3ed47d7604f523b798e0923b6e12c840950a80d457f64e2854d45c8823bac735

Analysis

user interaction
yes
max time kernel
33s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HelixLoader.exe
Size 156.0MB
Sample260721-bjs97aa17q
SHA256 3ed47d7604f523b798e0923b6e12c840950a80d457f64e2854d45c8823bac735
MD5 fe23cfcbb32b05ccb459bf01aac04a79
SHA1 c5168fe91b6f23dddb5ef807487538db7232619e
SHA512 720e3040591b695100a291516caf391d15caf46a831592fd926276bd43bc5d94af0da9f87b3cbdafda15d3899ddb29e58acb5533d1c0bc16e501ea0273073be8
SSDEEP 786432:NuMLFmx8OA83yg1Yg1WV5OtsFktaPxNvsCMTc15jZjX0DRy77fmk:N5Mx8VqHFWqAuCOc15jBvzL
TLSH
T12F787C1163E85A05E27B8678977382A1E6B1BC535711C1CF0494FE4E2F73BC2AA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5616	HelixLoader.exe
5616	HelixLoader.exe
5616	HelixLoader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	HelixLoader.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3536	msedge.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 3536	5616	HelixLoader.exe	90
PID 3536 wrote to memory of 1356	3536	msedge.exe	91
PID 3536 wrote to memory of 1196	3536	msedge.exe	94
PID 3536 wrote to memory of 5324	3536	msedge.exe	95
PID 3536 wrote to memory of 4372	3536	msedge.exe	96
PID 3536 wrote to memory of 5324	3536	msedge.exe	95
PID 3536 wrote to memory of 4372	3536	msedge.exe	96
PID 3536 wrote to memory of 4372	3536	msedge.exe	96
PID 3536 wrote to memory of 3704	3536	msedge.exe	97
PID 3536 wrote to memory of 1780	3536	msedge.exe	98
PID 3536 wrote to memory of 3704	3536	msedge.exe	97
PID 3536 wrote to memory of 3704	3536	msedge.exe	97
PID 3536 wrote to memory of 1780	3536	msedge.exe	98
PID 3536 wrote to memory of 1780	3536	msedge.exe	98
PID 3536 wrote to memory of 3856	3536	msedge.exe	99
PID 3536 wrote to memory of 5876	3536	msedge.exe	100
PID 3536 wrote to memory of 3856	3536	msedge.exe	99
PID 3536 wrote to memory of 3856	3536	msedge.exe	99
PID 3536 wrote to memory of 5876	3536	msedge.exe	100
PID 3536 wrote to memory of 5876	3536	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\HelixLoader.exe
"C:\Users\Admin\AppData\Local\Temp\HelixLoader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clerk.helix.peretas.live/oauth/authorize?client_id=DIqaZ6a2ZZohqLtW&redirect_uri=http%3A%2F%2Flocalhost%3A5566%2F&response_type=code&scope=email%20offline_access%20openid%20private_metadata%20profile%20public_metadata&state=helixloader
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff8b8dfc188,0x7ff8b8dfc194,0x7ff8b8dfc1a0
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,7557259882059088952,16419546103606778136,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,15846408110725171381,4410732561984122434,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2080,i,17446258931696680848,11666755465609624682,262144 