6ae54a64ce0f6e1103c5befe2118de9f28e72f1ff84f081f0fa5b9a50281323a

Resubmissions

24/07/2026, 04:35

260724-e7yflagk6w6

24/07/2026, 04:30

260724-e45qhaed826

Analysis

user interaction
yes
max time kernel
48s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tuff.exe
Size 418KB
Sample260724-e7yflagk6w
SHA256 6ae54a64ce0f6e1103c5befe2118de9f28e72f1ff84f081f0fa5b9a50281323a
MD5 542a3dfdb0ea8d36a1949731c3114e2c
SHA1 d0f057d2adf96cf35bda87be6aecebad117be5e6
SHA512 81b288bec283a4d8bd391294e080765db663c50bbd3107cda7dd50db5d41e62e2cae15d04183b9a0d65891e00cb012abda2d73cd860a19d74b3dadbb268f8911
SSDEEP 12288:YL75lT6oHlmRnKuNs4msbT0pBentabnbvg/ZUsZQ4/QBbAQxbDvbBbCbe8bxmb4Q:275hdH8KuNs4msbT0pBen7hYOZu
TLSH
T175947C26B69001BDD17B92BC4B5BAA05F636B44B4351CACF3BDC49A11F87AD09E7F210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tuff.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5652	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293413804372250"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{74E60CC8-EFC3-468F-B9FB-4659D1AE9BCA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4348	msedgewebview2.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4348	4528	Tuff.exe	89
PID 4348 wrote to memory of 3712	4348	msedgewebview2.exe	90
PID 4348 wrote to memory of 1912	4348	msedgewebview2.exe	91
PID 4348 wrote to memory of 1912	4348	msedgewebview2.exe	91
PID 4348 wrote to memory of 1912	4348	msedgewebview2.exe	91
PID 4348 wrote to memory of 1912	4348	msedgewebview2.exe	91
PID 4348 wrote to memory of 4464	4348	msedgewebview2.exe	92
PID 4348 wrote to memory of 3596	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3596	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3596	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 2512	4348	msedgewebview2.exe	94
PID 4348 wrote to memory of 2512	4348	msedgewebview2.exe	94
PID 4348 wrote to memory of 2512	4348	msedgewebview2.exe	94
PID 4348 wrote to memory of 2512	4348	msedgewebview2.exe	94
PID 4348 wrote to memory of 2512	4348	msedgewebview2.exe	94
PID 4196 wrote to memory of 5768	4196	msedge.exe	96
PID 4196 wrote to memory of 5652	4196	msedge.exe	97
PID 4196 wrote to memory of 4352	4196	msedge.exe	98
PID 4196 wrote to memory of 4352	4196	msedge.exe	98
PID 4196 wrote to memory of 4352	4196	msedge.exe	98
PID 4196 wrote to memory of 5136	4196	msedge.exe	99
PID 4196 wrote to memory of 5136	4196	msedge.exe	99
PID 4196 wrote to memory of 2492	4196	msedge.exe	101
PID 4196 wrote to memory of 248	4196	msedge.exe	102
PID 4196 wrote to memory of 2492	4196	msedge.exe	101
PID 4196 wrote to memory of 2492	4196	msedge.exe	101
PID 4196 wrote to memory of 248	4196	msedge.exe	102
PID 4196 wrote to memory of 248	4196	msedge.exe	102
PID 4196 wrote to memory of 2488	4196	msedge.exe	103
PID 4196 wrote to memory of 2488	4196	msedge.exe	103
PID 4196 wrote to memory of 2488	4196	msedge.exe	103
PID 4196 wrote to memory of 5068	4196	msedge.exe	104
PID 4196 wrote to memory of 5068	4196	msedge.exe	104
PID 4196 wrote to memory of 5068	4196	msedge.exe	104
PID 4196 wrote to memory of 3928	4196	msedge.exe	106
PID 4196 wrote to memory of 3928	4196	msedge.exe	106
PID 4196 wrote to memory of 1896	4196	msedge.exe	108
PID 4196 wrote to memory of 1896	4196	msedge.exe	108
PID 4196 wrote to memory of 252	4196	msedge.exe	109
PID 4196 wrote to memory of 252	4196	msedge.exe	109
PID 4196 wrote to memory of 5304	4196	msedge.exe	110
PID 4196 wrote to memory of 5304	4196	msedge.exe	110
PID 4196 wrote to memory of 1964	4196	msedge.exe	112
PID 4196 wrote to memory of 5228	4196	msedge.exe	113
PID 4196 wrote to memory of 5228	4196	msedge.exe	113
PID 4196 wrote to memory of 768	4196	msedge.exe	114
PID 4196 wrote to memory of 768	4196	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\Tuff.exe
"C:\Users\Admin\AppData\Local\Temp\Tuff.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Tuff.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4528.4832.6286553314393851223 /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView /prefetch:4 /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e6665fd8,0x7ff8e6665fe4,0x7ff8e6665ff0
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView" --webview-exe-name=Tuff.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,14968362516485534596,6589987630702524461,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView" --webview-exe-name=Tuff.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1760,i,14968362516485534596,6589987630702524461,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView" --webview-exe-name=Tuff.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1760,i,14968362516485534596,6589987630702524461,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView" --webview-exe-name=Tuff.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1760,i,14968362516485534596,6589987630702524461,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:0986cc0759838ce0d68ae467dba418ce4f7c2ca8 /prefetch:1
    3⤵
    PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,17739528262804846669,2155516285822149756,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,9313195363277192662,6390159793856869592,262144 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,17768317051198965606,10226028933677264685,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,17652778508348042473,18120320668168445321,2097152 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,16840627295475844899,2393540181572998610,2097152 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,4693603462716060067,9825196963986084093,2097152 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,1314572966223858016,12689368523615112645,2097152 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,8885896386708989021,4439447285622963662,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,4361887175497517461,12999382635141313337,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,10516369193299167627,10519149119661714510,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,3731490869215699203,12994223310181312356,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5071874788753989490,11017964731172304492,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5071874788753989490,11017964731172304492,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,568644206377672316,5968758657009105999,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,13939635450678961443,3786821373051426953,524288 --field-trial-handle=2268,i,11606398036197900035,11165646771379016756,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
  2⤵
  PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e37e9afe-f007-457b-9426-0152d9d91056.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e37e9afe-f007-457b-9426-0152d9d91056.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5c17c9ba74408297edc6584d70bd831e96debfa7504cf8eda45a542322ccfd3
MD5 504047254268621472e5e16fb9678596
SHA1 3c63379e41e77710b19ea7a749b3d57b55611867
SHA512 2d1363330c8fbefcd95654e034e9bef959d04b1328406196fc11970a140840defa3d186f747158be9480b58fe1febfd22118a7ca8997805fcd8c40a2be2104df
