gh0strat | 94c5403d7fe6a1e3f399ddfc34895c47a38d0d48e539a2718eb3d90d1132da46

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 3.9MB
Sample260719-3dk56sfx5m
SHA256 94c5403d7fe6a1e3f399ddfc34895c47a38d0d48e539a2718eb3d90d1132da46
MD5 1fa29b46bdfcd2465ba8d951be9bc626
SHA1 c095b68970ded5fe418f421cedeea0c8e04a31c3
SHA512 d43e9cd99f70db2725c74eb8f5bd16cbb64aef1a3d921f2b646978008337d0bff000df5bb69ab6319766ca7d644224214aec51b67c942ba66b909ca095c57d09
SSDEEP 49152:YCwsbCANnKXferL7Vwe/Gg0P+WhxeRWORjsizxAoo7QrvgX5W64:zws2ANnKXOaeOgmhxejW37kuN4
TLSH
T117168C03B59548A5D2888170CE56C973EB207D6E0BF246FB3694BECA3E366D47F35224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4272-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4272-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1700-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4312-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4312-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4312-44-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-6.dat	family_gh0strat
behavioral2/memory/4272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4272-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4272-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1700-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4312-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4312-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4312-44-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/memory/4272-18-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4272-22-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4272-21-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1700-27-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4312-37-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4312-40-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/4312-44-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240718671.txt"	R.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

pid	Process
5904	R.exe
4272	N.exe
1700	TXPlatfor.exe
4312	TXPlatfor.exe
4268	HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1048	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
5904	R.exe
5756	svchost.exe
1048	Remote Data.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240718671.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4272-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4272-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4272-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1700-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4312-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4312-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4312-44-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_1386686800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_1227691835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_1227691835\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_755022928\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_755022928\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5036	cmd.exe
5364	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289770588584357"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{94594471-8065-4CD6-A9F5-D15C88408C94}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5364	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4312	TXPlatfor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4272	N.exe
Token: SeLoadDriverPrivilege	4312	TXPlatfor.exe
Token: 33	4312	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4312	TXPlatfor.exe
Token: 33	4312	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4312	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5904	3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	89
PID 3316 wrote to memory of 4272	3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	92
PID 4272 wrote to memory of 5036	4272	N.exe	94
PID 1700 wrote to memory of 4312	1700	TXPlatfor.exe	95
PID 3316 wrote to memory of 4268	3316	2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	98
PID 5036 wrote to memory of 5364	5036	cmd.exe	101
PID 5756 wrote to memory of 1048	5756	svchost.exe	102
PID 4268 wrote to memory of 6008	4268	HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	103
PID 6008 wrote to memory of 2884	6008	msedge.exe	104
PID 6008 wrote to memory of 1068	6008	msedge.exe	106
PID 6008 wrote to memory of 608	6008	msedge.exe	105
PID 6008 wrote to memory of 1068	6008	msedge.exe	106
PID 6008 wrote to memory of 1068	6008	msedge.exe	106
PID 6008 wrote to memory of 1356	6008	msedge.exe	107
PID 6008 wrote to memory of 1356	6008	msedge.exe	107
PID 6008 wrote to memory of 5828	6008	msedge.exe	109
PID 6008 wrote to memory of 5828	6008	msedge.exe	109
PID 6008 wrote to memory of 5828	6008	msedge.exe	109
PID 6008 wrote to memory of 2020	6008	msedge.exe	110
PID 6008 wrote to memory of 2020	6008	msedge.exe	110
PID 6008 wrote to memory of 2020	6008	msedge.exe	110
PID 6008 wrote to memory of 604	6008	msedge.exe	111
PID 6008 wrote to memory of 2232	6008	msedge.exe	112
PID 6008 wrote to memory of 604	6008	msedge.exe	111
PID 6008 wrote to memory of 604	6008	msedge.exe	111
PID 6008 wrote to memory of 2232	6008	msedge.exe	112
PID 6008 wrote to memory of 2232	6008	msedge.exe	112
PID 6008 wrote to memory of 5040	6008	msedge.exe	113
PID 6008 wrote to memory of 5040	6008	msedge.exe	113
PID 6008 wrote to memory of 4948	6008	msedge.exe	115
PID 6008 wrote to memory of 4948	6008	msedge.exe	115
PID 6008 wrote to memory of 4552	6008	msedge.exe	116
PID 6008 wrote to memory of 4552	6008	msedge.exe	116
PID 6008 wrote to memory of 2112	6008	msedge.exe	117
PID 6008 wrote to memory of 2112	6008	msedge.exe	117
PID 6008 wrote to memory of 5492	6008	msedge.exe	119
PID 6008 wrote to memory of 5920	6008	msedge.exe	122
PID 6008 wrote to memory of 5920	6008	msedge.exe	122
PID 6008 wrote to memory of 3772	6008	msedge.exe	123
PID 6008 wrote to memory of 3772	6008	msedge.exe	123
PID 6008 wrote to memory of 4204	6008	msedge.exe	125
PID 6008 wrote to memory of 1476	6008	msedge.exe	126
PID 6008 wrote to memory of 3188	6008	msedge.exe	127
PID 6008 wrote to memory of 4692	6008	msedge.exe	128
PID 6008 wrote to memory of 4692	6008	msedge.exe	128
PID 6008 wrote to memory of 4280	6008	msedge.exe	132
PID 6008 wrote to memory of 4280	6008	msedge.exe	132
PID 6008 wrote to memory of 1064	6008	msedge.exe	133
PID 6008 wrote to memory of 1064	6008	msedge.exe	133
PID 6008 wrote to memory of 4808	6008	msedge.exe	134
PID 6008 wrote to memory of 4808	6008	msedge.exe	134
PID 6008 wrote to memory of 3748	6008	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5904
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5364
- C:\Users\Admin\AppData\Local\Temp\HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  C:\Users\Admin\AppData\Local\Temp\HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://im.qq.com/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff806d1c188,0x7ff806d1c194,0x7ff806d1c1a0
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,6716621041962568498,9966148172390104184,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
      4⤵
      System Time Discovery
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15319411091263148557,14251958408997814279,262144 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,10421160049731130520,5663560841278802208,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,17795455931771394863,17836703499846007987,2097152 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4982177982924046394,1954576881741511177,2097152 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,13344091060695299752,460945760017711972,2097152 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,11896324770108778637,18022634513439513565,2097152 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,25833627507078,14318110049090158934,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,4323903454441283282,3019133274148875069,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,12117819507325120955,15312220113027358002,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,3381468522709362525,17191210385102700997,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5211151705225314496,4180668316046725200,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5211151705225314496,4180668316046725200,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,12306369362632621321,2963554754188602392,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13143373985714362757,14970627840099047044,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7486194534413182608,453720743564609817,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,12153882903731901620,11267832470995527375,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,1933168729199001270,11739378776356763776,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15295156284958890799,18153196675355094950,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,12070075418811740499,10690841878538645946,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,2652571990539598358,5207538509548009943,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6181339326132257793,17177086609959253087,524288 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,10763506035005994537,7842599454036337247,262144 --field-trial-handle=2776,i,9926680531375754064,6221183940463751293,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240718671.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1048

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "Remote Data"
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 491a3c8550b366e4fbe983fdde3dd99cf0713b145875055ceb3d6e22b4df4ef4
MD5 9864c26a7beb59f345bcc325ce9c89cf
SHA1 f900767c17bd976331d9880e8b3fb7fdc69eddbd
SHA512 c4a04a973d93e0dfe5469c13c60d632baf6b37a27a1b0b0f454f6779c907250e4ad4b315c99c4bcf7ad2bb95877823af8fa2fe5f2afc2efe7e28c2aca13f7c93
TLSH
T10C4173B08F3816FFDBAF45758BD21A5C7231885B331B2E172794AD704A853B7141011D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9544dcf08b687b327e26b01531373654ae00af61d9fbffa3b04546f426dedef9
MD5 f51964ef32344f12aef8181f854a8663
SHA1 fadb262ccc1e55a9961933b2344ac305fdd3004d
SHA512 1e5aed5c75d7b3b47687dd7b471c2a5790866813e9c52458bf70ec8d8de71f74bc28c239d71b3dee9117bc999070287ef977999c508f83d9e995a62f949443e4
TLSH
T12951B0F783F4856E8D0156F0EA186E2BCE1D0915832C7D5A89E4AF1B93F3871E18194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 829c9e2e8a36a29406a3187c46d549f890482b522c598b51f14314771b5e53da
MD5 269b7f8b05ddac84d2d8b3d490f12315
SHA1 69d9e275bd1f3b8539ea65deaf1db4f6a7dae155
SHA512 162fe79ca3b48ff3ee833185fbc5ccecc5311573f042e7065d9b4e14e68d1b1d055723a4673c2b78612ec6b738201212f800fea9822954ce233caa641edfda7a
SSDEEP 192:sxR0RjC9/fPsUyGy5ZvzoA8pZ9S/g6+WNXKQ9Yo9ICYmGZIgDXJ:sxR049/fPsUyGyXGi/5V9t4t
TLSH
T1A342B756AD28593B5CC7D61DBB65BF93E6F9503261D02E48A7FC9B0C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0c605aa5225d1b01d231e143b59d73ab39c8cd39c4b784b61666f92ad19ffaa1
MD5 772fa48889290c8ec100f97654bddf1b
SHA1 e30cac24d80c5b906fc40be065a6d146b3c3bed2
SHA512 27a9fa17c8712fc1e128e3ffd969b76304573d02e9a2231a68db00a5b3be1df19b3cec928ccb4a35055e650dd4a8d910a3f7d5d39cae75db28e9afc1a5704911
SSDEEP 192:sxRPRjC9/fPsyyYywGAzoA8pZ9S/g6+WNXkr/YoJeCYmGZIgtJ:sxRP49/fPsyyYyp5i/5g/T43
TLSH
T1D442B8566A28993B5CD7D21DBB65BF93E6F91033A1D42F48A7FC970C00E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fb0e276c82aa904a1ed305ddae2aeb7275f65282a49006c50ab2df234d94917b
MD5 ba30bde8a6752dc25d0249f63c3fe5f6
SHA1 38d7e83a62e2805c55a76d4b19f2b70a76d8ebdb
SHA512 f3a3db05178123513af77f5477554d033ca328dbc53d8ec8046d59c5f299c9cca05b40c76f496877defbbc809973f1d661c352ddeb3d5e39eae5dac382eba7e8
SSDEEP 192:sxR0RjC9/fPsUyYy5ZvzoA8pZ9S/g6+WNXjSPsVYoY6eCYmGZIgDFJ:sxR049/fPsUyYyXGi/55VV4D
TLSH
T17C42C856AE28993B5CC7D61DFB65BF93D6F9503261D02E48A7FC9A0C00E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 364208cae007aa853d3a6f4f2c5360ecdca4bcebabe9d6aee1a4db8c3abdd42a
MD5 4c7e3a781213cb5efea34a97a924ca28
SHA1 563c8183dddcce68c6047b8fde9bfd36f7826317
SHA512 a52720bd44a80621c14cbcd6a9006c9bd722e3441a92fd138b56553e6e4fde52b5c66e621c2d31edf2edaf39caca25325638150850a12ed1db80e61f057734d2
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVaVuwjro9ue0Ur8:j26HRUE7MRWgs2f02u1jaF4wQd8
TLSH
T11AC2DB7B640DCEBF4F800ADDDC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 909bda0a96092fdf30f136af493cb26de01abc1fa4e99d64d3f21b230a9e5471
MD5 9a02c77e531a1320415d5a8260b8cad8
SHA1 6c191aab831709a7dcbb3b2b1ce6f62716222472
SHA512 fe9a4493723e3d7903003298f27ee379b308399f6816bccc45ce873c7f7dd2974cfd3e5f289981fb1c6a3666bf504cb88437fc213b58d00e3d00d1b45b8aa6a7
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEok:CENE8EzEnE9EXErE+EzEoEHEvEFEugED
TLSH
T122A1E850B03A43C5393DB60CC4B88D5E81D2B896345DA5AB3BA40665DF6FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dba7ba181f2cf77d29c83b1d8ff84d1b04802f5c47720d8ede9d2a5a1e7391af
MD5 0efbe87fa733390f560e314ca0ad311b
SHA1 665d8f5fa70a25bd9ec42c2c58aea572fe58a453
SHA512 c43f978ef4ce0d604bc26dd69795629ae7981a5a3a56aca8689ccd177b5ea09e66ac9be12dd24647cf5418e8dceca11813274af9db6c8ce000558f7afad0d285
SSDEEP 768:Jrv+4UNbdX3BPax/TBOWZAG6ONXyer1IRCzni9ZeVH1SK3:Jbsbt3ysSIqn2EH1R
TLSH
T1DC13CF31E4A9DE334DE2A396B10773937FB8206785800B90EEE66F4D069799E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e6260f74b78483dac16abdc5c7311f1d21dbdeb92998fd8cca5d1110b57c5ff4
MD5 11af46177516cbef2d2aca3ad1065b64
SHA1 f72278877f7d10ab7120680b192742dea8ab9f87
SHA512 94e3a8adbef9e0347987de93b36b04ba94105e778094f17c3d51855564be1f9967f0a82128fb00e36a0c98b949a4f6c2f5788b8624868191f51132a60225fb99
SSDEEP 768:hrv+4UNbdz3r8/TBOWZAPONXyer1IRCzniBweVH1SK7:hbsbV3QCSIqnnEH1l
TLSH
T1FA03BF32E4A89E338DE2A3D6B14773437FB86057C6840790EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 82111c0ca857bdb89ec8913980adef096cb0e6957fe61111c46c762a34a1c31f
MD5 bb08f3cabcfcb3d3c70b21d4dd82a854
SHA1 e0144c06f2cfaafd5d260563199703e83c7f74f1
SHA512 99c8c9328660cfa2c1da012b1005e0b5532bcfbbb5e2eaef8ec22da2170b7f626f442e6247f91ab9d3d9b4800c572aea2f81b4b5f678a94479162d1da27cb2cf
SSDEEP 768:Xrv+4UNbdX3mPix/TBOWZAG6ONXyer1IRCzni9ZeVH1SK3:Xbsbt3LsSIqn2EH1R
TLSH
T14413CF31E0A9DE334DE6A396B14B73937FB8206785800B90EDD66F8D069799E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c67cde9e4bafc586d6495d2883331611a1a29e0c789bdc9903841406d0d23ad9
MD5 2c700205bd6570114ecc8f70529752c3
SHA1 bc229ad88f23eb4a0c395d6e01b7d66f3e801127
SHA512 6ac23dd9c69c72c88f011e31f67b78ceb6030a1c9ed2f6d8823b287577803ccaffd49c4d62a7ace2040c6fc3707cfc449d010441206b0c8106251f90c0ecec26
SSDEEP 768:3Fdj+9J33wgcPampsOWZAG1ONXyer1IRCzni9Zj:a9J3WCSIqn2j
TLSH
T14AF27C3AD495CE279DE297C6B3067797AEF4106785C85AD0EED92F4D00C76AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2f30e0fca93c53b8272ea8fc1e3ba3210b0b96c61cd6f5bfbef2a24767dbc1cb
MD5 320e8fcb7fc637f10f2a2564a74d641e
SHA1 26b0ad6dbf8bb281617cace79102e53344e43f9d
SHA512 205d6204cf196a0fde09a41837234c8a2f5487c72f6e35cde625293c792101970eb1c920878d8071c862e59c6d2c413f4ad9b9c723a1d38b702e5fe763ac3b54
SSDEEP 768:0rv+4UNbdX3lPax/TBOWZAG6ONXyer1IRCzni9Z0:0bsbt3esSIqn20
TLSH
T14803AF31E4699E334DE2A2D6B10773937FB8206785C50B50EEEA2F8D059B95E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 617bcd2426ef0a9d3c1a15a33c8219b77fdb4d1c0037c8b64e02930c987fb9bb
MD5 f1e717ee71a1aaca5c7ad6b00bd5317f
SHA1 50e7536fda78a523ad94bbfe61b1f6f6be9a1b1c
SHA512 e048089e7622534c34bf1b574be9662f2772421da596254a92e248ca6a7119be6c20f4bdf405fbff93d2134e07db72819cf7f328daf7d20177c77cf71bbb8e17
SSDEEP 768:1j+9B3kPax/TBOWZAG6ONXyer1IRCzni9Zj:A9B3jsSIqn2j
TLSH
T1B6E29E35E4969E234CE1A3D6B20633D3BFB8206795C11F50EEE96F4D05C7A6E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

773c0237-8f96-45eb-927a-c0e91760695d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\773c0237-8f96-45eb-927a-c0e91760695d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_2026-07-19_1fa29b46bdfcd2465ba8d951be9bc626_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 1.5MB
SHA256 5ad63ee9d22b2248e723e047ca3cef068e1308d1cec763ad6e63dfaa8cead7ae
MD5 5f5cea54da24c84f87e7fa041628c975
SHA1 bbf4618a0ff4dfa096847ec1cf5b41b00a2ce84e
SHA512 289eedf3980178f0f075a0c1b7fb04ac3c841ca54e9df8b2704f89d3cc5b89b1d558b8521b2f2b0bf6c0c3e8e897fac6c5c0bdef3caf668e024cd46d49297b3b
SSDEEP 24576:jWORCOsih3Fv9/j0dmwx7XgKmqA1WcC/DQC8P6fQ:jWORjsizxAoo7QrvgX5W64
TLSH
T1A7757C17F28948E8E06DD1748746C536EA617C520B35AADF06D07A1B3F7BAE42F39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.4MB
SHA256 25cabdfab27eb31d3cc36542566b953dffa119ab2735a20d4b2653fe166c6791
MD5 dfdb8435f84cedc5314b93b172782585
SHA1 fbe39efa8127cc3fa8714d2e933140698c3a7995
SHA512 f9205e2d3f0739e0278e96b3aa61d4e4af90db08a4c90ec60aac62f4a72c69553d91a84ed2117548e35c51f3ed31302f309aa3ec10d0c649ea322bf4c2770f9f
SSDEEP 24576:YCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHQ:YCwsbCANnKXferL7Vwe/Gg0P+Whxeo
TLSH
T1BBB58D43B55148B2C3C85671DE67DAF39B207EBE57F3027A7A88FDC93A342447A21225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6008_706000939\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240718671.txt

Path C:\Windows\SysWOW64\240718671.txt
Size 899KB
SHA256 f814a4c1f5cd2e1928a05ac0c21967588d7f6d05098cec18c12faf815e22b2d7
MD5 551ec43778b0fe1b03a6a18c2bf7bfba
SHA1 c8a22d0b7b0a2ff6df4e360ca638bfea51bbe70c
SHA512 5cc0af964ad29fd3cb1d25742aca52da2760884309042b534f46c3570a4477c8021dceea7feea82d8d760de3490125748dbaf8027b8812c38828efce155c8b34
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXz:7wqd87Vz
TLSH
T12A152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote Data.exe

Path C:\Windows\SysWOW64\Remote Data.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1700-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4272-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4272-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4272-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4272-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4272-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4312-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4312-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4312-44-0x0000000010000000-0x00000000101B6000-memory.dmp

Download