hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/2989%E2%80%AE[.]zip

Analysis

user interaction
yes
max time kernel
86s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Endermanch/MalwareDatabase/blob/master/2989%E2%80%AE.zip
Sample260728-w1wf4aba39

Score

7^/10

defense_evasion discovery persistence ransomware upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2648	2989‮.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
82	raw.githubusercontent.com
83	raw.githubusercontent.com

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2648-429-0x00007FF72BF60000-0x00007FF72C010000-memory.dmp	upx
behavioral2/files/0x00190000000187a6-428.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\International\sShortDate = "BA/DA/991E"	2989‮.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297366580823614"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{90647CCB-E633-4023-B115-F5ADE00E24DC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	2989‮.exe
2648	2989‮.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	4924	7zG.exe
Token: 35	4924	7zG.exe
Token: SeSecurityPrivilege	4924	7zG.exe
Token: SeSecurityPrivilege	4924	7zG.exe
Token: SeDebugPrivilege	2648	2989‮.exe
Token: SeShutdownPrivilege	2648	2989‮.exe
Token: SeTcbPrivilege	2648	2989‮.exe
Token: SeTakeOwnershipPrivilege	2648	2989‮.exe
Token: SeLoadDriverPrivilege	2648	2989‮.exe
Token: SeBackupPrivilege	2648	2989‮.exe
Token: SeRestorePrivilege	2648	2989‮.exe
Token: SeSecurityPrivilege	2648	2989‮.exe
Token: SeSystemEnvironmentPrivilege	2648	2989‮.exe
Token: SeIncreaseQuotaPrivilege	2648	2989‮.exe
Token: SeAssignPrimaryTokenPrivilege	2648	2989‮.exe
Token: SeCreatePermanentPrivilege	2648	2989‮.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
4924	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4896	1160	msedge.exe	89
PID 1160 wrote to memory of 2456	1160	msedge.exe	90
PID 1160 wrote to memory of 5904	1160	msedge.exe	91
PID 1160 wrote to memory of 2456	1160	msedge.exe	90
PID 1160 wrote to memory of 2456	1160	msedge.exe	90
PID 1160 wrote to memory of 2356	1160	msedge.exe	92
PID 1160 wrote to memory of 2356	1160	msedge.exe	92
PID 1160 wrote to memory of 5264	1160	msedge.exe	94
PID 1160 wrote to memory of 5264	1160	msedge.exe	94
PID 1160 wrote to memory of 5264	1160	msedge.exe	94
PID 1160 wrote to memory of 2844	1160	msedge.exe	95
PID 1160 wrote to memory of 2844	1160	msedge.exe	95
PID 1160 wrote to memory of 2844	1160	msedge.exe	95
PID 1160 wrote to memory of 5068	1160	msedge.exe	97
PID 1160 wrote to memory of 5068	1160	msedge.exe	97
PID 1160 wrote to memory of 5068	1160	msedge.exe	97
PID 1160 wrote to memory of 484	1160	msedge.exe	96
PID 1160 wrote to memory of 484	1160	msedge.exe	96
PID 1160 wrote to memory of 484	1160	msedge.exe	96
PID 1160 wrote to memory of 6072	1160	msedge.exe	99
PID 1160 wrote to memory of 6072	1160	msedge.exe	99
PID 1160 wrote to memory of 1412	1160	msedge.exe	100
PID 1160 wrote to memory of 1412	1160	msedge.exe	100
PID 1160 wrote to memory of 2060	1160	msedge.exe	102
PID 1160 wrote to memory of 5724	1160	msedge.exe	106
PID 1160 wrote to memory of 2568	1160	msedge.exe	105
PID 1160 wrote to memory of 5724	1160	msedge.exe	106
PID 1160 wrote to memory of 5724	1160	msedge.exe	106
PID 1160 wrote to memory of 2568	1160	msedge.exe	105
PID 1160 wrote to memory of 3692	1160	msedge.exe	107
PID 1160 wrote to memory of 3220	1160	msedge.exe	110
PID 1160 wrote to memory of 4744	1160	msedge.exe	111
PID 1160 wrote to memory of 1048	1160	msedge.exe	112
PID 1160 wrote to memory of 4340	1160	msedge.exe	114
PID 1160 wrote to memory of 4340	1160	msedge.exe	114
PID 5700 wrote to memory of 2888	5700	userinit.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/2989%E2%80%AE.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x23c,0x2d8,0x7ffc3e19c188,0x7ffc3e19c194,0x7ffc3e19c1a0
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,8901494571366077882,14375876637609836994,262144 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,17168806050577825309,14656619825519771936,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,10791288939275603856,5323453239153212897,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,16841352731881032713,16036486510570841256,2097152 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,6287432275823271511,10957473498014186790,2097152 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,16602292221709312756,4211664187965106338,2097152 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14250409514926979493,4744243207258328810,2097152 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,15092896637115911625,5307256528876119169,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,12551569490062379006,13031569662856827971,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5311216850176830013,11951966677698751338,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5311216850176830013,11951966677698751338,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,495967872778825668,5085672864168256663,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6756,i,11962604132420650981,14339031940705475616,2097152 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,4763199236876001365,6848851413794743476,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,701461975667222279,318709915206720044,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7073085866651085956,6312477026203942189,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9099386731165548443,2517654069001061239,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10557078439483102021,12426383032659594924,524288 --field-trial-handle=2408,i,17443395855051710349,1536776138532298182,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2360

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\2989_\" -spe -an -ai#7zMap4409:72:7zEvent20669
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4924

C:\Users\Admin\Downloads\2989_\2989‮.exe
"C:\Users\Admin\Downloads\2989_\2989‮.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5384

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c877b3347ecb306d991d0aacee1f05a018c749227bf275f864499b22a9b0fad
MD5 50489448d1b47fddd27cf846604a7e75
SHA1 60a55175c073cee00b9cb6c71c698891284d3ab4
SHA512 51cabf949f5ea61de2405bcbc462d59daa35f820441c9538c7358ed11ca0335e917a2d5b1d88cfb7df8a3e90f3889624ecb6c2793f422a42b2c5187c4fcc0cc6
TLSH
T171D023747F7557D0D11C00754420564062750772359F535561A1641CFDB488493FFDE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bd55c6a403052ee0d3644d4f87f6e628c63a4f5435bf01d4c2d860fdd1daef76
MD5 8be6da1feb2ecbf012e02a400e8831d0
SHA1 9b108a4179b0a9630da16383d01301f29a0583e3
SHA512 c923805a887cc3fc2d64daf005e8d04eb9b0c703e4a7fa584c2f016a00dd55fb06884db6797136e71bf601c2ae516c1660c7df8655c153d4a9f530e66d5ebce0
SSDEEP 96:e9BwX4rC7sTcJaL9sNaZ+8OcTe9fUDIYJ+HpC73:adfcJcBRp+Hpa
TLSH
T1B1A1B5E6A3A700D1D3E4527098E1FA883B34B56F2D377ED26016EB745987F84C360721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ba4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ba4d.TMP
Size 2KB
SHA256 e19432a5efa8bf476ed48352e2052cc5e9a1902925018556c6f5f492d8503b0b
MD5 1a8b3a42c7778a6ec86ac0d4e9a77410
SHA1 79633759fa75026f9d071459ea88677c49f86651
SHA512 11172591ac516c4eb887f660ab9cef2561964ca85db58ecec7446371699cc06d089eff366949d13a130734e37f2850bc7781ce5b9080be33ee5d78e486a80954
TLSH
T1345172F6B3F719D2C3F4A7B1ACE097983B74C47A35376FD2605A25B09A873C46061062
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 0449a7fc5a2878e331cab079f3ab2eea6526f7a4ece9b97f6f81bcfd264df548
MD5 7f61a9fd08ce69b529d6356e3b471d43
SHA1 49a7a531a82faf8512e62b1bd48c2dc369bb3324
SHA512 b203bc2dd64b532d6e57941839e22fb2d87c00e02c1e1e1de15e1dc9811122cd01f9286d6472236f5c46cadb6a989e3e13158af672e302b8af3246bdda66058a
SSDEEP 3:MsEllllkEthXllkl2zE/lRT+t:/M/xT02zJ
TLSH
T117440404FFD0070FDD4011314051C7D01370D4111717574334F10433DCDD7500D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65c870e8-6d6a-4eac-97d1-b99ae15bb273.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65c870e8-6d6a-4eac-97d1-b99ae15bb273.tmp
Size 1KB
SHA256 6002249268c870d2fc9c1a1f4a5c1089142d588d1920030be7e62b36c8d622ea
MD5 6456d56627a590b942099b027fa3b13b
SHA1 3aa83d82cac5ee04d1e71f015f42788a3d1e8f9e
SHA512 71b7c65d75fbeb9dca9e6586daa115f63d31e247840de6ae767e5bb629aad2d0e4901e831e5a5ec67b9eb3dc8fe1a6a6069941309c7f6b9c0a8b45adb8f23f82
TLSH
T161219DF3C2E8557D890142F86A143F2BCE2D0955931C3D5AC9D4AB5B93E1871E28095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 44648b93071428e3f58a5f6cb580e7166eda715ceeb99d623940df8b1befeed5
MD5 070b62e2959bd6cfa25afd3993642e9f
SHA1 01b89759815b32a4dbf4492c5270120cc8be6d2b
SHA512 03bfa459bad7667ef8e4a928ab8d73c85386ddbda034a82accb7dca40cc0fa153dd8086c31e804916474fae7e48a695579ef5832f0ceacbb93c62690d0255a0e
TLSH
T11561ABF783F5956D8A0256F0AA18AE2FCE2D0514831C7C6A89E0BE1BD3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5e34fb7afe5db9ebc84bdd7684ca75a278756cc24a46d3377630d24dd40a4006