SSDEEP 192:sxReRvxD/flsygVZyq/Be3bzKoA8pJa/g6+WNPhh/YEc3oG7hIgVeTJ:sxRefD/flsygb9evBk/5X/c9Q
TLSH
T16E52C70A6D28593B5CC7D299FA15BF53D6FC5062A5946F48F6FD8B0C04EB6CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ad35829c95e62ac9b224090732df6ab47d2ee2d81f36277bcaf301b69fad7ad5
MD5 07749bc372359ef070534d91c18d03de
SHA1 ff7afde70894686dd0e73b52c769951373c7a942
SHA512 f70717bd95815d1a19646048d1cca13970d4fd87d42e80ddd89dfa60e57547f22dc4a34ef14b633c5eb4626965a46a0e0d4233f9e1fb6445d979fe5f1f6c7668
SSDEEP 768:40Dk6DJQD8aF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6o:40Dk6DJQD8aTE7N0DbWgQ6DjfIQDFu1X
TLSH
T143D2DA7B640CCB7F4F804ADDAC197ACE6D6802CB9698C98047FE991C02C7BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 528B
SHA256 b65f8f742d79add5fd4958df62411b3562558c8ff27974ee0ab0e51c1d86c745
MD5 781bf934307575ec8db08f363fbd20d6
SHA1 6fd5e6dc16900ab67fdec444e1c27fa3329a1930
SHA512 38cab1d810c0218cc213541b2a982b9d031fb156de8503fd740708ad13b0e8554766e3a96bb37733476dc1a21665fd8cacac5b062b7684bed0db9624e702668c
TLSH
T159F0F1D78CA9E443D422BCBB17361556333A00FD26119E96005D302A996693C8340205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e47a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe59e47a.TMP
Size 528B
SHA256 a8f9d3fd6397529e10c304f058b917445e8fbbaf1f4381ba87cef9e341110a0a
MD5 0d4a44f2a64a1c11df3248990240a665
SHA1 37b331a085ec0ec91af8bc684a4d0eadc0e5ba42
SHA512 a2e9d8d8a576d4f6468dc649748d9712e70b4b8f25dd3f7a553222528b2930324a125270cd30a2c840c0704ba9ce325006d4d89820b006c64bac956077844915
TLSH
T180F0C0EB40E5FD52D955A8F56116941A333F0C303629D65F609B342E5933ABC8681E46
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 51f62abba4804d03cff1cc3c4928b9b00884b2d6bfd7fc395809d1e22aa70c40
MD5 793aa38a49460f47a4a142513f0d26bf
SHA1 6572142768edb87375f4f462ffdbd2a46ca547d7
SHA512 ce9e106c7467313e2899a55c970af694b04d5ab4a83d52844706321b3aa5fdcbe27bd30f9f417d81305ca5a786eb9aad94c66432a552df896e22cb13c94a34d3
SSDEEP 768:L93tFmQOgAkDTd+ZgtxtDeX6+qTko0u229a4vsTDb9MGK:L93tFmQK7vVTVKa4Wb+GK
TLSH
T131F2BF72EC258D7388AAD78472973A576EF52273C6D81B44E5EEA70C044356C2B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 34fa9db8102eca9349f463e92d08da8566522c0a6401ab1f549ca8008cceaa96
MD5 fd45fe895af7a4b74c7babee276d026f
SHA1 fc3228bd361666ed77bb66e804ca95bbec770df8
SHA512 4936a6609bdf6c2a10a2bef7a1af2d282a1eb8ee331b655bff5d8ba9e47c6ded174a7cfb7aed26dedf48d34a17384762d347ada750e21cba8f1b3ed7df2f9d6a
SSDEEP 768:prv+4UNbdG31kXqDTd+ZgtYeX6+qTko0u229a4vsDieVH1SdW:pbsbU300vVTVKa47EH1h
TLSH
T13203CF32E8648D778CE797C4714B75472EB95163CBC81B80D9EE6B0D069B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ac3b83e-649a-418b-a10c-0ed0a023cf51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9ac3b83e-649a-418b-a10c-0ed0a023cf51.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56010c7e9bb2850238f21ba5e9bae0b468c5f267ddf8c594935de320064116d6
MD5 7532de5f863ab604c136bff7a97ed5c0
SHA1 71934de87bfa3650bcf5be27fa8040e5eee8cd33
SHA512 fe53ebb2e5236d4219190aa53faf91ebb63417a30d51cf27aa7ebe63e703a114d380d03448e317de5cab5a78d669cc98171c33a77f33879bb73e58a34123c945
TLSH
T131D0241333550134C01030330543710C0D43D10F44C54145D43CD57D1F0405C3F034C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 375a08651d14a691598fdb10ee40d1c322b6f9765e5c37bc244f39b9de178ecf
MD5 22168609c9fabfdd9effb6680a6d722d
SHA1 e0d984ca9542612a51303772c5b8f594a3347e1f
SHA512 d86ee4e3327f386f3ee0d7a957168203ba879c142feaeafe1ac2110fbde9691f1404a5a369067c7de1413b0daf99047dd6fb0baee460bd75c56b15100af4b287
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4e164a15-2772-48d6-8019-6937733bcb71.tmp

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Default\4e164a15-2772-48d6-8019-6937733bcb71.tmp
Size 5KB
SHA256 4ed98625293ec8b5fb4c976f342fecf24879c8d7ff27ad488eff6c07ed6789a9
MD5 8f05322b4e598b3ac12a553fb403b52b
SHA1 75f01d5eae8c28e0679b225ef211431f6e245929
SHA512 46fdff53036509717dfe26629c558906bea791d3dcef695dc6a5b330f9ec8fe2984e1a687063f8f538d8dc111ad35d3599564eff1cd28e69527e29c2084d19f5
SSDEEP 96:stU/dk9uu6Lfb9okHbo5h16ZZs7/x+6Mhmuecmje4+K+g/5t28XM1C7K:stYAem2o+sV+FijnVG6K
TLSH
T185C196065E28687B4CC6F549BA39BA03E2F9607275D52E58EBF8471C08DB5DC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Local State
Size 2KB
SHA256 c5923ebdb58856ce43e93989690e357608802014f246bf074dcbb57943d4ff7f
MD5 201f9565111bef2348ae96badd11ca95
SHA1 92531634580614977130622b8149c71d5553235a
SHA512 75cda548c1de3caef77c46d04d4282a0154b14af0099aa22f9e6e781e9d9b326a9a0cb48ad07f5d89ce816c12bae96607046239bfe891c2112e3de345d6f56c5
TLSH
T1CE51A6736814AA3785E38EC879467F63DE7151A9EB522F6499DD0B0C00D745C2347C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Local State
Size 3KB
SHA256 2b6b3f689a76f3d09b22f76a3abd597b6e99be0442ef6c90a3b43c884d539d6c
MD5 11693db8b25d6f18658c0b40a4bea7e5
SHA1 186b0b5c9cab8fa630325e703a826a882a208eee
SHA512 5e11cf3e11b44808d2592f5d9e8fe7b64f42a44aa878145ca1105bbf2b72b46081a07d46b441e8cf5a001264b0b2db83cfa1aa31bd0fa75d8cab4b2043eadb1c
TLSH
T1DF71867B6964A93749E38E4878862F16FB915166EA813FA8D9EC0F0C01D729C1353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Local State
Size 15KB
SHA256 ad99dd42a8f74700d194bd03121e6b33b23619e27fef2ffa02fc59c295c9f5f1
MD5 b22464342b95cb356e8a34782d4ef476
SHA1 7242bf2a5797f28415ab98ba223f1001aaa7cf31
SHA512 041797239956ab765eca009f66a65be26c9ed9a6bb6f3ec27bbedffd0f464b661b7ee51e34f57b3e262fbdbcdc91c92537d59c6e2ad94b2f3753572e28cdb9be
SSDEEP 384:A+aQikB+z/xvxjg/qhEwNBS+bLufBtO6nCH9zU:f/UxvxjgC+2bqZqFU
TLSH
T12172AE3B58687D2795F3E64479494B8BDAF888B295C23FB84DAD5F090ADB2980303D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597083.TMP

Path C:\Users\Admin\AppData\Local\Temp\TuffBeta\WebView2\EBWebView\Local State~RFe597083.TMP
Size 1KB
SHA256 912b3086817d36edfcaaa9e50ff81af7b206e2ef8c80ff81fd7fa96130f33810
MD5 880885982ccc433c15ddfad8ae9176f4
SHA1 08c2231b852721a070fb4fe00bbb9c954a7b5b4d
SHA512 94b45a3532a38088902132ffdafed7bbd78fa3d41bcc4852cac2318dd7e4fddc58899ddbaa66aaf4a24624d780a8446037157451f741278e44b22aadea22a8bf
TLSH
T12F3194BB94A09E3258829ACA3142EE93EE2101BE93424F5868DD4B0C05EB44C563FC37
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_144026227\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1912-190-0x0000022F4F7E0000-0x0000022F4F8B6000-memory.dmp

Download

memory/1912-26-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download

memory/2512-191-0x000001E8D5E20000-0x000001E8D5EF6000-memory.dmp

Download

memory/2512-88-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads