mintsloader | 7c5f16ed26dba082ebc7b8de21a291a7ad58c09375f91a13876e58b576aeb933

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
01/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT7836865528760.html
Size 19KB
Sample260701-plbptaes3r
SHA256 7c5f16ed26dba082ebc7b8de21a291a7ad58c09375f91a13876e58b576aeb933
MD5 364a258fa81df69b12404a377974d184
SHA1 dd89023598578f06fd0230c2df9d009557e4aeba
SHA512 5faf4a6f593bac36b497e6f5804052e6378716a58a72d01bc9198166b8b04f812613bbb958211240be5b807cc8f1387f37342e645735c685fc91f0cad1426762
SSDEEP 384:TUN/xDU4UN/xqN/UrmRqMrRd2dRN/2KsTIJVwKrM:+TKBq
TLSH
T1A0920A61CA54254F2D4362A6EB4AF1936264C51363018A90F5AF93CDBF068FCD3B7F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution mintsloader loader ransomware suricata

Malware Config

Signatures

Family: MintsLoader
MintsLoader is a multi-stage malware loader.
loader mintsloader

Suricata alert: MintsLoader Outbound C2 Communication 1 IoCs

Network activity triggered a Suricata alert

suricata mintsloader

flow	pid	Process
66	3588	powershell.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1220	powershell.exe	103
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	1220	powershell.exe	103

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
47	4220	powershell.exe
66	3588	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe
3588	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273822926116775"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{918938C3-CD9F-4DC4-8373-18BBD7AA75F6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
552	notepad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1716	1912	msedge.exe	83
PID 1912 wrote to memory of 4816	1912	msedge.exe	84
PID 1912 wrote to memory of 4336	1912	msedge.exe	85
PID 1912 wrote to memory of 3776	1912	msedge.exe	86
PID 1912 wrote to memory of 4336	1912	msedge.exe	85
PID 1912 wrote to memory of 4336	1912	msedge.exe	85
PID 1912 wrote to memory of 3776	1912	msedge.exe	86
PID 1912 wrote to memory of 3908	1912	msedge.exe	87
PID 1912 wrote to memory of 4724	1912	msedge.exe	88
PID 1912 wrote to memory of 3908	1912	msedge.exe	87
PID 1912 wrote to memory of 3908	1912	msedge.exe	87
PID 1912 wrote to memory of 4724	1912	msedge.exe	88
PID 1912 wrote to memory of 4724	1912	msedge.exe	88
PID 1912 wrote to memory of 4240	1912	msedge.exe	90
PID 1912 wrote to memory of 2800	1912	msedge.exe	91
PID 1912 wrote to memory of 4240	1912	msedge.exe	90
PID 1912 wrote to memory of 4240	1912	msedge.exe	90
PID 1912 wrote to memory of 2800	1912	msedge.exe	91
PID 1912 wrote to memory of 2800	1912	msedge.exe	91
PID 1912 wrote to memory of 3336	1912	msedge.exe	98
PID 1912 wrote to memory of 4332	1912	msedge.exe	99
PID 1912 wrote to memory of 3336	1912	msedge.exe	98
PID 1912 wrote to memory of 4332	1912	msedge.exe	99
PID 1912 wrote to memory of 1560	1912	msedge.exe	102
PID 1912 wrote to memory of 2632	1912	msedge.exe	106
PID 1912 wrote to memory of 2632	1912	msedge.exe	106
PID 1912 wrote to memory of 2632	1912	msedge.exe	106
PID 1912 wrote to memory of 2916	1912	msedge.exe	108
PID 1912 wrote to memory of 3644	1912	msedge.exe	107
PID 1912 wrote to memory of 2916	1912	msedge.exe	108
PID 1912 wrote to memory of 2916	1912	msedge.exe	108
PID 1912 wrote to memory of 3644	1912	msedge.exe	107
PID 1912 wrote to memory of 4212	1912	msedge.exe	109
PID 1912 wrote to memory of 1924	1912	msedge.exe	113
PID 1912 wrote to memory of 1244	1912	msedge.exe	123
PID 1912 wrote to memory of 2212	1912	msedge.exe	124
PID 1912 wrote to memory of 3180	1912	msedge.exe	125
PID 1912 wrote to memory of 3656	1912	msedge.exe	130
PID 1912 wrote to memory of 3656	1912	msedge.exe	130
PID 1912 wrote to memory of 4252	1912	msedge.exe	132
PID 1912 wrote to memory of 4252	1912	msedge.exe	132
PID 1912 wrote to memory of 4252	1912	msedge.exe	132
PID 1912 wrote to memory of 3464	1912	msedge.exe	133
PID 1912 wrote to memory of 3464	1912	msedge.exe	133
PID 1912 wrote to memory of 3464	1912	msedge.exe	133
PID 1912 wrote to memory of 2716	1912	msedge.exe	134
PID 1912 wrote to memory of 2716	1912	msedge.exe	134
PID 1912 wrote to memory of 2716	1912	msedge.exe	134
PID 1912 wrote to memory of 4076	1912	msedge.exe	136
PID 1912 wrote to memory of 4076	1912	msedge.exe	136
PID 1912 wrote to memory of 4076	1912	msedge.exe	136
PID 1912 wrote to memory of 752	1912	msedge.exe	137
PID 1912 wrote to memory of 752	1912	msedge.exe	137
PID 1912 wrote to memory of 752	1912	msedge.exe	137
PID 1912 wrote to memory of 3140	1912	msedge.exe	138
PID 1912 wrote to memory of 3140	1912	msedge.exe	138
PID 1912 wrote to memory of 3140	1912	msedge.exe	138
PID 1912 wrote to memory of 1948	1912	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT7836865528760.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7ffb4a94c188,0x7ffb4a94c194,0x7ffb4a94c1a0
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4823211404836116699,12521512723370942799,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,9358593889123504373,434622213223437329,262144 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,6716839808672259926,6282313303846272545,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6908344984234451026,12733495303298348207,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,584036146575199562,1368828432141007877,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,12618251684209623058,9699519546339706311,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14377868882264870738,3404324311992652396,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,64520067895335727,17761332220590356705,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2341509232556782664,4447192753255157801,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,91070726213443106,15579444218437783852,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,91070726213443106,15579444218437783852,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6372,i,5068401462173050640,7305974799075456143,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=it --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,7643780527781085387,11674899988262576044,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6260,i,10787487811605730663,9623448359346528939,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17506176667144143752,15849812522308367066,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:4212
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Fattura759073333.js"
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12946201120223605933,16000778048744205625,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,15167175779629342619,16176810809970901877,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15063171285308848925,6559466193661268119,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2952,i,13330651663381040100,5024308730221680617,524288 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5224,i,15209637530144691705,14382686450036542096,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6608,i,17267059509991647703,17737737513899308981,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3544,i,12192799727088927985,8733467798700057206,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5644,i,4124465261230554780,16885265664008197235,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5364,i,12964948999536336824,15856366976935730270,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6996,i,7328537607118816600,11152246997456896141,2097152 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4448,i,15291554392755585959,9141169585265210959,262144 --field-trial-handle=2344,i,3116299220736409792,8626632490492602186,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -ep Bypass -File "C:\Users\Admin\Downloads\exdYDmZlf3zAGDBlFiJGuMLAYZCl5TckJpJbrHC171keRQIbu3.ps1"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Fattura759073333.js"
1⤵
PID:5028

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\exdYDmZlf3zAGDBlFiJGuMLAYZCl5TckJpJbrHC171keRQIbu3.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -ep Bypass -File "C:\Users\Admin\Downloads\exdYDmZlf3zAGDBlFiJGuMLAYZCl5TckJpJbrHC171keRQIbu3.ps1"
1⤵
- Suricata alert: MintsLoader Outbound C2 Communication
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Fattura759073333.js"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e8bf14c9af190736f4d3be1a9829360f5b087aad5196b0791b8ff0f554ae626
MD5 613f4c385a4cc19c523675e59eb16e30
SHA1 03497c4dbd98212fca95ff365bc5ad8151ae028c
SHA512 05906a418c8b89f3db30172462b334270396146341c114f3fe944b423443fabbc407304a08104feebf843ca87755992a3eeb9709f78177e91231e01769eed77b
TLSH
T15D814AA300E1CCB1EB306931BDDA0A2231F2B6BA75FF0F9A00C854755E1D3D1421AD79
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586339.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586339.TMP
Size 3KB
SHA256 87ba298b349764b6127b49e9de3bd22587c9a32917c94e8493792955577bb1e6
MD5 e01ec1df3ad3cf42cdf5ff1dbca19886
SHA1 70d8b9d0550892f7419b062600b00b53981e3c2c
SHA512 d1e1effef7d85264a45d86bc23075eb8bb3c57a1273b3a6d63d7c8f103674c1df7b52f192fe56e61ae120253122c5e28c798f65397a76d15dbb03c60e07301ed
TLSH
T18C814AA301E1CCB1EB306931BDDA0A2235F2B6BA75FF0F5A00D804764E1D3D1422AD79
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 006714043dc9a3cd25820733ee4b936f7b5c539bd1b1b3d661aa2405114ae5d0
MD5 4e724c9920ba6eed4410bf7056c05e1b
SHA1 5ab06cd1186908861cfedc3a9395981c870a8dd5
SHA512 204ec96497c9d7e366cebcaed7b87a799188ff782a5bed3f2e5413fdf4c96e3d3fe69e41bdfc968a15f38d875a933df3dfd6dda2e4a74845ba17f7600b8cf451
SSDEEP 1536:rfEEixdvNdb6GZqW3b5PDuVhpBHExvoZsV62UHPq:YZv30maUUC
TLSH
T17EB36226D6A64C2B01F12264EC754383F325436F9286A82F3A7C5D5C2FBD93A6542F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 644B
SHA256 445003082ca15bf19b448e72ed8eca9b2095887fd0579f089cad7c1a72b8cd43
MD5 d61efad5860cd0681c5181c8bad43965
SHA1 b319317e012177a79c07e452bb99c73db453a58a
SHA512 90494ad7dcc1e5f4619faa0333afe080de0cc417b8530d57e431d443b6b38ca6014af981882c458a7089c4822e0ccf80bfb746a3e7edd7b66c9c9119612acec3
TLSH
T1F5F09EF783E0457E8B1182F0A9187F1BCE290402431C3C5A86E0AE17A3A3464E001D47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 61ee121f611afb1937853f510fac4a78b2a7f4ad14e4cde60a6632bd8ba01ec9
MD5 d6f1674b07523119f4612f33d66aaaa2
SHA1 c841f0cd9415e6c24a03d99989f0b1df3cd0d9de
SHA512 66f4b703895ca279dad94e974410d4caab66b7afba6cf2bf2f2447b90df9cd503b2ba116a180974ab9950fbb0a35624799a3e41a3e7afc013e0c39b1f0974a1e
SSDEEP 192:sxZV9D/ya/KOMl8M9Y+/f4gs+zeVZ+VI0IupdVkHW6+WNGYvrVIESIWqOW2IgrJ:sxZLs1l/fds+CbwIHbG5Z9
TLSH
T18542E9166B345977CCCBD209FA45BB53D6F95462A2940E48AAFCCA0C05E7BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6df4ea4e887a03a907ea9b2de0d0cc24d0ffda8507c9e3a27942b94428cc5107
MD5 6e59896cbb98ee290a8209383d6de21c
SHA1 e3b821ef5da72dda0116402353b6fd1e6ccd3b29
SHA512 0b48157751bd6d95c7c05978e94c57da9000e5f843742e28a3a5050d1b9ebd6f9f41a4ede36dc328c81ef9e1ec8611ce221acfb13e9333153827ca66e767131a
SSDEEP 192:sxZV2aD/ya/KOMl8M9Y+/f4gsYyzTpV/VI0IupHVVVvHW6+WNDVzV3+/Yv2qVpEw:sxZzs1l/fds5pnBHba/lAZv
TLSH
T1D552E916AA345D77CCDBD20AF951BB63D6F5646292900E44AAFCCA0C05E7BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 004d407254bc2472500be118daef438c82169fd4163f7e509e2a0a6ae9df7b35
MD5 8696e0fd3d0a35982564dc73acfbce44
SHA1 e8162a51abd17421f274c1f63ad2245dd56aadde
SHA512 88c6c38cec6af646ed6b6d59e540f47335cb86857af4602737826e57bea1d4e10196b70dbc6cb553c57c86f17f4d5e11566cf6c0f7e704adfe4c1d6bda210a15
SSDEEP 192:sxZV2aD/ya/KOMl8UQYw9Y+/f4gsYyzTpV/VI0IupHVVVvHW6+WNDVzV3+/Yv2qP:sxZzsqXl/fds5pnBHba/lAZv
TLSH
T17C52FA16AA345D77CCDBD20AF951BB53D6F5646292900E44AAFCCA0C01E7BEC6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 73c91efb3f125da40ced8c21e4fcadfc6c71bbbab5a72cd57de09044883ef36c
MD5 90b9a39652d15be66426e8f509abde8a
SHA1 85ded0c35a82013c45cb2b303cc648cb0aa8c1c1
SHA512 fa17f8c0848a9fc2e0f72121a69fbeb7392b3589e61982e51bdd0783dfcb3e0995dcf86147662cfbaf4ad2fc4e07df1b13789128561feec297063562dd32e7f0
SSDEEP 768:OIseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppxroJh:OIseJ3xWvhfynu1jaVcL88pKn
TLSH
T17ED2FB2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c225aea2583b210f856b11038a33dc3af2887e54641503b8a8a071951d735787
MD5 a391e26fc5242065fac8ebf4d9ae1d53
SHA1 34da320d97fa46a6d942658d44c145b61f44aad1
SHA512 acccf78b77822151bbee3980928bacc4463ac7895e1d648568f9b96f82f5eabad584327c77a7ab43dcb5b97498c7a8b616a1ca5677253f60b0a417974a27c3cf
SSDEEP 96:KYH+KggmuHaKoMikAKNW+2RqK6s2stY826b:49ZmfZxstY826b
TLSH
T1AEC1F206343A1282787D2888EB9599765E8132A3706864AF7FFC04569E27E134FFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7298b9ba-fc69-4d6b-b874-668fbc3a768e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7298b9ba-fc69-4d6b-b874-668fbc3a768e.tmp
Size 22KB
SHA256 f429961ace041200b0a6f4a3fb8e693fbc03721c6ac63bcc34c17d3e99ae0e7a
MD5 50e5faaa44d5d76aff26a151a18c4cc3
SHA1 0c539a4106cf75f34c81db5d295df51f35566354
SHA512 9ed9e069af12cb64ad0e1dac13912dfa8ca78741416e1c71d48cf8726b6cdd17a91a63ba9a642fa0bca5e1b77bed00e60465d75df1f4ab83dabe673c54bbb3a0
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ul:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAk
TLSH
T17EA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 3975f518b6d1fff3eef4dbee129647e99c47a5a589373c7c25b60fdb14a0e6ae
MD5 60a8a47b0ac255c8dd7850326c4bfddf
SHA1 f4e8d1b35cbe1285497ac1f81e7550441129c41e
SHA512 22f68943eca6f0c994e46c5e1b4c0094114a4ac7c5195df7f538346199c19fbb5926e64070c4e6825e52451b9b9f36584455092384e9b551c2a46e345b881607
SSDEEP 384:jtNn/s3n9SfsN7rb7iJM5udoxEquU6nkA:jj+9Uo3AcuTnkA
TLSH
T1D9624C326C349C27D9E3E585F04B371B5EF4A16B96C52EA4E9DC6F1C01CA3AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4930f2f019b6fc9b806b988abadbef8f7af91107bb4dbe15f6746f3c84476d8c
MD5 d5af2a64d4015a0693441505653408ec
SHA1 a9153b7beb03f19bed826a67a99cdc8896ba6ac6
SHA512 0aaa8ef74815abdfd47dd389a8032e2534876d6714365a58a0b5a0fe102b8705dd74e3e04b8ea1e5cdfb360cdf51bd621503d642cff950f23ddbd5ed29cf0d18
SSDEEP 384:NTFKtNn/s3n9SBEXsNF8TUNTUlIlSb7i6M5udoxEquU2nkA:BFKj+9RXEwgUuAcu5nkA
TLSH
T1808239335C648D3BEDE79A84F54A36179EF591A78AC16EA4E6DC6F0C01CB2AC030BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ae57c517eea383b94b35a69124193d7b88b69ec68d0cc58b634ad6137c9f9498
MD5 ecdba0aafbe6073c687c455df76987c3
SHA1 83748e9b17866c825b06b1bff0323a8ee93208c6
SHA512 fd326cac3575fc25974b53482bc26baf9d52ff51e2de4c510030cd561f7fda91d296b631c17b7ccfbdf673a93d90b4575afe29191c0c107c3284a3048cbd51cd
SSDEEP 384:DtNn/s3n9S3sN7Sb7iEM5udoxEquU6nkA:Dj+9EjcAcuTnkA
TLSH
T1C6624C326C349D2799E3E585F04B371B5EF4A15796C52EA4EADC6F0C02CA3AC530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3b6bff13432645f2ce0725117f06d734112038f138f55ebc9e664c138b729349
MD5 16e10e74bfd92cf56665e005746ffbe9
SHA1 0a0c3b2445504bd1089ada09d6a7855229f5fe9a
SHA512 7fadd548a5cca186638a47267162915dfbda4fbaafb3efc63b2354b0196a970da103d7e5b192ccea89fd94dcc0b5419dcc577999ca4f61a97a94d773b7c43329
SSDEEP 192:lONP6vMtPQmiUyVmVTThT0+FdLUxED847iMBBU/u:lONP6UtRxTddoxEDRU/u
TLSH
T112021935AC785C7BDAA3AD45F48A27171FF4216F9AD11B54EAE82F1C01D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c3edb0fc49b250ce1c946f9b47f25aed065dca7b153cbee1386a4d3aa78b94e7
MD5 0c9b029c27061e8f4772cfa6a3e6e7ef
SHA1 7854e0daaaceacb448a024c45ca993ee5a6d7d65
SHA512 4fce1ec38c5c9684bdc6bffa3833c5f5232fee161ed7d72d12a371434c36647d449f81dc09023c1bba2125f82093c0e327ca9199485a140c0ff16f5f93ae803d
SSDEEP 384:ptNn/s3n9S3sN7vb7iEM5udoxEquU6nkA:pj+9EkcAcuTnkA
TLSH
T13C624C326C349C2799E3E585F04B371B5EF4A15796C52EA4EADC6F1C02CA3AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 cd867373030e0fd630badd16bdc8dfc4e1c8f9ef002b86565e595ad05ac34728
MD5 c69b8380e1c5b758e8ff79d805308a98
SHA1 56ea275af5055e5ca25bbedda320d1ca34a3c5a1
SHA512 e010183a63604c2e5507cc9a3760730458955a5cb9c0ae8b74f9dea0fef375bda3ba5a734b05cc999773c79b19eb1342d19fbda4584c031e631b8bebda2305f1
SSDEEP 192:frONrS6vMk1PQmiUyVVVTfThT0+FdLUxE5JSuUK80IiXq3U/u:TONO6UqRI7ddoxEquUTnU/u
TLSH
T12E120A36A8649C2B9D93F541F08B36171EB5915BDAC56BA0FADC3F1C02DE66C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ebe5b38f019542ff98c6a198e4a21a9f2028e577912d3662a1e4fabd65cc41f
MD5 14cfc7d37400d15afc97708fdd938c6e
SHA1 f30c2a8c19db9d9a6c854c0d7ab6a89843f9a95c
SHA512 b10c80d62958d37637bbf1a642ef0230bd61fc9d833023a1f16d5dfe7f41a0254741b1fefdac8fc14184eedeef276e7f57460bed16afe81239012ceb7c4a64a4
TLSH
T17A411A58B6EA1148B3B76F5A9BF7A85D847F7C772E0AD48E10110D4F0A22B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 63ae941052b421abbef149d1355008c86dd0e581720097f697ad3d3f35453861
MD5 a8d4ba9e9212c8437424734e11817764
SHA1 8661c243288a1068eebdfb0b7dbc19b2b166cb4f
SHA512 ad6a499ab9d0a8fe393faeffcbec50736ef63deb30d943b3fa25cafbe1b30ec88166fd4825ba448377ff164d663e5ef58cf5ad77c99014249271c6921616f589
TLSH
T18B21A837F3DC8921CC86123A409D9C1076B283C781AECF9F6FC4D614A07F588CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lxgmwxth.srf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxgmwxth.srf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Fattura759073333.js

Path C:\Users\Admin\Downloads\Fattura759073333.js
Size 30KB
SHA256 f100cf16b9fe55248f51103560439a9991c8a10d25091fe7ac28b076b071566b
MD5 8cfc9728f53de82f0e5d446d80d81201
SHA1 83a186c59ab2be8fa128183bb39602616d092200
SHA512 e7a42fbca389df6331cbe649a4dab323fe8b7250428d6e06d8e12e4b035718da15b3da35c325f142dbb0b67878d5ad8f6530915489c72fa9b8f5b8408ed12cc9
SSDEEP 384:oGzSGfGcyG/Gv4G4eHkkY7dIeWe871aCSW4O4H:H9rea8BarTH
TLSH
T1EFD2B6F3BA98109E69CF01431AF1C3B650BAC6B6432455F2E76B434C1542AD9D23F9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exdYDmZlf3zAGDBlFiJGuMLAYZCl5TckJpJbrHC171keRQIbu3.ps1

Path C:\Users\Admin\Downloads\exdYDmZlf3zAGDBlFiJGuMLAYZCl5TckJpJbrHC171keRQIbu3.ps1
Size 1KB
SHA256 bf375250033e33f93473e21f38809b34920836fbc8f5f86603b664dd8c00a69a
MD5 6b169da267c84fe8ee5f9d0008fb85a4
SHA1 60f8605355a5c858a48c700e4124cf6c71f8c618
SHA512 edcacf78c8f7b3ffb8bfb044fa4d2ca9d69500a9d1cf0fe89088a7b66af6ec4b236cce59a9f07db124d57851285b61a355f45663ac6fb980b875c685c4deeb57
TLSH
T1B62100E2C37747648BD44DCA21FC64883055D42B75412C40F05E4AB3B4A36EC6A23F7A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-231-0x0000026CD5C40000-0x0000026CD5C54000-memory.dmp

Download

memory/4220-229-0x0000026CD60B0000-0x0000026CD61B2000-memory.dmp

Download

memory/4220-219-0x0000026CD5CD0000-0x0000026CD5D52000-memory.dmp

Download

memory/4220-276-0x0000026CD5FA0000-0x0000026CD5FE0000-memory.dmp

Download

memory/4220-228-0x0000026CBD580000-0x0000026CBD590000-memory.dmp

Download

memory/4220-220-0x0000026CD5B00000-0x0000026CD5B22000-memory.dmp

Download