MD5 aa01f21a5ffbd5c2e10844955a34bf2e
SHA1 b455444bf6f29bfa720d34ffade3e143e0247938
SHA512 aa760c0786a315eddf6359f20a79a42d8bda6244fa35b5cb56ef5c53476c91db87af0ba5908ae03c23854871051a1deac15cd85c56685d073a7327d8f86345b8
TLSH
T18461ABF783F5956D8A0256F0AA18AE2FCE2D0514831C7C6A89E0BE1BD3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1c9daccabaa2acb4cc7329000ef7a81cdf61e587a76b1586b63037379638bed
MD5 4d27870318d13a6cb5e14497ea4810f0
SHA1 f9730ecae255aef4320731302ec1f0952b7cd320
SHA512 8298635b332e11b564724b18a2ce6a0737eb372c1ce5ffdf975830e6b65617d2999395478fb2414996dde76dcca5e40a416d9a711bfef0bbf9c5275ffcd28ce7
SSDEEP 192:sxRMRqO7/fdsy+SHFSaBzoA8pyJq/g6+WNSuE/Yb3Z6jGuIgDFJ:sxRMX7/fdsxSlSa8F/54/Y6h7
TLSH
T12742C656692899BB9DCBD21DBA56BF53E2F91032A1D01E48E7FC9B0C04E76DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6394e8588bf5351294a12807f0cd0499e91b2e02965f9fd7a0e72c2d24530de1
MD5 7b5799b5474e9f7888a1d032b7a34711
SHA1 423b882ae6301ec8a5a606c6be6c76f25e8e88eb
SHA512 15239f123d181b8c8999d258c00f54d027beca2070ef28021a067398b1b4a2ba4e2605d1a801c8a5e7f2bb69fc432bea2c7d35d0cc00364dd6f7236d37b1466e
SSDEEP 192:sxRMR6O7/fdsyAWpVgSHFSawzoA8pwJq/g6+WN+M+uE/Y7mZ6bguIgDFJ:sxRM/7/fdsjWvgSlSap3/59E/j6T7
TLSH
T1E552C656692899BB9DC7D21DFA56BF53E2F91422A1D11E48ABFC9A0C00E76DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56fe74f89b3c257ad205077b9721a10a074d601adfea1d6844cd7c6ceed9ee52
MD5 12bf5c15ba9ca4377e333a7a35f37a85
SHA1 5a47b7bba4ea6675e5594122245cf2e1198be26a
SHA512 f1806fbaa40e30af98fe74e42992381c1fa0ba0101c5f52c5291f9767c8d24e86067e9926d748b0541ccbb0b3c95d1fe3c8fda850f04da02b6cc55a0cbb1366c
SSDEEP 192:sxR/RqO7/fds6+aHFSaBzoA8pyJq/g6+WNSuE/YbHZ6jGuIg2J:sxR/X7/fdspalSa8F/54/u6hC
TLSH
T1A042C5566928A8BB9DCBD21DFA56BF53E6F91032A1D01E48F6FC960C04E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cfff6e228324ebbace7b8105ce6948049bf8ab7b97aa76a1dc929559598c8863
MD5 3f99ed7058ae044a8161ad59d4d8872d
SHA1 b7b31a6506a74d56cb28af944fa678be93716344
SHA512 b59d0d3b6ffc250fc434f81ebaa232a1cfbc067f7ecb1cdd620891fc85df9b125083094bc7094cc5fe8488b0a05a358c7bf9a9a4fc781fb1d68f6bd0d5758aa3
SSDEEP 192:sxRMRqO7/fdsy+aHFSaBzoA8pyJq/g6+WNSuE/YbHZ6jGuIgDTJ:sxRMX7/fdsxalSa8F/54/u6hh
TLSH
T14442B556692899BB5DCBD21DFA56BF53E6F91032E1D01E48E6FC960C04E76DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 648cfedadd0de44f5d831e02177c7a84a21ec5e579988d30fa1c73dadd38891a
MD5 2d558d21e5488b85d9585ac50052c3b2
SHA1 1b74436ffba0c2672e0f87e5d76dc9a9b0c1340b
SHA512 74fa53e4df8b355edbd81628cc6d2345df8d766e680ae95bb29e9efd069e3a4077b42acce87043b382236836e5c8e51708683d3388008535db1b3d85c4848c7f
SSDEEP 384:Flp1pABfCtgisFfq4KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnz98ERFqroAov:Fb1pAtWgikfq48F1+UoAYDCx9Tuqh0V+
TLSH
T105B2DB3B204DCB7E5F800A9DEC196FD76D9802C796588D8447FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3e9b6c76db5a526a4c781ce4491d80f32b96fe634e9f1e8bc687536ff233bfe1
MD5 6cc89c896e52c853646cd8e5697dbe52
SHA1 63470c45cb674d796d9400a60d8a1c93169d57e4