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,11858036373017396674,6091500446727937459,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,4411995841670310254,7340363679605185891,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,14182455641647847044,15762243161426417207,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,6382332246133265867,1315093835394350048,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,236039085866544974,2354181087933179067,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,2125032627845728634,14654378622296866804,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,18367232249614849417,5296108361455867030,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14400983202295570889,9860508590033171616,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14400983202295570889,9860508590033171616,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6156,i,5027419782577813930,5089182154721209774,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5744,i,8943527747445084470,16286529660690006133,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6288,i,3977676274671964525,1836101263019636426,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6920,i,7282694082326191444,9268220269202998031,2097152 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,14822814778642647919,12096628191042892523,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,4529587726574945614,10191868241427037060,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,4688747665078488470,5501472413778053856,524288 --field-trial-handle=2692,i,4877881854641584556,16413004672808266712,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
    3⤵
    PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

9e36ed70-350f-48c7-8768-730ea457f404.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e36ed70-350f-48c7-8768-730ea457f404.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 370290343d438ad0ed91d7d88969d6e9e3a5c351e16eb368e481866d83faacb5
MD5 1a6320d46758973b061ccd4ec7071bc4
SHA1 a33516802ecd906c5d631f0af26ff0854280773e
SHA512 e9b21e0322ec575864e4260d4a9d0a9870891a1ddfb7d79dd6670bfc673340c09be378f94d5ae2ea6878e883842d680fc56d1ee7691871c8cacba50cb57a8425
SSDEEP 192:sxRsrCV/fgsZqhDzyzwwG3zoA8pul+/g6+WN0Ul/z6o+CYulG4yIgDUJ:sxRseV/fgsMhDhpel/5J/b/Ss
TLSH
T15542A65A6A289D3B9CC6D219BA65BF53E2F95032A1D42F5CE7FC8B0C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0adc348ae5970a469b351f28607e5439b15d99a279bcee4f79fd2b5e4fa6de65
MD5 b6517edb996089612c36573cc1a74019
SHA1 6cd02b2762c278b09166c92715d7cad9b6da107e
SHA512 f9bd4770481fc4564754423c7cc253f7cbd94eb759a3483d79c8e68c0563a188d9b9822f0768e8915b03265c83dcd1cec986348f6dd8148e34491322ebf61ef3
SSDEEP 192:sxRVrCV/fgsQ4hDz6zwwGkzoA8pi/g6+WNIYoPCYulG4yIgFJ:sxRVeV/fgsphDppFi/5Ia/Sv
TLSH
T1743285166E28A93B9CC6E21DFB65BF53D2F95032A1D42B58E6FC870C04EB6DD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5d51dae7588fbcfa5594720cdfc9933c9fa4b272ebace4937ce12636df8dc5f7
MD5 141072ec5b3dadbf2415c084d8eaac3a
SHA1 34abd752348952b8d0edfd9a0480f59a9a0d85d2
SHA512 bb484b3fc34482e97ef6a7bef362f6fccf92451267fc0e20ec51607b811c7b0bc0b2c27378cf5703fdddf1c5926a787eaf4b998f1c551b070c0b47cde49ae348
SSDEEP 192:sxRsrCV/fgsZqhDz6zwwG3zoA8pulr/g6+WN0Ul/YoBCYulG4yIgDUJ:sxRseV/fgsMhDppeU/5J/k/Ss
TLSH
T1FB42A55A6A289D3B5CC6D219FB65BF53E2F95032A1D42E5CE6FC8B0C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b1314e160594fbad1b0d15a07e0a49886a4e1720f84d06dc0fbb2d7d6b51f950
MD5 fda30a3f600a5625e079d1c0c1bebe3e
SHA1 59ba102a915ad653d31fba3362c47c15a02aca45
SHA512 a5aa4a82267ca0752a35abeeb084769fb86c396b0b579ac9aacc4d6663966a6623d5efdd5e9c7f409771fd5a2d8f02e5a5f54341ab7467369c0155ea23ca9118
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVvVuwXro9Ze0Urh:j26HRUE7MRWgs2f02u1jaO4wEAh
TLSH
T1D9C2DB6B740DCEBE4F800ADDDC297E9F6D6802CB9698CD8047FE951C02C7BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 dfd0061a0bf75ea7a3b9c029ce34afe239d3405ab46c8354b173eb1b21f4329b
MD5 37209daffc9d4a6fb79af8a5d4b9eba2
SHA1 f9d66ca91631ef7f4465eec686283597b1e04ebb
SHA512 ebbf02d27ed12dfb24799bc13c1b1698ec34ced1061061f86042b56050293d7cc2b7f389642319487927d486a638cea376e3996bec86afcf514313a6885dd213
TLSH
T168211058B1B76640783D2508E1D4EC9792C2707EB014A46B3FA830798F27E25ECFC5D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b287d6b4fa36ec84c4d4ca5cd0b6865116fb1f61917f82ddd021b7d30cba221b
MD5 609d0e1e50235d2b5482558de4b8792d
SHA1 16e6d0345503179db040715538a0de083a33f23a
SHA512 b606c0a54093bfa500bd6dfaef365c1f6ac2561c289daddd4cadd6ed92f4a06346ba733a749ee631a3832a57453a96902fe59c7cf54b8eef3334341b9a1d8bbe
SSDEEP 768:Srv+4UNbdz30//TBOWT1a5NONXyer1IRCzni9beVH1SK3:SbsbV3gj6NSIqnUEH1R
TLSH
T18E03BF31A5A8DE334CE6A3D5B047B7837FB82067C5850BA4E9DA1F8E059758D230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 611eca6f3b646b824174a614af73501bcebf820b9c9bdc92ffd1ed95010d90ac
MD5 ac94a1870bdd0f9331203576cc5fea92
SHA1 f3eefd45bbefe05256d846ee3bc0c71002e1da4f
SHA512 a98dc4aa61f834a34c1739945d6ca86f5aa1f58987afcd9323c22faf4b6d5dbef43c08d013a057b0bc62673944523c40297a39b6a89758ae4e086205e4618563
SSDEEP 768:hrv+4UNbdz34t/TBOWT1jONXyer1IRCzniB9eVH1SK7:hbsbV3SjjSIqniEH1l
TLSH
T1DE03BF36A4A89E338CE2A3C5B04776437FB86057D6840790E9DE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5097b956cbf73518a60514dda8fd8b13c9993952741c4e0d8d7f340f3ae930dc
MD5 b85384a8fe626aa34e1b43c080368dc2
SHA1 d0b2d5c12044bc92ae82c18d2580cc45b5f97e84
SHA512 ff63ff5cc42b1ef5a1c606466a4fa8444aa831409eadd1064a1c3fc057c7bf4eee1f0473ba206b26de068dc155db83f20c7eb0893f17f6eb68cd7741f6b40f17
SSDEEP 768:0rv+4UNbdz3Clw//TBOWT1a5JONXyer1IRCzni9beVH1SK3:0bsbV3Cuj6JSIqnUEH1R
TLSH
T10313BE31A568DE334CE6A3D5B04777837FB82067C5800BA4E9DA1F8E059759E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089b9131-6c76-45fb-b2e9-cfbcc9fd4d02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\089b9131-6c76-45fb-b2e9-cfbcc9fd4d02.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\HelixLoader\-CBXJZUOZnwn\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\HelixLoader\-CBXJZUOZnwn\PresentationNative_cor3.dll
Size 1.2MB
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\HelixLoader\-CBXJZUOZnwn\wpfgfx_cor3.dll
Size 1.9MB
SHA256 cc40e27a3a7e14dd4a8c423081fa367406e093be1dc79759e56d828e140bc014
MD5 c0a4429e4c59b9b4487c570ca92cd312
SHA1 2263d4e13f507225964c53588a32af0734a7a13c
SHA512 d5ae03a6d38880eb1eb19dda5e8b3e110f2ac8df46f668b4736055e34f4680f6a679db3b236311829cc1caac951a147d6f1c2b473f6eda245a764bd4844d333e
SSDEEP 24576:15AzCIrGoleR+kYpETy2yS2Wfb6stIyHXo9HSTt4Myji4sfm/FP9dZDNQJg:CVvcR+kYyrybWbISyHSHyjiffmTlMg
TLSH
T1CA954A4AB6AC40E9C0BAD23CDADB461BF23174152761A7CF27A0479D6F27BD0097B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads