMh3TfvfmWTwJLyj2y
TLSH
T19003CF76ECB85CB78CB29685770277976EB842A3C3C52B64D9DC5A0D019BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0cf6c937831bb8b58a11b8e2923172ef03cccc7bb2618b40e12bd929aa5a6390
MD5 9726aea4e768169dab19e45105377563
SHA1 5f9b1344e41de657cc0e1d3c485f51522a0408b6
SHA512 2b76fe52d304f2c76a52ccd929b26f9a55db05647f32119af16a382d5354a5ef9cd09eb561605e718d72370d23890f21fe9c0fe2debf8d80cb1642d843cc9d98
SSDEEP 768:2j+9i33ep8NDPfcOTfBVDfBAFV5R4HTytYYqgHvPwXzn12bf3m:l9i33ep+fvfTfOWTwJqBy3m
TLSH
T124F2B071ECA99C675DE2D6C9B6023787AEE85273D2C01A14D9D88F0D05CBBCE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ba50592cdf31b50dba0385ec0e3467cf23c537984f1894deea1e3b3f607f4267
MD5 ca1151030d186f5f34d16382530c4a58
SHA1 fe6542ceb3a301c804573b9cf76058326785f4b8
SHA512 60aa0f68efab8bf92ab8323d6b66b49094fb72d9dd4409404a8be804052975a6cd342e4f74e3f597e441beb3bd8a45a091aa7dfe4b11bc0ea365d4c9185eb8b1
SSDEEP 768:9F1j+9b3SwgWep8N/KfcOTfBVDfBAwV5R4HTytYYqgHvPwXzn12bf3m:U9b3Bep9fvfTfRWTwJqBy3m
TLSH
T116038E76DCA8CD6B6DE387C5B705778BAEE44273C2C85994DAD84E4900CB6CE170BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 00068af7bf3ba9cfd25d32ba882f00872c9f996e650d26545a7aa05f7052a6ff
MD5 6161e0ef4a37aeefb152585ae44d6820
SHA1 4566db956b6fd42c106858a4e11b4acb6409178a
SHA512 fb13d3a635d3e0da756b6156a3e2dc9142eaeaeab473efddd3469e78b635693e50497fcca8468edf95f7e27a06d8c469a289803cd815a5798fe5a1e2640a3bcd
SSDEEP 768:vj+9i3uep8NDPfcOTfBVDfBA9V5R4HTytYYqgHvPwXzn12bf3m:C9i3uep+fvfTfsWTwJqBy3m
TLSH
T1EEF2BF71ECA99C675DE2C6C9B6023787AEE85273D2C41A54D9D88F0D05CBBCE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

148da3b1-75da-420e-8c31-777ee169d79c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\148da3b1-75da-420e-8c31-777ee169d79c.tmp
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3f3abf52-df09-4a42-8f12-234c7c375ebf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f3abf52-df09-4a42-8f12-234c7c375ebf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_56777194\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DscCoreR.mui

Path C:\Users\Admin\AppData\Roaming\xwreg\DscCoreR.mui
Size 287KB
SHA256 132614e002a5b6a4b32a3bb5f4fe12f6d98e2f07b45b6e321cd2c785c62283e5
MD5 b289f5ca9115126770eae141f1da2461
SHA1 92820582e4d237fcc01566d8f5077b96c4064514
SHA512 b5bc6f49f2ebc3bae64b7b0487937b6eeec188307f69b240943f153b9ba745519bdfaf573341426aeb23aeece60e33f30ca207ba0f7b57cb618a8f3cdaf6d4f6
SSDEEP 6144:893bakTyyyu+zbPE6GgF8T/qkADQwa0RD6wWmzWG4CVn3K4:xkTym+kmqqkghD6wWhO64
TLSH
T14154236D9C090E58FFB586CECFFB004F9A84ED71A50C8559546A2853DEE23C27753A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncRes.dat

Path C:\Users\Admin\AppData\Roaming\xwreg\SyncRes.dat
Size 108KB
SHA256 dd64588cd549a207e4e2cef5fb62c58a400697b4d80cb4d38dc087b25cf3717b
MD5 3fc721f86bcda1523416a1e81ee74783
SHA1 e57e65375a2129d944082890356ecbb36e3185e3
SHA512 64e0f3f8a0cbfb59da644daf17fb86d3f89a930dbb056a734f2df28cf378dece1e85710366d5b097b342d221e51288e07f00eedbdeb2796559e93f80034189ab
SSDEEP 3072:JXbTAVenFVl1HkhMfMhthUA3/Wsh656eeoZW:JXnAsnF5HkqfMhth/65zeN
TLSH
T118B322D3A76E8546EB79F4E5837920AA20A45B23112F5E5DD53E9280C331B02F3F60E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemSettings.dll

Path C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.dll
Size 207KB
SHA256 0e34870f2f9da5505190e6e01c86527de232c48ee009c4f24d98fa918249eac1
MD5 0f4f3b1dc9c8ee8c47e8f0744b807e13
SHA1 a59f0e9a86964d23629a23a210b4900007548a9a
SHA512 5f9e486fe73a71b87ec30dfbf70f91e27f66d547cbf2060927878a4f6cd74314cfec7cb5b4c43c511d53786b25d88808beaf9ac2ea36e7de780f1e795e01d49c
SSDEEP 6144:dvjffxwIyQD0Cr+s/2byvvohoXl/lBlelfLl0l0l2l699XXt:dvjfJwIya0O+sNvoCl/lBlelfLl0l0lx
TLSH
T1B3245C19B3F90469FE7786758DE75545A7327C211730CABF039042299E3BBD0AE36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemSettings.exe

Path C:\Users\Admin\AppData\Roaming\xwreg\SystemSettings.exe
Size 118KB
SHA256 190258f9864b0ae0f7ee10ba7acd127e9fb2ac13786fa4a4b2ed3217b0f26a49
MD5 4214c654e295fbcd36b7ed9781f7a559
SHA1 a59b82642eb045a7e8b32adf60f9248893a54300
SHA512 75ffa4626fc2213bcb8f8e4c7f9aab5a0c8bc9424c1e0ba88666751af94b86cece47f49439aa9b872aaf71f7571658373395315b95185e2a8b743131d95a2232
SSDEEP 1536:ALjOIGAzPaIhnV/BEHC3vpvlKDomIcoKCE45nHQMPpLEPmz5JW0:OzPrL5EONKtIctiLE+t80
TLSH
T1BEC34CC6AF98B944E4BA043076A5C97C6573FE220B10C6EF2693F35D1D75BC8AD38A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.pdf

Path C:\Windows\Temp\e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9.pdf
Size 240KB
SHA256 d1b90165e8b9ed5355af18e791aa128215f9ca7ff2bb3dbceb794fda6ede808a
MD5 2f1a32d33c69b106d0cc0f1eb390c2b3
SHA1 2ad87e78cc57aefac8ae968294ea148b58aff707
SHA512 83354675b16c6e4738fb5974d56369452c6fce7c70f0468882cba1790e516e90ada87e91566debf8fde18e6ee9e4d0892401326257ac387695c87ddd2299b7d7
SSDEEP 6144:dsxOfjjj/GUUxQaMburh3rnxYyNwEl8bRbDsP6EpxI:GxQSUFeFn1wEaa0
TLSH
T11234128FEF5A41D9D8068C7A659336784245D6CB839E39E4820FCC526281F70A7B5FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3876-100-0x0000000180000000-0x000000018005C000-memory.dmp

Download

memory/3876-93-0x000001A134C30000-0x000001A134C82000-memory.dmp

Download

memory/3876-96-0x000001A134C30000-0x000001A134C82000-memory.dmp

Download

memory/3876-97-0x000001A134C30000-0x000001A134C82000-memory.dmp

Download

memory/3876-114-0x000001A134D60000-0x000001A134D62000-memory.dmp

Download

memory/3876-101-0x000001A134C90000-0x000001A134C98000-memory.dmp

Download

memory/3876-99-0x000001A134C90000-0x000001A134C91000-memory.dmp

Download

memory/3876-98-0x00007FFD025F0000-0x00007FFD02600000-memory.dmp

Download

memory/3876-110-0x000001A135310000-0x000001A135782000-memory.dmp

Download

memory/3876-111-0x000001A134CF0000-0x000001A134CF1000-memory.dmp

Download

memory/3876-112-0x000001A134D10000-0x000001A134D11000-memory.dmp

Download

memory/4400-74-0x000001C707070000-0x000001C707078000-memory.dmp

Download

memory/4400-87-0x000001C707580000-0x000001C707582000-memory.dmp

Download

memory/4400-86-0x000001C707560000-0x000001C707561000-memory.dmp

Download

memory/4400-85-0x000001C7070E0000-0x000001C7070E1000-memory.dmp

Download

memory/4400-84-0x000001C7070C0000-0x000001C7070C1000-memory.dmp

Download

memory/4400-83-0x000001C707610000-0x000001C707A82000-memory.dmp

Download

memory/4400-82-0x000001C7070B0000-0x000001C7070B1000-memory.dmp

Download

memory/4400-81-0x000001C7070A0000-0x000001C7070A1000-memory.dmp

Download

memory/4400-73-0x0000000180000000-0x000000018005C000-memory.dmp

Download

memory/4400-80-0x000001C707090000-0x000001C707091000-memory.dmp

Download

memory/4400-64-0x0000000180000000-0x000000018005C000-memory.dmp

Download

memory/4400-66-0x000001C705760000-0x000001C7057B2000-memory.dmp

Download

memory/4400-69-0x000001C705760000-0x000001C7057B2000-memory.dmp

Download

memory/4400-70-0x000001C705760000-0x000001C7057B2000-memory.dmp

Download

memory/4400-71-0x00007FFD025F0000-0x00007FFD02600000-memory.dmp

Download

memory/4400-79-0x000001C707080000-0x000001C707081000-memory.dmp

Download

memory/4400-72-0x000001C707070000-0x000001C707071000-memory.dmp

Download

memory/4400-63-0x0000000180000000-0x000000018005C000-memory.dmp

Download

memory/4400-62-0x0000000180000000-0x000000018005C000-memory.dmp

Download