phorphiex | c84cf6126025b610a323264ad1b040ebaf1be8b5524c72f719245f4f6561e6b0

Resubmissions

12/07/2026, 17:47

260712-wddb1agx2s10

12/07/2026, 12:45

260712-py86vah15j10

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe
Size 1.2MB
Sample260712-py86vah15j
SHA256 c84cf6126025b610a323264ad1b040ebaf1be8b5524c72f719245f4f6561e6b0
MD5 73967c28761e8250e0abddc2005a76a7
SHA1 e1e27435066fd533d6ebbb75185bd64b330181f7
SHA512 6d11d89a8c35325244f8a909c2174f04653869d22de953925ad6c2c126987ba571ac97a44674498793de660ae26113a61e3668ffe668b24b3e3cd20c0166299e
SSDEEP 24576:lRIr4eNS66Hf2xFvJolHhhpxfv06YTQjJhjI53V:llmBJoDvxc6Yah8
TLSH
T1394517C56A5881ECDC2EC13D8BE69776E3B17C464B209EDB1294721A3E331E17D3A21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery phorphiex installer loader persistence ransomware trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Downloads MZ/PE file 2 IoCs

flow	pid	Process
1	4680	2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe
35	5100	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
440	5AA9.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	ip-api.com

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_222400624\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_507760430\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_507760430\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_2128871431\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_2128871431\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_222400624\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_2128871431\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_2128871431\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_381760357\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5AA9.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5100	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000e00000001c529-69.dat	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283339444304475"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1CD746F2-FCA2-4FE7-8937-9E6D4C9D9AC2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 440	4680	2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe	88
PID 4680 wrote to memory of 1120	4680	2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe	89
PID 1120 wrote to memory of 2804	1120	msedge.exe	90
PID 1120 wrote to memory of 304	1120	msedge.exe	92
PID 1120 wrote to memory of 5100	1120	msedge.exe	93
PID 1120 wrote to memory of 304	1120	msedge.exe	92
PID 1120 wrote to memory of 304	1120	msedge.exe	92
PID 1120 wrote to memory of 4472	1120	msedge.exe	94
PID 1120 wrote to memory of 4472	1120	msedge.exe	94
PID 1120 wrote to memory of 3020	1120	msedge.exe	95
PID 1120 wrote to memory of 3020	1120	msedge.exe	95
PID 1120 wrote to memory of 996	1120	msedge.exe	96
PID 1120 wrote to memory of 3020	1120	msedge.exe	95
PID 1120 wrote to memory of 996	1120	msedge.exe	96
PID 1120 wrote to memory of 996	1120	msedge.exe	96
PID 1120 wrote to memory of 5996	1120	msedge.exe	97
PID 1120 wrote to memory of 5996	1120	msedge.exe	97
PID 1120 wrote to memory of 5996	1120	msedge.exe	97
PID 1120 wrote to memory of 1000	1120	msedge.exe	98
PID 1120 wrote to memory of 1000	1120	msedge.exe	98
PID 1120 wrote to memory of 1000	1120	msedge.exe	98
PID 1120 wrote to memory of 1992	1120	msedge.exe	99
PID 1120 wrote to memory of 1992	1120	msedge.exe	99
PID 1120 wrote to memory of 4284	1120	msedge.exe	101
PID 1120 wrote to memory of 4284	1120	msedge.exe	101
PID 1120 wrote to memory of 3160	1120	msedge.exe	102
PID 1120 wrote to memory of 3160	1120	msedge.exe	102
PID 1120 wrote to memory of 2740	1120	msedge.exe	103
PID 1120 wrote to memory of 2740	1120	msedge.exe	103
PID 1120 wrote to memory of 2740	1120	msedge.exe	103
PID 1120 wrote to memory of 3692	1120	msedge.exe	104
PID 1120 wrote to memory of 3692	1120	msedge.exe	104
PID 1120 wrote to memory of 5664	1120	msedge.exe	105
PID 1120 wrote to memory of 4104	1120	msedge.exe	107
PID 1120 wrote to memory of 4104	1120	msedge.exe	107
PID 1120 wrote to memory of 2444	1120	msedge.exe	108
PID 1120 wrote to memory of 2224	1120	msedge.exe	109
PID 1120 wrote to memory of 2224	1120	msedge.exe	109
PID 1120 wrote to memory of 1440	1120	msedge.exe	111
PID 1120 wrote to memory of 1440	1120	msedge.exe	111
PID 1120 wrote to memory of 5840	1120	msedge.exe	115
PID 1120 wrote to memory of 3660	1120	msedge.exe	116
PID 1120 wrote to memory of 5536	1120	msedge.exe	117
PID 1120 wrote to memory of 1752	1120	msedge.exe	118
PID 1120 wrote to memory of 1752	1120	msedge.exe	118
PID 1120 wrote to memory of 2124	1120	msedge.exe	122
PID 1120 wrote to memory of 2124	1120	msedge.exe	122
PID 1120 wrote to memory of 5756	1120	msedge.exe	123
PID 1120 wrote to memory of 5756	1120	msedge.exe	123
PID 1120 wrote to memory of 3984	1120	msedge.exe	124
PID 1120 wrote to memory of 3984	1120	msedge.exe	124
PID 1120 wrote to memory of 3660	1120	msedge.exe	125
PID 1120 wrote to memory of 5336	1120	msedge.exe	126
PID 1120 wrote to memory of 5336	1120	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_73967c28761e8250e0abddc2005a76a7_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\5AA9.exe
  "C:\Users\Admin\AppData\Local\Temp\5AA9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wguswgc-na.wargaming.net/wgcsinstaller
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff862a8c188,0x7ff862a8c194,0x7ff862a8c1a0
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,16174045915279288957,15471443957470220360,262144 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
    3⤵
    PID:304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,5723575395830659107,161840439976583032,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,2048895659089094637,8818970233916099521,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,11117556411261377680,8363271150672961264,2097152 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,8144607736577186965,11233484787982368091,2097152 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15184732040326767879,5978461475126387569,2097152 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,180671020757967951,8042478750415123101,2097152 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,5465889948966952802,16674470292422935257,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,10608323578428273454,7711135739081804170,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4219732098156887647,16375871185408766503,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5880,i,18045731903039702061,17399906574552684101,2097152 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4127650068685133458,13109479112889778412,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,6823308206050157575,15776630631970071600,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4862613853435961101,5471850237063829581,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,14820644070848787420,12384812003740576019,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4862613853435961101,5471850237063829581,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,12905063494090686403,691397880493261978,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,14899056357446879025,11429046375913352465,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,10596545926570618737,484074422601811530,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,15488864184784067667,5334393396153094535,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,9308905519232915426,10778629553478934453,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,17444111378793370131,15827115309995491974,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,13423852892329429,13714143771960877887,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8297479978961268995,3033489028916984233,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,741015555627697155,4257199640186206320,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5588,i,15468462626727938236,11121844825694365260,262144 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,17347431802976002546,14580123604521784184,524288 --field-trial-handle=2728,i,16637679059123525199,549808930203802788,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 36570e5a23f805f70faeb5c93f96784142e49d14027cac5e279adccb23d9059e
MD5 82ee474a8e6d16a7c6f9a42ae4f7c630
SHA1 3c8f6d4feedea8ae7809cb27ee65437658dc3476
SHA512 7042824fa0a04ec3c6343ff30796dc749ae1d8d833e1cbf63602d53efabc7f3380cf0cbce80d3546aa60fabe709dc88358532b52029e38dc56857a19e6ad2dec
TLSH
T11E612BED733EAFC3FF604CB29CD0A49A32E58645062BAE83A1501DF0480EF2461DB167
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d24a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d24a.TMP
Size 3KB
SHA256 703b03e49c3b9914b2338e9473398333f9694c2b8688dae726680ecbb193061e
MD5 175b4fa6d5e5a1af6ed2c1fc55b59b4a
SHA1 25dfbd4293fcbd437552a162c351c8664629542f
SHA512 6cdd26565bd2e7bb1da991766c6aa5fc738cd00ae6a03004d58f9c63d6374131ad6485f96bf2c05ea9eb5226b6b658461ca17a214f3d86b343fc6a890fa476b1
TLSH
T137611DED373DAFC3FF604CB19C91A45931F58645062BAE82A0501DF0484EF2465DB167
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a29ae266dffda668805de90b7b5193f0772247ea3121ec0e5ca13305840641bf
MD5 7303fea4bfb8cfc672b21a56e9b43d90
SHA1 c4e5ce0b756a7f083460f988b4de2dcdcd7c356b
SHA512 0e491711df0bbe713b011e23250454cb7c1a445581323d2edee38a3672ffe1fccd08d4906c49cae862477f267f90aede59ec52feb9a59e8a073cbf0d6ab6b991
TLSH
T11751CEF783F4966E891196F0AB186E1FCE1C0915432C3C6AC9E4AF1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c33509220b1088b2d597a082c1767f149e8c471080d26d1847d48731b0e65fb2
MD5 dcfeee902b2dc3113b151340d0deef51
SHA1 0a779322ab6d8a62660cf60ff8ec832b366898b0
SHA512 41097511fcae624f6cf4bd789f7d81380e2bfc65a5cb103875367d9199e55e4f302d626d7c483d64da994b192ba986e4deca96bce2c17294c80d72f071d8045b
SSDEEP 192:sxRRRGyM/jK1Ml8wT0/fO+s25jCZPtbgvzoA8pi/g6+WNIYnY3h8GwIgtJ:sxRRwF0/f1sOjEPtbHi/5I5Rk3
TLSH
T1F852E9156A346D77CCDBD20DFA55BF93D6F91523A2901E44AAFCCA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1937e207693b5ae3a2a807f651efb231af11488b2b6f7f8d0570d3744d316b5b
MD5 a54ff8b9a3e342f82953e6223ce830d2
SHA1 c105d12a80805d942e9eb627a8bc475102862b43
SHA512 cb5c3b57e2054c436891dcb21a3621b3eccd2b40c1ef101a4dbfd44151263890ce5ccf6cedbb9bd70a229fdde77b950d2e71286fbf981dcc6407c85756977f0b
SSDEEP 192:sxRWRGyM/jK1Ml8UQdT0/fO+sz5iCZPtbgvzoA8pw/g6+WNIYnYWh8GwIgDUJ:sxRWwql0/f1sNiEPtbHw/5I5ckk
TLSH
T1EF62D9166A345D77DCDBD20DFA55BF93D6F95523A2901E04AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5783805aea945d2e9b853ff51fabf9897a646b341ed516801a9e1b2734609f0a
MD5 e558822a17673b0de58469685cead3af
SHA1 16b5444a299eaff8f77f2ae9a50f0417779d3b34
SHA512 10e4b8454f9871f37d01c4e15d79c5e6f6e9d8c56d97a40066610a9eaa1b66f8a87af07350c374e5bc01b6df4659150fadff324a4c28cf856be2fcde8cc5068c
SSDEEP 192:sxRWRGyM/jK1Ml8wT0/fO+sz5jCZPtbgvzoA8pi/g6+WNIYnY3h8GwIgDiJ:sxRWwF0/f1sNjEPtbHi/5I5Rka
TLSH
T1BE52F9166A345D77CCDBD20DFA55BF93D6F91523A2901E44AAFCCA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a0cd4c8d37a3289598ad38269abc1165c63d3374cb972d7add13bb4a3ac6cf0c
MD5 808d4203d30c0e395f6d21b1ab5b841f
SHA1 220daddfb777b14aceca4a7a9542476d52da8862
SHA512 e1220316933d6a1be732ddffa86a8484976390058b82b4bbdec4ad6c0d75eb0bebec173af50e8baab8a9421386de396c0b1dfd4f8e44f799ba3f5adea148c15d
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRJOu4Y6roSD8d6:wGedPsE7X6WgoufDMu1jaCJOVYx16
TLSH
T164E2DB3B680CCB7E4F844EDCEC29BE9FADE801CB56D8895447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11734ddb-e030-4d5a-bca5-353cbe9bf0d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\11734ddb-e030-4d5a-bca5-353cbe9bf0d5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 642ea8be6295323365aa1727c1fb7e20980258b83eddedcdf428ef789929d2c1
MD5 c612ba055b8975377954bbe78688212b
SHA1 716ae7af350f084fe05de2776bdd16115161dab7
SHA512 895a70524ed97b671bc4bfe6f7f2dc0ac2fe1bf58ed6499289c42b189ea3bf0f17f8fede0d3ce9087c8b3103da25dc705de9feb0d5b7bf10c91ed3f13f242db7
SSDEEP 768:hj+9x3E6DZIO0UiAlNzc4ReyIsPWb9MoF:89x3tltc44bs+b+oF
TLSH
T155F2BF32AC258DA3ACEA5746B60736D3BEF5153B82C52E84D5DD9F0C09832EC175B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 60546bd5905ca44845b8761152f0b4eb06b82b6281eb77fe87a71c26d678450d
MD5 cfdc41398d7a02d1e96b78630621eaa4
SHA1 b2b862e074d09fb4d6902add06fb1e56309adb0c
SHA512 3acc7243c2476ea843cd357570f0bef0876d9d64ef637108dd61d4245f82ac29b799fb1451dfd810b6717dd4681ca0747ad4f78b911fde50494d586d664e14f9
SSDEEP 768:rj+9x3R6DZIO0UiAlNzc4ReyIsPWb9MoF:+9x3qltc44bs+b+oF
TLSH
T157F2BF32AC258DA3ACEA5746B60736D3BEF5153B82C52E84D5DD9F0C09832EC175B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f44c00c19beecbe318773743f069ab5e6aac8b41ef0ccdab7d022d1d8c0b70c8
MD5 ad290357c7255b81d9d7ca5ec5bbe9f6
SHA1 0f7987feb8bcbc2f44d48067400cadb1004c36e5
SHA512 e309b635aa6bcb844a5a59f64528d5fb40ed554028a44c1c5e9985b5669a1aec4f0c212c6dbaf9120de31a68fbd61b689ac3d0a6de344e90554235de13e5755f
SSDEEP 768:rj+9S3w6DZIO0UiAHNzc4ReyIsPWb9MoF:+9S3ZHtc44bs+b+oF
TLSH
T137F2BF32AC25CDA3ACEA5746B20B36D2BEF5153B82C52E84D5DD9F0C09832EC175B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b7768d4580dae942bee695af5107150f409bd9f76f2a711aa4a5486245ff0bd6
MD5 86ad7c4796c68a0bb7c1d5c6d590baf5
SHA1 328db21a26112baffca3d5e69a3a9c9a09766a43
SHA512 ab8043d722c60596c6b37724315f6b6bff29600d6fdcb5cca4df005f81cc089c3fdd4e990da463fe85d8713ee3f1f9a52af48177b9ebf0ac81f1a656c40a573f
SSDEEP 768:6rv+4UNbds3KBDZIO0UgNzc4ReyIsXpeVH1S5D:6bsbS3vtc44bsZEH1Y
TLSH
T10103CE32A8788A73ACF66686B547B6533EF8512782D81ED4C4DE2F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 18dd94b91f0c96e438d082241830ea4d480d99d1e485dac4f152ed5924f1b9b3
MD5 9dc7b4e184c8ff32c2832e4eea007d45
SHA1 8542b39df8171a84c85bd02a318457e1b8f13537
SHA512 df9beb6d20b2f7287f4dbcd14d45e63e6a6853b87f4db14349a8412483a8dc3670878b317bb7e52762f6f61c9f4a5a41d6e971bac4a798e841e9cd13edf24261
SSDEEP 768:bF1j+9m3CwgpjZJ5O0UiA5Nzc4ReyIsPWb9MoF:69m355tc44bs+b+oF
TLSH
T1A7039D36EC25CEA7ECE75786B70A7696EEE0117782C86DC4DAC99E4C04871ED034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

3b81a03d-e132-4742-b6ef-8cf86e549376.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b81a03d-e132-4742-b6ef-8cf86e549376.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5AA9.exe

Path C:\Users\Admin\AppData\Local\Temp\5AA9.exe
Size 12KB
SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
MD5 362fc53afbda6450184b73746802a6fa
SHA1 4c289f978c4c464da05cee4c33101ea7f5291d7b
SHA512 d137b29e9a9ae7ec47dcdb6733e618566cb66d910e33058c5681b61cd3ef0d07e346d4cee19f39c0e1e6918215bb5281caaa5fac204156f46b37c2b63e1b7c81
SSDEEP 192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz
TLSH
T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1120_1714237526\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wargaming_game_center_s_install_na.exe.crdownload

Path C:\Users\Admin\Downloads\wargaming_game_center_s_install_na.exe.crdownload
Size 4.6MB
SHA256 8d8b3f5309fc977bac2124cf12e93745d4ff1846a0ef987867164a734d5c6522
MD5 97e49140e2ea9f6ae30dfd25dcee9e47
SHA1 550e67b36be07ce39f2d007d7b3cbf7973e65cd2
SHA512 e68ca9dd524282065f9c0beba63c6d15163cfec8063fa40f6dd3d3d4238d73c4cf9f95e1380ffb509123a18c5a13a3aae80180b3429ae2245d4a9684ba907c72
SSDEEP 98304:Sr3ei7om95WvhmXJThI4IqrrTyboYHBJELwq22UnT1he/YfS1:Sr33r5WZuJThI48VhqLwq9wne/wu
TLSH
T1B02611C3A940857EDD5DCB3E07E76332A63E6C211BE07D2A2D813A0F65B518A3C7865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download