SHA512 14aae57c527df2c454bc591d623c112f8206e42a95dcd08ff6f73c038e8e18c1d869e00cb6ccd53c253bc83245a28524e9eeb004317c8adda90c2e3d44cf258c
SSDEEP 768:Frv+4UNbdk3Yxz/BqobGRWtZu4aWADIidy8LusO0:Fbsb23YrtZzaNsuVLLl
TLSH
T1F503BF76F8598AB79CB69184F1873A07BEF89253C6C90AE498DC1B4E01DB4BE1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 db48e64b589537406e726c2f4c2d081a023dab32e4dc2bbb0b887d5267c2e686
MD5 04d5ae79f0d156e2adc1992cb59563dc
SHA1 8b72f2ebb5e8afbce337d3bb5ee2a3797993fb0a
SHA512 5112b62e85f81ec349f09cbfd44949263960846794f28f0c8875cbb26ec8b6dedfd5e94abb54bc85555baa2c96c2f0b4b4694369039ccf904076760094467710
SSDEEP 768:Wi3oxT/BqobGRPtZu4aWADIidy8Lusb9Ma:Wi3o4tZzaNsuVLLb+a
TLSH
T107F2BF7AFC568AB79CB6A240B1873A06ADF4D263D6DC1ED448EC9B0E05D74BD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0934d020d3e3e7e4ef6bf5fabfdea476b3a43cea9dd0043b324ed37b31f44be7
MD5 8dacff172062295e2caeaadfb4d188f5
SHA1 66a09e365305662972828b71bb5a69a2ace0dba9
SHA512 50b48c0218eb95f8553b3bb3e65035faa1c519b3286b574d66645024d9d0341b40b89334e58c536b9c38d967d0622e636048967e3869a0018648191d353744ac
SSDEEP 768:7T3Yxx/BqobGRPtZu4aWADIidy8Lusb9Ma:7T3YytZzaNsuVLLb+a
TLSH
T139F2BF7AFC568AB79CB6A240B1873A06ADF4D263D6DC1ED458EC9B0E05D74BD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 014f4100cbfde173f4e559c4df133428c53e781836ee8a3b519067c0c190092c
MD5 a3d892895f43df979716e7bd52ce7bd0
SHA1 d816b21a2cef59f09b43b95c6cd57e988f29fc24
SHA512 5864ac1278fb70feeaf49956d15938344c5700b8fa2a46f84adf7dfac11bdac3260f07181dcc45a7e5d5602962e54ff97310be27c8d39af0c2b03223d65ba422
SSDEEP 768:pw33x7/BqobGR9tZu4aWADIidy8Lusb9Ma:pw33KtZzaNsuVLLb+a
TLSH
T12E1349F5A8C74AB7C8AE9343A37E2D06ADBCD253B598099477E8570DCC9647FC302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 33f8d3c9e561bf1929bb5d4d15620d7acc08d78d4226f7fef275b7ea1afe5bd6
MD5 e4363ba514d7dc12e39f75c8074658c2
SHA1 792ba6e522127ab9103a45da1ce33be4d97c74bf
SHA512 52a93f65092c6d4352e753eb1fd5912613b9dc8265a5a87429d5179c874bac234f65bf293e208ea6fd10471b980970ca195612ff31f7364467ec6af54e7f6e7a
SSDEEP 768:+i33xT/BqobGRPtZu4aWADIidy8Lusb9Ma:+i334tZzaNsuVLLb+a
TLSH
T1C7F2BF7AFC568AB79CB6A240B1873A06ADF4D263D6DC1ED448EC9B0E05D75BD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 4e8513d132efdacf0a6b993dab048b9405af6f202520e989e24b663157326276
MD5 719948563b698e2c4aa349a3fa29cc61
SHA1 184bd36cf6fc631fe33fd39e47b594749f9a1655
SHA512 40960a6eff57f19772928b188625f89cfc3b4646378ae561def18baa671bdaf720870a1578ed1e75d9171e242f75a910e3d7cbd081e526a8abd29d6ff331ff51
SSDEEP 768:PP3ax+/BqobGRW5Zu4aWADIidy8LuTV9Ndb9Ma:PP3aS5ZzaNsuVLqddb+a
TLSH
T12E23C1F9ACD7497AC4AEA703637E2D1A69BCC267F5A40894F798470DCC6247FE312805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a2af6be6b73d6ec1c5e8f5a577a86faeee5f9042fe7e67cedf4e4f258dbdff35
MD5 5958d1cf2878f83083d83e9119a06c92
SHA1 3dbb22488d65fa746bd74defd99029cb558f4149
SHA512 bcbb31659033551bbe6bf4d0b321d9138a12014cdfac94a9a457726310f4e341c75511a0361d018f398178e21c2680c6bba7b63aab0b4769a8cf2bcac8fbd3bc
SSDEEP 768:9rv+4UNbdC3bmhBqobGRupZu4aWADIidy8LqFeVH1S1C:9bsbw3SpZzaNsuVLuEH1d
TLSH
T1ED03CF36F8598A779CF79284B1877A077EF89263C6880BD088DD1B4E46DB4AE1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

