ae45327e192ffcfa468500fbbe330fbf5c5b7bb4f94c41574a03538ce374c28f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OTBank_Payment_28_07_2026_258442.pdf.js
Size 8.0MB
Sample260729-ap2cbada99
SHA256 ae45327e192ffcfa468500fbbe330fbf5c5b7bb4f94c41574a03538ce374c28f
MD5 660c39ab784fdb4b2309ba77ded7aa1f
SHA1 91bf436246409150baaa8348ed406c2d0b1e7841
SHA512 d7b52fd32713039bc7a964bdf808c94f3be86ea400ca349dadf230e8cb8037d6c3635acc6b0fc70a49927e3c522978d030f013bd8eebf25f07328328a8972345
SSDEEP 24576:pRjHkKxoKXwb0UpHeylncq07tYrX+RJbZFjieOh/icyJ9typGNj5X1ihLYpMj:pyncd7tYrqhDi2cyzNFX1ihWMj
TLSH
T13B869389EEF722419D0370394BAF1042F1B9AA0B544DDD40B91EE3704FB162965EEBF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
149	1500	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WVTWMJQA.vbs	wscript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
784	wscript.exe
3820	wscript.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5116_159958359\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5116_159958359\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5116_555673690\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5468	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297587153390638"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{85AF9EC6-C758-4FBD-8056-3120E42B3EBA}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5468	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	149	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 5116	1500	wscript.exe	89
PID 5116 wrote to memory of 3400	5116	msedge.exe	90
PID 5116 wrote to memory of 4644	5116	msedge.exe	91
PID 5116 wrote to memory of 4392	5116	msedge.exe	92
PID 5116 wrote to memory of 4644	5116	msedge.exe	91
PID 5116 wrote to memory of 4644	5116	msedge.exe	91
PID 5116 wrote to memory of 3544	5116	msedge.exe	94
PID 5116 wrote to memory of 3544	5116	msedge.exe	94
PID 5116 wrote to memory of 2284	5116	msedge.exe	95
PID 5116 wrote to memory of 2284	5116	msedge.exe	95
PID 5116 wrote to memory of 2284	5116	msedge.exe	95
PID 5116 wrote to memory of 64	5116	msedge.exe	96
PID 5116 wrote to memory of 64	5116	msedge.exe	96
PID 5116 wrote to memory of 64	5116	msedge.exe	96
PID 5116 wrote to memory of 3236	5116	msedge.exe	97
PID 5116 wrote to memory of 5048	5116	msedge.exe	98
PID 5116 wrote to memory of 3236	5116	msedge.exe	97
PID 5116 wrote to memory of 3236	5116	msedge.exe	97
PID 5116 wrote to memory of 5048	5116	msedge.exe	98
PID 5116 wrote to memory of 5048	5116	msedge.exe	98
PID 5116 wrote to memory of 700	5116	msedge.exe	99
PID 5116 wrote to memory of 700	5116	msedge.exe	99
PID 5116 wrote to memory of 4004	5116	msedge.exe	102
PID 5116 wrote to memory of 4004	5116	msedge.exe	102
PID 5116 wrote to memory of 2244	5116	msedge.exe	106
PID 5116 wrote to memory of 2244	5116	msedge.exe	106
PID 5116 wrote to memory of 2244	5116	msedge.exe	106
PID 5116 wrote to memory of 2388	5116	msedge.exe	107
PID 5116 wrote to memory of 4532	5116	msedge.exe	108
PID 5116 wrote to memory of 2388	5116	msedge.exe	107
PID 5116 wrote to memory of 4532	5116	msedge.exe	108
PID 5116 wrote to memory of 2944	5116	msedge.exe	109
PID 5116 wrote to memory of 2944	5116	msedge.exe	109
PID 5116 wrote to memory of 2944	5116	msedge.exe	109
PID 5116 wrote to memory of 4420	5116	msedge.exe	111
PID 5116 wrote to memory of 2384	5116	msedge.exe	112
PID 5116 wrote to memory of 2384	5116	msedge.exe	112
PID 5116 wrote to memory of 4036	5116	msedge.exe	113
PID 5116 wrote to memory of 4036	5116	msedge.exe	113
PID 5116 wrote to memory of 4996	5116	msedge.exe	114
PID 5116 wrote to memory of 4996	5116	msedge.exe	114
PID 5116 wrote to memory of 3696	5116	msedge.exe	115
PID 5116 wrote to memory of 3696	5116	msedge.exe	115
PID 5116 wrote to memory of 5296	5116	msedge.exe	116
PID 5116 wrote to memory of 5296	5116	msedge.exe	116
PID 5116 wrote to memory of 5228	5116	msedge.exe	119
PID 5116 wrote to memory of 5228	5116	msedge.exe	119
PID 5116 wrote to memory of 5228	5116	msedge.exe	119
PID 5116 wrote to memory of 5272	5116	msedge.exe	120
PID 5116 wrote to memory of 5284	5116	msedge.exe	121
PID 5116 wrote to memory of 5132	5116	msedge.exe	122
PID 5116 wrote to memory of 5692	5116	msedge.exe	123
PID 5116 wrote to memory of 5692	5116	msedge.exe	123
PID 5116 wrote to memory of 4440	5116	msedge.exe	127
PID 5116 wrote to memory of 4440	5116	msedge.exe	127
PID 5116 wrote to memory of 3864	5116	msedge.exe	128
PID 5116 wrote to memory of 2972	5116	msedge.exe	129
PID 5116 wrote to memory of 2972	5116	msedge.exe	129

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\OTBank_Payment_28_07_2026_258442.pdf.js
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.microsoft.com/uk-UA/windows/deployment/updates-lifecycle/what-does-it-mean-if-windows-isn-t-supported
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d8,0x7ffe6a86c188,0x7ffe6a86c194,0x7ffe6a86c1a0
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,6820787244960015222,14564700578368416212,262144 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,16772608681200300235,5194297264879723345,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,5525279040967755407,3814676198789929079,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13505969833758622003,13784342612325380425,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1980625137600197645,2455533025846777899,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,5013487285397882669,4597928303186231183,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,610767064934318154,11583919884745827413,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:2
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,13629521134410808048,12270799428255184491,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2134433637493494076,11046130555129764847,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5532,i,1001519040040220432,7157989899835815685,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,4867297056011364184,11693453833885131445,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,1035755487818295767,2287879462698173827,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6044,i,1373179887676807745,1785516887596547314,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11618074261903082069,12843485870175262676,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,11618074261903082069,12843485870175262676,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,12215486217005859773,15091411493534329068,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6205723186634047646,2959889120527354681,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,17253274956293468678,11208273172309703592,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,4268477056256684092,13324624266874522902,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,12215393741344324473,18287942780557245497,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7048,i,5652880384883128942,5702195255789530707,2097152 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15574729285921427861,4510806394454525701,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2054128647238957216,5740847037706059748,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,12698881188628300702,3647154606388098252,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,404923796467525469,16431694619770208706,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,9759822670939975049,7033506231374643087,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,956373484707064819,10944405872554146449,262144 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17921832788616533612,13376926764320456887,524288 --field-trial-handle=2304,i,5027972442836968602,4179557679690711590,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:2972
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WVTWMJQA.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:784
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\msi_install_helper.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3820
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\XULKLOYNGJ.msi" /qn
      4⤵
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup_script.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:972
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 5
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5116_159958359\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5116_555673690\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

XULKLOYNGJ.msi

Path C:\ProgramData\XULKLOYNGJ.msi
Size 17.7MB
SHA256 3cfb7e8fcf9b7904c572d8749e935bcbae438bb13cc6461277ac64bb60c50f78
MD5 16a8d93b726fee49faff9e83eb172688
SHA1 067afc7baaa19686ff5bd90cc972ee843460dc19
SHA512 eec1f110dae9a646f5f81572e437cff5f5af840f085c4dd9e33b7ee3ef8438ab50fad6483a1d385c2dc7c7d5817cac771698002844d30eb1d86ccf9f58606bf0
SSDEEP 393216:Wp1s7O5Sz3ds708J/LrRQLJg3g9DGH0bpZlJjfFa:01qNgBQL+3g9DGHWjda
TLSH
T17E171282F651446AF99F0232A6FA7F1C443BFCFE57D4224A24E4720962E3ED60D660D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8ea07885957f0715ed4c450ca70158937d71d4dddce5584163ef45d2742c72d
MD5 a55703af47444a66e13aeecd624ceaac
SHA1 57806f9d52f3514acb7541232357f6b20f706777
SHA512 69b3e58a1ea6a76f9835985f1c7088a223fb02fd9ef94d87237a81e5e241c7604f070a48e4f0096c9bf2ebb0a45e2b2e844db965278619f37d9d44cc740c07a1
TLSH
T1DF7192E4C0D21B97E32400F9F2E00A077E318AD645435F562E5544BD58EB3E1F577C88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5985ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5985ef.TMP
Size 3KB
SHA256 3a46aa769254bd8b7ab269f96d920ef89efaa848e70093f8295b0eed1d883aa9
MD5 2f178b956260b9a39e0d750e66b63a72
SHA1 f32791814972de176622760b76bd32ed0332bdea
SHA512 172763e0a91a1ebcc11ec41fe5dded5ba5679d7ec59089ffaa094072eb24d897b933a9427da3491ae9c8d0187dc9ebf2ba50d4e5991e5bc0607fc486d7a889d5
TLSH
T128612CF4C1C20787E32114F1F6E006537E328AD65A439E662E6049BD98E77E1F97BC88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2976ca62164a49e10e394a117f9bc75e9bd08a0c9f770da848af7f3bbf7a9ff9
MD5 55ae4c19453896378fa151de9725e277
SHA1 dcba66b78e572c616c480948af810a6b0b1162a7
SHA512 f80897b7e23e047cb392c363f93a03b9eef2f3f55ba8ad737939c00d0fb76b84a37f489f4b1df584b7b94865645bce9dafb66fce8fbf0a0c871249a6c51f6aff
TLSH
T16A518CF783B4856E8A0196F0AA18AE2FDE1D0615432C7C6989D4EE27D7F3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e1fe1e55242515e4bc017254d34bffe96dcf58b73ee810aa0723046c5bfa750
MD5 8575c13f0ad86cc82ac01365654f89af
SHA1 df7b2b1d09276c1d33d71dd096602b5ea2a0e433
SHA512 95c65582b53bc1d1c5020f3bf640097173b969657e2a597681c0322cf72fc34a681014310f007de5fc841fb86aae1d6d5598a124027aec8d4f45457c814de5ba
SSDEEP 192:sxZWRJyM/jK1Ml8MiE/fHswIdIdphpJHW6+WNq29/YLL4DuhIg4J:sxZWNqE/fHswIeZHb9/ec
TLSH
T1DE42D9166A385977CCDBD208B955BF53D6F50973D2900E889AFCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f1ff8d9b4bbacc83ea767dc6d68a27d28adba89acec564abb169182469afdfe
MD5 c039919a18d61c4f354a78c002bc1f99
SHA1 a402b212fcb69f955c4120df188931f973ab2938
SHA512 442abe7172ca745aa408173297b27614c561a5223a81a110c8585042e999e1ab2eaebbf46902ff97fc7a5326bbbcc134a19bc63a88537c6241a4a83b6717258c
SSDEEP 192:sxZWRJyM/jK1Ml8UQciE/fHslXlldoBH1NIdpDpJHW6+WNq29/YLqrDuhIg5tJ:sxZWvqRE/fHslXPzHb9/il
TLSH
T16352DA166A3859B7CCD7E118B545BF53D6F54973D2900E849AFCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e25181b815fb27815b207918052d3df3678ed1744ae4050c05a205254d01a410
MD5 c0a213c95506ed45ce7fa9226c738223
SHA1 a0457dbae61e84c289de911da692a93bf2487b69
SHA512 3af11ee6264d75ab3769a71906b8852e17787ba4fa06709d7b4fb175d70cd4a389134eed31cd37f336ec267076d2bcc9994d1984abec22a1c952b83d0ec1e9f9
SSDEEP 192:sxZWRJyM/jK1Ml8MiE/fHslXlldoBH1NIdphpJHW6+WNq29/YLL4DuhIg5tJ:sxZWvqE/fHslXPZHb9/cl
TLSH
T12452C9166A3859B7CCDBE208B555BF53D6F54973D2900E849AFCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ea062a3e46dc746f54f7670d144eefa29026e438ca0c82dac1c10ca918262388
MD5 41e3c2c0425b0184475eac9ea6cbe2bc
SHA1 bac25030138e4ce7d76ebdd5c172fde18241b33b
SHA512 b15ace49c72263c4042beb49a67ebf15142de585f569ab3a6ab5420ecf9b5cc8169928f573e9d3816e930f7f7a16dfafff58e8080b13b3ccab822935db728825
SSDEEP 768:nvs6pX77pLuLfx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLxhILlWwJNArof:nvs6pXNEfx1WvxzWju1jaaxhILIsNLv3
TLSH
T1C5F2FC3B6C0CCB7E4F804E9CEC2A7E9A6DD8018B9A98C99447F9445C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e34eb980e23abe67a640e133fef5dfed87aa103cf8cf01082d8fbb33d903aaac
MD5 972bb94e86f705e973381656671361cc
SHA1 7d7e473f82c62a42b149a72b9130cc24254df64a
SHA512 27a146e9f81d67abd1a33889050b642834c1b3293cadabfbaa2f0efbe8c557e0cfee80299ef4c1b89529711ae557d92d7e27139e9c2dd700cb960c0263a4c502
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyqwF0AO6egaCbzInogKA1oGgk4whLmQt0:KUAAKtePubCKs8e+nCKQU/z
TLSH
T1B191061332B703123C3E690C975597678A82B5677068A42B3BED40B24EA7E205EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f0e27b3-1b3a-4541-9371-2eab6de1eeaa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f0e27b3-1b3a-4541-9371-2eab6de1eeaa.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a15bae9ffc26797dada27cb18f2bf8b3034eae77c45de99545fb05ea03f583a9
MD5 b879601331d71a9e1c0b6b2471098357
SHA1 fa06e589fdbf0e022f05a62d3858524dfd8d182f
SHA512 2b4a56985565b0ef30ae213fa2609bb7fb834a0e4270c988fd27254a547bf6c79c19bbca88202d18c3857b4455a36c95643bb5beec6215d1906ad79dc1bf3f53
SSDEEP 384:nSZcIhsNpi6GWkvcha99dFMsOMyj8Scjmwgy:gh+0Dij81jky
TLSH
T1D2927D716C785C7766E7E106F9872A239FB45473CAC41F84D9E99F0C00E66AC131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 29b13842bbf858a41ad42e5430f5d3b7ef16be95768f7eb38b7285daa43ea4ff
MD5 cf3f3c551766dd7e91d80101d27a8d14
SHA1 41aff750c7fc519d085f56e917a33e435a0273fc
SHA512 21bdfbb27eddd9e57b19d8b3883b20f53fcc7a9188380a6b09c3e42792466291027c43b364399e3c9045ce1a7f169063c4105e90039c902496ce165d2dc8afd6
SSDEEP 384:nqZiFiZcI3zsNL8TUNTUlIlr6GWkvfh9DfQK99dFMsOMNj8Scjmwgy:qwFQjKwg3IKD9j81jky
TLSH
T1C1D2B5F198D78976E9AE9383A77E6D528EBCC063B5885A84F7D44D0CCC921BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f462526ac7381a02bb8c2e531eb5999a171f28e840552bd8cf7ff46235b4ab19
MD5 d8fe85c4e65e5498b7a9357ada9f4494
SHA1 e2ba7b8f857fc87ef0e526d6d813272f32a7bf27
SHA512 42d42e4a3594aaad85d88c0a6e0411d5ead53265fc83102de894d795cec94f09792da5d4603488a76f663257c95a6585b5dfaffa40cd14a501a374835adbdc3c
SSDEEP 192:qONC6O7+3hQmiUydPGttb0b+FdFh2SgGj9PU6:qONC61OGt99dFMEjlU6
TLSH
T12A02D9356C786CB74AF2AD49F5873B135FA5112BEDA52F84DAE81F0C00E765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 594547d7851b28696fb603144ad573adccce94e90f133d2331564c47ca9bcc5a
MD5 8a0b5527f2cc8c6193e932d2681fc364
SHA1 0ecc210f504f377e799da56f389b75b6d794b1f7
SHA512 52bffa27db31e7f4c41869dccbb318df9ff21b5c1541faedfab3fe3928ff77ee683f8b2bbb49f351067489f614914cc13957e3f1a7196e4247651ee1b4eb2337
SSDEEP 192:0ON06O7+3bQmiUyqPTttb0b+FdFh2lSOh2lvcNjtqxrU6:0ON067bTt99dFMsOMmj8U6
TLSH
T1C4120934687CAC6719E3F505F58736639FA51177DD862F84E6E84F0C00EB6AC274A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d6b24d67283cde0eb3c7dd79dd99545bdf3d4e5b6761ee0d1ae64ee78e98b0b1
MD5 979ec3e6882742cf644cafcc6cba637e
SHA1 9f63298bd9cf85cd97c485316b819fb3a70a93de
SHA512 a86e436436c2025016769f1b1c6cab959f3320548df489bc24d995a81a53d21b0b92d3661839c9bbd930ec5995a817698f7b1f86d8941edf9bd6eef2c8d37394
SSDEEP 384:nRZcIhsNpr6GWkvcha99dFMsOMyj8Scjmwgy:5hZ0Dij81jky
TLSH
T136926D716C385C7766E7E106F9862A239FB45473CAC41F94DAE99F0D00E66AC131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e26148f2-a456-4070-a994-dbb962463e21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e26148f2-a456-4070-a994-dbb962463e21.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37473f9f10d5a3ed314a886eba421ce778a247340ebb7c4a6b801b8ec9a7a101
MD5 0445ad3fad624287b6397796f50619f3
SHA1 848daaee724035fc44e4221c03e6cefdd5020fc6
SHA512 7cb1ef5c2477ef044e033083a7b84a6f8402a33c96435c046ff0790d09cd1edc0546cb63c3d958936c8ce65284456ba7870fb3e6ac4d20aecfb56895707b7aa8
TLSH
T15E412858ABFA1148B3B77F5A9BF7A86D487F7C772E0AD05D10110E4F0662A408862777
MD5 SHA1 SHA512 TLSH

Submit Download

4bdb0a48-9410-408d-9783-47becbc719c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\4bdb0a48-9410-408d-9783-47becbc719c0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c24ebb72-e0dd-47ad-89ed-2e4ca5c5ca7e.tmp

Path C:\Users\Admin\AppData\Local\Temp\c24ebb72-e0dd-47ad-89ed-2e4ca5c5ca7e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cleanup_script.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup_script.bat
Size 327B
SHA256 ab47ee8ba8f7d4c43fd26f32e0f953657132d635a81881538ef39754b8e76ccb
MD5 a3a56b78502f7429b3b6f6c790ed2861
SHA1 3a15bfc20e2595e6a3cbe90a9c2f492edf66eb3a
SHA512 9ffa2b2cc3e3b5024d73395977e7e3c92c4122e307122f21294679c94723b8a4a2aee06ddaf22dcfd8dffd30f33914959c23d9b533544c77875a72a5344b47ad
TLSH
T13FE0260203E6C24AE8A370430BFA520C81648EC23746B753464540BEA50B528D6B22C3
MD5 SHA1 SHA512 TLSH

Submit Download

msi_install_helper.vbs

Path C:\Users\Admin\AppData\Local\Temp\msi_install_helper.vbs
Size 346B
SHA256 ecc388f9ca6895976553351a774921c019949923b0cdd3d867074f34bc83c326
MD5 97c644ada1a1627c9a0fab320816b30a
SHA1 47572a8652221af150e897a3f95636b9c5178c58
SHA512 bd53044eb7f444002d5046a5471d7088f1f4deeff76db83493a7db565f1b09e0cbbf887dbba38214bb134251a058c17e7378c18d79ded3bc877487af1b1e9adf
TLSH
T193E0204480D9C5E40457649B43E59829F1B5DCA02D34E17B8750C94C4475134B71F042
MD5 SHA1 SHA512 TLSH

Submit Download

ce11eede-daa7-4c8e-b8d3-e207643cc002.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5116_1873087691\ce11eede-daa7-4c8e-b8d3-e207643cc002.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5116_777669253\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WVTWMJQA.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WVTWMJQA.vbs
Size 3KB
SHA256 3b518deefd78fe77634dc2b9b93021fb6228fc51d26171dda9e1e2fd82a1092d
MD5 c0a301e9ea846e6bdf7c712a1ec3bed7
SHA1 01ef3cf6cd21db43959bf31647413833f2844312
SHA512 ad73749d5028468e98ab1235100485f4973eb48fbe2ae50409041ed8c952dfe3438e3a78425c568266c12beeca56c7967a6df3810f2305f69b3985673f7c476c
TLSH
T1EB61214EADC9E1BC003AD5C76A1ADC0EFB6009BF8D65646FBA5C885209341FD72746CE
MD5 SHA1 SHA512 TLSH

Submit Download