hxxp://dwrapper-dev[.]herokuapp[.]com/beetle-cab[.]cab

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dwrapper-dev.herokuapp.com/beetle-cab.cab
Sample260716-ml1b3aev4v

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4416	7za.exe
4060	7za.exe
2700	7za.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286716506682267"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{11BB3538-0B71-4D4E-AB97-AAFBB8C88472}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	620	7zG.exe
Token: 35	620	7zG.exe
Token: SeSecurityPrivilege	620	7zG.exe
Token: SeSecurityPrivilege	620	7zG.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
620	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4880	4448	msedge.exe	85
PID 4448 wrote to memory of 2152	4448	msedge.exe	86
PID 4448 wrote to memory of 4596	4448	msedge.exe	87
PID 4448 wrote to memory of 4596	4448	msedge.exe	87
PID 4448 wrote to memory of 4596	4448	msedge.exe	87
PID 4448 wrote to memory of 4068	4448	msedge.exe	88
PID 4448 wrote to memory of 4068	4448	msedge.exe	88
PID 4448 wrote to memory of 528	4448	msedge.exe	90
PID 4448 wrote to memory of 528	4448	msedge.exe	90
PID 4448 wrote to memory of 1284	4448	msedge.exe	91
PID 4448 wrote to memory of 528	4448	msedge.exe	90
PID 4448 wrote to memory of 1284	4448	msedge.exe	91
PID 4448 wrote to memory of 1284	4448	msedge.exe	91
PID 4448 wrote to memory of 3364	4448	msedge.exe	92
PID 4448 wrote to memory of 3364	4448	msedge.exe	92
PID 4448 wrote to memory of 3364	4448	msedge.exe	92
PID 4448 wrote to memory of 1440	4448	msedge.exe	93
PID 4448 wrote to memory of 1440	4448	msedge.exe	93
PID 4448 wrote to memory of 1440	4448	msedge.exe	93
PID 4448 wrote to memory of 5108	4448	msedge.exe	97
PID 4448 wrote to memory of 5108	4448	msedge.exe	97
PID 4448 wrote to memory of 4528	4448	msedge.exe	98
PID 4448 wrote to memory of 4528	4448	msedge.exe	98
PID 4448 wrote to memory of 452	4448	msedge.exe	99
PID 4448 wrote to memory of 452	4448	msedge.exe	99
PID 4448 wrote to memory of 4388	4448	msedge.exe	100
PID 4448 wrote to memory of 4388	4448	msedge.exe	100
PID 4448 wrote to memory of 4388	4448	msedge.exe	100
PID 4448 wrote to memory of 3800	4448	msedge.exe	102
PID 4448 wrote to memory of 2404	4448	msedge.exe	103
PID 4448 wrote to memory of 1772	4448	msedge.exe	110
PID 4448 wrote to memory of 4704	4448	msedge.exe	111
PID 4448 wrote to memory of 2404	4448	msedge.exe	112
PID 4448 wrote to memory of 1100	4448	msedge.exe	124
PID 4448 wrote to memory of 1100	4448	msedge.exe	124
PID 4448 wrote to memory of 2076	4448	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dwrapper-dev.herokuapp.com/beetle-cab.cab
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc1aaac188,0x7ffc1aaac194,0x7ffc1aaac1a0
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,17032093003450739078,5983116685142711406,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,12453776877819483014,2300365312857710495,262144 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,14948450418017241951,15288850451901336401,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6661627262203113624,13098672619006382671,2097152 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13974853333413971145,6540606628648946450,2097152 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17362331616539028717,6913974997190402427,2097152 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,7836746976000137073,2379329532648089214,2097152 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12192304153913979732,6513736518623604933,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,13503625632976575926,14201336840093035033,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,13474655218593835140,15204558597586487627,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5720,i,14924920506194842065,18129395316976345763,2097152 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,5647104614887389966,16143173999661361913,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,5647104614887389966,16143173999661361913,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16576509489664198186,11652697940980811971,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,3708301475775674864,16260750263683250097,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,9039910414578015892,2666113452503663948,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16027238142017577122,13895020534358604404,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=1560 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,2908906129769964837,15498709321536299747,524288 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,13345584258850111474,3877284552954369384,262144 --field-trial-handle=2340,i,3342544866454154988,11126177744902178809,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3076

C:\Users\Admin\Downloads\7za.exe
"C:\Users\Admin\Downloads\7za.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4988

C:\Users\Admin\Downloads\7za.exe
"C:\Users\Admin\Downloads\7za.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:204

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap14205:82:7zEvent16107
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:620

C:\Users\Admin\Downloads\beetle-cab\7za.exe
"C:\Users\Admin\Downloads\beetle-cab\7za.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416

C:\Users\Admin\Downloads\beetle-cab\7za.exe
"C:\Users\Admin\Downloads\beetle-cab\7za.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4060

C:\Users\Admin\Downloads\beetle-cab\7za.exe
"C:\Users\Admin\Downloads\beetle-cab\7za.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0bae149c6695738eae56dccc0c94caea2ba1728cb1748263bc342c160c1a3fc7
MD5 d5d0dace6d29a9497032f6449cb45975
SHA1 c19114be8d1ee423d1abf2d76d22b36e1cc3c842
SHA512 63fe1973d4b36019e24f667d8e5746824c16f43b1cb43e041b3a52eab45547325eb524d46b672fca3d9a5128ae332cccac99623d5f8f975624a832a098ad0858
TLSH
T182618219194E14B5F7611B31E4C20600F9B053B90EB72ED336F8D97EFA2EF23802555A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e9c.TMP
Size 3KB
SHA256 4a398cf4b08bab4608c1b215b63102c46551875e69d9dcec15a23d02ecf5a397
MD5 45c13dc73a3a1e67860ba37369dda223
SHA1 b80020a1e3bd6b63f85c9e02fe3bbc6559d1af16
SHA512 dec51e84e085ed35b081f1a9cfc71e3cfdf2705e3373e78bc19499424f8bf4022c72d1cb8bef722112983c812daaa4b9533791b890e9b6835b4ff88b01892bc8
TLSH
T1CF618119194E14B5F7611B31E8D10600F5B042B91EB72ED336F8D97EFA2EF23802555A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a1c7239ec44af4dc3175571d624806adb3e0e39ec09d907e98d1f8fafd521c3a
MD5 8aa94de4ec2da0443de9ec037c02d708
SHA1 9c33c4e4ef7e49ad1fb29f8321fe7e03db623e64
SHA512 3d1711f4b4a2a2909b3974dc40bd16fbc0ea030607b3f282636ab6e0f418694b0df624cb750fcbeaadff78e56659aee4c1fc6fb03946a4c05aeac472a9b56176
TLSH
T142117DF3C3E585AE890116F06A24EE2BCE2D0905431C7C15CAD4EF1B93E34B9E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 108248f3603f9b506dd30b42360e06def9b3e86edc014012eb7dfbc0cac6ead8
MD5 47df5cd1203b75800ad5241e1c43e17e
SHA1 e0cdb9977e15b4c469045dc2b7e2ae449ff73436
SHA512 70440ea1b4ec99aafcfd2cde7638c7c6470c70da637ea9493c344f318e58d2d1eb3d1e807c643f5858893e88a64e88814831affe0aed5951aa6250f54dcc9ad2
SSDEEP 192:sxZeRcyM/jK1Ml8M9H/f8scDdEIdpJHW6+WNGYLlTV6IgrJ:sxZe61H/f8scDddJHbGh9
TLSH
T18B42D8156A345977CCCBD209F955BF53D6F90473A2900E48AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3c70d66b4c46d9b2980943a877153d485769e3f8b53471bccaeca8496a35f1a5
MD5 f564389bdf8ac0124acbf4260f072994
SHA1 a8dd4a7bafc160ecac8874cf4583956cc02ec6fc
SHA512 b03996364d5abf765b845100d651686c94c68732abe853fa3b8f328980e4cc1e83c7618191e57bfe297a5fd3d3a4eaae6dac2ea6253a4833007005416742cd88
SSDEEP 192:sxZeRcyM/jK1Ml8UQ6jH/f8sX3dEIdpLHW6+WNGYLYoC6Ig5hJ:sxZe6qyH/f8sX3ddLHbGuJ
TLSH
T10452EA166A345977CCDBD20DF955BF93D6F84473A2500E48AAFCCA0C05E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 747c74819cdb89f8f7890c4a0b65ab1ca9dfb297c8b14b3e00e4605ea4515e6a
MD5 ac9f3a622fc52b9f65fe8aa3b95cf788
SHA1 ea24ec52133fb432f3543d701260f2f9948389dd
SHA512 f26cfa2734bb130ef60b7dbe86bb00ee3dc62700470d21f7e233ddf0ceaa4d17f0ee4f7bd053f6f5078932b8f795493e300d812e3b22f6cd9500af180e599e2e
SSDEEP 192:sxZeRcyM/jK1Ml8MjH/f8sX3dEIdpLHW6+WNGYLYoV6Ig5hJ:sxZe6bH/f8sX3ddLHbGpJ
TLSH
T1BE52FA16AA345977CCDBD20DF955BF93D6F84473A2500E48AAFCCA0C05E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 233b4acce38c0b8d302f9226d46ec54a2368ec6519aeb8289930be3df102f67c
MD5 a626513c56af3128935534f759b66a5f
SHA1 4b4ff6df83fa6b3c0eac8e349469b201877611cd
SHA512 db1607ef214644dc471d7307f51432bc00916d133089babaf5272027881df96d3de36b6df2ff88cd81abe06a636b2f20fcbe658006f24b4cd88b920433b2bbc2
SSDEEP 768:gms6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNHro+r:gms6pD1WvxzWju1jahILIsNU+r
TLSH
T18DD2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7360fec9cd8eab86493dc2dae6e93d0735526f42d3e03dff8942d52075f0dd07
MD5 e89586bbc692c40ba30ac51934cd6aa8
SHA1 fd651d35cbcc1e288b2f77a78d72ecbbef53d294
SHA512 66f23376a6e95465b0b28cf1e3307a64a37fe6e507c49fcb29a9951866a733868d0388cfdcf5992068fbed0c1d5246b5d942222e320086368beace8e2149c36d
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFzIVKwEfyI/Kva4bytLIxK8IMAz:KUAAKteP+zWKwEfysKva+OLeK8Ijz
TLSH
T1BCB10602717703123D7E2908A29997265F82B6633418F42B77AD00B25EABF344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 ae213262eee74cdf8592ca7200e964a0b54e75400398eb357573ef1ec71e94cc
MD5 e9b8eb7e5b2bc96160ab88d58945d673
SHA1 8a1dda14353d9ed9a25fee83370cc422480af057
SHA512 fcca518cc79a98ab40eee1b96a0ba0c2909920d059933d89f1b837f8172477fc4aae23a349a3ad94b468fbd2892b6427cadf37c509d5a0e7c9aa51df8bd842ba
TLSH
T1952173C0A3A990687EC9B841C12D5D03A9E5BF276B0E9832235F48F46F4CC260E6E971
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593c73.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593c73.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 07f38ce36da00b2c5c7ba103ded8eaf0b8e4737adf3191950ec1d720ffa720de
MD5 0ecd71d402d908b4530282a089f71f66
SHA1 d767b201a7961f887a7d2be39a7159fd524db793
SHA512 04c3692ea9db589abe6815503b22cdc2c68db4d5aaeb7195f26510e79f4a56f4e4b3ca8c09b09b36a4f97c78c7d1ee1a81c5190ed485e8a98069187e81c23ae0
SSDEEP 384:otNn/s3n9SQsN7p4CWYba0Ya9sO7SBENOOObjI9G6w7d:oj+9PvT0BiO2CNO29Md
TLSH
T1A9929D36AC285E774DA38145F947361B9FF881BBD3892F84D5ECAF0D01DB6AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1303ce70216c2c59e68a1190601cef37f0d1e3d5ac09923b360b2c2447705550
MD5 5b16cc00870cdf8e385190a3cbbb6ac2
SHA1 521b4a02135169098cd4a5da2bdc0261618f2336
SHA512 bd33079c9982d8e4dd0b9213264dabb14ef27b3b374b319501f80277acd361990b23ffe5273796b5d19d2a8e599eca0e488913299d9c8e9ad4c891d86b219b9a
SSDEEP 384:bHiFLtNn/s3n9S/MsNF8TUNTUlIl04CWY1a0Ya9sO7SB2NOOObjI9G6w7d:bCFLj+9z8wgXd0BiO2gNO29Md
TLSH
T1ECA26C3398588E7B9DB38A45FA4B321BCFB941B7C6856E94E2DCAE0C01DB5AC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8fb1415c734187e0abecb77e6b32baf427305fc183587b85a96242747c4ebbce
MD5 26b09bba2776221e941ce35c6ff42024
SHA1 0dad26d599e9b86c87b9c0dca92bf072405bba55
SHA512 a2884b8dc949180797ad119168c4397a5932a390dc1b68dc6a2b1ab4f7ea9ef2c6ee556c4fd4ff3f35e1a89280e95d47496a26a4170f2e3dd488274e1bb8b64a
SSDEEP 192:qONp6O7+3hQmiUyyoZhGttb0RO2osgGN4fU6:qONp61ChGt9sO7CN6U6
TLSH
T10D020A39686C6CB79EF2AE05F68727179FA5113BE9962F40D5E81F0C00D765C2343822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 076a17dd32d7ee5a156b28a37b153b0cf7ea5ec9f31c86888f7d1f3ece9864c4
MD5 561caeaf589dd4eda6a7725517a9cb03
SHA1 ef203da4717134ab5cc0bc2372debee52ec04af6
SHA512 5def2e2386b39a8dcf81168a7f345fb586b0df33e1c13542855eb6a7aefbf0bc45da20e10f59965d2f951fb16c63a36e45fd60af7f54cd50f53e18995d712fbe
SSDEEP 384:vtNn/s3n9S4sN704CWY1a0Ya9sO7SB3NOOObjI9G6w7d:vj+9/od0BiO2ZNO29Md
TLSH
T1AC929D36AC285E774DA38145F547361BDFB881BBD3892F84D5ECAF0D01DBAAC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b93080d34316e4ad59b26b2588d6ded059c0bdd5e1185d6cafbe448d4ea04786
MD5 34aaf13df6807e93e36072defc249991
SHA1 45e73e944618c1b9c96ba70a44ef339a3c729430
SHA512 273b67557976afb0eea753d01e8c2bf7e7398844f0f2c29a881c2e6f1dc9dbc68889947dea7996e0742ce796ba285bc79c02536bdd985f703117396bfc180b0b
SSDEEP 384:gtNn/s3n9SQsN704CWYba0Ya9sO7SBENOOObjI9G6w7d:gj+9PoT0BiO2CNO29Md
TLSH
T14392AD36AC285E734DA38145F547361BDFF881BB93892F84D1ECAF0D01DBAAC1306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 da5080c6b81c3042093515c5c5ff0a615d01634340e02ed36b05efa3e51570ec
MD5 74d331cff4c65e823d6fb116a3892ff9
SHA1 913b2189bac51624d755b66eaf5598d59ac05e9a
SHA512 c3bf2c8274c66fe71a5ea0da161d7ce8ed0cfa3c04bf9b71c61a17084080cf8d50d95bf7ee32be2a2a30199aa0319c04bb761521569eb05c76fce4a788b58c34
SSDEEP 192:RONm6O7+3SQmiUyyOZhottb0RO2oSBtcNNPqUEU6:RONm6kUhot9sO7SBKNOU6
TLSH
T1E3121936B868AC775EA2A545F98732178F694137EA466F80D5DC2E0C00EF9AC234A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

250e03e1-d47b-4fe4-9938-eeec5921af20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\250e03e1-d47b-4fe4-9938-eeec5921af20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16bb79a88fef58893e3f6dc991607b33ee148891609481627aa075b68c6c9e8a
MD5 e4985e4ff49dcd7892d8740f7963bbd0
SHA1 78eb20e58601dfa40d42f076aa9fcefbdc448926
SHA512 b8f85a747f1537ccc304451bc3c0d3752b074dde34a45a6c61a21571f45151e392ae22af7d739e99263066af0bf31936a8115189f4b1765485fae02fca87eda0
TLSH
T19841295DB6F91108B3B36F569BF6A8AE487AB9362F07D45E10110E4F0A32B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

beetle-cab.cab

Path C:\Users\Admin\Downloads\beetle-cab.cab
Size 13.1MB
SHA256 bf0a5efb3d84fa52938ccf45d84483386606204b4f6473cb9030b53baf7b1ba4
MD5 64d612286675052142ea0f1b764fb461
SHA1 c1bf827dd9bff1309cdc014f7c008cdf77532562
SHA512 3ad54f0d68f2e7b4493f307c2031b4f0b37a9bbb61387f3079b4374fc4c9e8ce346bf5f6dbe40612d8af02acb6aa9aaa29490cdeeb90259b4dda536bb766498e
SSDEEP 393216:ykC5RTCLfUqwxGPPmoDFYJbFFyC1+JdIivLDb15OINzxoNf:yJv6fUqgpJ1+5LDJ5OITef
TLSH
T1DAD63321B7F5D0BBD2022231D61D3BB596F983490B2489C76380DF6EAF355E1CA3A51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\Downloads\beetle-cab\7za.exe
Size 796KB
SHA256 ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
MD5 90aac6489f6b226bf7dc1adabfdb1259
SHA1 c90c47b717b776922cdd09758d2b4212d9ae4911
SHA512 befaa9b27dc11e226b00a651aa91cbfe1ec36127084d87d44b6cd8a5076e0a092a162059295d3fcd17abb6ea9adb3b703f3652ae558c2eef4e8932131397c12d
SSDEEP 24576:HWdp+y7/ya3yc7tfBA6rDUzfKrBxEATB:up+fa3rLA6s+/
TLSH
T177059F227BF5D077C25211328A1C7BB691F9936C0B2448C763848F2DBB719D5DE3A92E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download