2989_.zip

Path C:\Users\Admin\Downloads\2989_.zip
Size 190KB
SHA256 28d6d54fb15ed680e48bb21fe67270b653f6b0608b7da0c8c692afac8b696049
MD5 b0fb18639327b9073e733fd538c5fab8
SHA1 67d9701131ed22c092b4eb058e7d786da7ba005a
SHA512 45f8d924a35199b5fd5ceb58ad24590ba4d17c8f8a32f05377d3bc92f5ddaa1c6bb34d5dd440eff52c799d9c1cf503e24ca9ea97afc1343bc97d1281afa3d3c3
SSDEEP 3072:qs7xBcN0ynOL6G1gisq+2wVuOONN83ePE894bSdlG+r8PoeSQuJIJ6l4evOZxYb+:qsFmEsqsVbOHR83wGHPoeS8J6eevOZ4c
TLSH
T17314220C05AE9924D83E9C927452B3FC5E27579D27CAC18A0CD2DEBBF16A1392CF450E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2989‮.exe

Path C:\Users\Admin\Downloads\2989_\2989‮.exe
Size 678KB
SHA256 e574f7d4eb20cf213a489e93dbeeb44c1ae8a303fe29ae7e0fe86ad15f339da3
MD5 2f7fbe2755b98a6a33e21f68137345ce
SHA1 6e75f994ca9aadc57a3016b177f9f68717c13d47
SHA512 bf7ec76613a1214e92773ac2413d88c6916333a9f4c24ba6ce7cde1767bf16a8d90315928145a26ee49236c4666626ee1085a43534372857a0450876ad9ef98a
SSDEEP 6144:8qXxQLcc2kmP1ILeM3Q8gi980l6Y9hiG9:ZCLccZiISM3Q8ga/oKiG9
TLSH
T188E4019365B8B36CD84743F6A4F6C5BA245D6D323C27820327C57F8B78BA5F24235A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2648-429-0x00007FF72BF60000-0x00007FF72C010000-memory.dmp

Download

memory/5668-520-0x00000249801E0000-0x00000249802E0000-memory.dmp

Download

memory/5668-518-0x00000249801E0000-0x00000249802E0000-memory.dmp

Download

memory/5668-564-0x00000249942C0000-0x00000249942E0000-memory.dmp

Download

memory/5668-551-0x0000024982BA0000-0x0000024982BC0000-memory.dmp

Download

memory/5668-550-0x0000024982CE0000-0x0000024982D00000-memory.dmp

Download

memory/5668-524-0x0000024982920000-0x0000024982940000-memory.dmp

Download

memory/5668-525-0x0000024982D40000-0x0000024982E40000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads