hxxps://gofile[.]io/d/OcnG1i

Analysis

user interaction
yes
max time kernel
108s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/OcnG1i
Sample260729-xaeakada83

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4576	KeyGen.exe
3180	KeyGen.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	api.gofile.io
25	api.gofile.io
39	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3736	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298239386818232"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A48696E1-CB13-4972-AB74-5975BB2ED489}	KeyGen.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{3EEB44EE-8B27-41B4-84D4-0BECBE56AD08}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B7171AA0-E4C0-48CA-BFD2-CF5B7546C3F1}	KeyGen.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
4576	KeyGen.exe
4576	KeyGen.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
3180	KeyGen.exe
3180	KeyGen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3824	7zG.exe
Token: 35	3824	7zG.exe
Token: SeSecurityPrivilege	3824	7zG.exe
Token: SeSecurityPrivilege	3824	7zG.exe
Token: SeDebugPrivilege	1940	taskmgr.exe
Token: SeSystemProfilePrivilege	1940	taskmgr.exe
Token: SeCreateGlobalPrivilege	1940	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
3824	7zG.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe
1940	taskmgr.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4932	2844	msedge.exe	88
PID 2844 wrote to memory of 3736	2844	msedge.exe	89
PID 2844 wrote to memory of 5052	2844	msedge.exe	90
PID 2844 wrote to memory of 5052	2844	msedge.exe	90
PID 2844 wrote to memory of 5052	2844	msedge.exe	90
PID 2844 wrote to memory of 4412	2844	msedge.exe	91
PID 2844 wrote to memory of 4412	2844	msedge.exe	91
PID 2844 wrote to memory of 636	2844	msedge.exe	92
PID 2844 wrote to memory of 636	2844	msedge.exe	92
PID 2844 wrote to memory of 636	2844	msedge.exe	92
PID 2844 wrote to memory of 4200	2844	msedge.exe	93
PID 2844 wrote to memory of 4200	2844	msedge.exe	93
PID 2844 wrote to memory of 4200	2844	msedge.exe	93
PID 2844 wrote to memory of 4800	2844	msedge.exe	95
PID 2844 wrote to memory of 4800	2844	msedge.exe	95
PID 2844 wrote to memory of 4800	2844	msedge.exe	95
PID 2844 wrote to memory of 4408	2844	msedge.exe	96
PID 2844 wrote to memory of 4408	2844	msedge.exe	96
PID 2844 wrote to memory of 4408	2844	msedge.exe	96
PID 2844 wrote to memory of 3264	2844	msedge.exe	98
PID 2844 wrote to memory of 3264	2844	msedge.exe	98
PID 2844 wrote to memory of 3264	2844	msedge.exe	98
PID 2844 wrote to memory of 3796	2844	msedge.exe	101
PID 2844 wrote to memory of 1776	2844	msedge.exe	100
PID 2844 wrote to memory of 3796	2844	msedge.exe	101
PID 2844 wrote to memory of 1776	2844	msedge.exe	100
PID 2844 wrote to memory of 3372	2844	msedge.exe	104
PID 2844 wrote to memory of 4056	2844	msedge.exe	105
PID 2844 wrote to memory of 4056	2844	msedge.exe	105
PID 2844 wrote to memory of 4056	2844	msedge.exe	105
PID 2844 wrote to memory of 2388	2844	msedge.exe	106
PID 2844 wrote to memory of 2388	2844	msedge.exe	106
PID 2844 wrote to memory of 1756	2844	msedge.exe	107
PID 2844 wrote to memory of 1756	2844	msedge.exe	107
PID 2844 wrote to memory of 1756	2844	msedge.exe	107
PID 2844 wrote to memory of 1224	2844	msedge.exe	108
PID 2844 wrote to memory of 2296	2844	msedge.exe	117
PID 2844 wrote to memory of 4200	2844	msedge.exe	118
PID 2844 wrote to memory of 3500	2844	msedge.exe	119
PID 2844 wrote to memory of 4312	2844	msedge.exe	124
PID 2844 wrote to memory of 4312	2844	msedge.exe	124
PID 2844 wrote to memory of 4368	2844	msedge.exe	127
PID 2844 wrote to memory of 4368	2844	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/OcnG1i
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffece17c188,0x7ffece17c194,0x7ffece17c1a0
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,17533392361358939229,1256253823755357323,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3822969155591571411,7372516366640984684,262144 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,8313105714975651130,1411511115074841962,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16609873429907286412,16711019567168893609,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10419277703079570213,4135184764974530233,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16970656202619931012,15880661805329281004,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,5861965700883559470,12851827201998104520,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4868,i,6433008842407088889,13620950034619876391,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,18140330264549704708,5336258692807129100,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,8970849290714421343,17531103992087040275,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18424730942692961435,2587130562225443397,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18424730942692961435,2587130562225443397,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6256,i,15781425231686204802,3971308704140629489,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14399534228442401985,11698084172046869820,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6488,i,15076560708557896709,9669416833617453544,2097152 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2344312557732157806,4464278255296958338,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,1147536468307622937,4872697553904467424,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,15430854234918548063,3565090707220437279,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9392163163679653598,13808895810278080660,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10856271945506808283,9137020486925487806,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15590521943180639497,1526293571717846055,524288 --field-trial-handle=2240,i,4672120856656496224,9212085489798151051,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:652

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap4490:74:7zEvent13121
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3824

C:\Users\Admin\Desktop\New folder\KeyGen.exe
"C:\Users\Admin\Desktop\New folder\KeyGen.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4576

C:\Users\Admin\Desktop\New folder\KeyGen.exe
"C:\Users\Admin\Desktop\New folder\KeyGen.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 870250571345dc3180be6f3a84b7d8ebe72442a525f21e8ec561fab2eeac2413
MD5 1d959fe5fdc70e3e22d3a318525412be
SHA1 75a2d73ca8db9aea857bbe2c12c22e9623f836ca
SHA512 f09a5650ff0356890418d2ccaca41f21a9a02a206a364d6548de27613c0cbbdb80804c2cbbe0a644b8992b9008a7c507c59032ed94a3cf673e968b8c85d45da7
SSDEEP 48:m84ug4PUojWQXQbwCRFzHJfoDFgncscB5gXPVEmEStLRs4:mh4PfX/MzpfoxgJ45g2xSpRs4
TLSH
T1A281A12C05E1A711E3D222F0E1CCB98BB073E9560717ECE19BC48ABC6F0671C8EB2108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ce86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ce86.TMP
Size 3KB
SHA256 b032d24dacc1183d90fa9a85cb09468cde8f4327220305ab1c929badc6c17f52
MD5 6b0b13a5773f1fb2e9c3960ec8fd80d5
SHA1 63b26b19ed455cb79e09e0d45fa8166887c387ff
SHA512 707f1acc5c5151af6b483376fa573dcd6de88301a861c71ebf14e26eacd667f364003797e3d0a0d962b4e7eb3732873a4786849b07ba775703aef917a44a43e0
TLSH
T19771D81C05E26B05E7D23231E0DD390B3571E89A1A2BBDE59BC4C8BD5F0671D8E7100C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95c9e6e89ca61e228af72df1335c74a8e54084df3cd5398654d0c0d2ef210c07
MD5 55792044f6b44936285123942e185ef2
SHA1 d41789fa86d058e47ed95328cf869c1469082247
SHA512 63b26374628ca92312fe2c7b4a17ee22ccd53f41d7eb352903c9b1ea3850d728640a961547fed6e738cb54430b3a655f89838c1f36002dde0295a8a7de935a75
TLSH
T1B2319BF3C3E5856E8A2156F0AE149E1BCE1C0112832C792986D4AF27A3E3871E105A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 26463811ff415ea12cee1bdc80a3fdf5715bc1e2a499b0931a912ac13825c366
MD5 06270422747bfc6c03430a2aed1a01c9
SHA1 06348bd2f18077d9f00955feca100f942c0e58ea
SHA512 0d72af98d776469017ec98644b36f251f58baf1ec53434765785957aa87341a094561ffb5b2a054a5ce17ad95ca2aa54af74d8dcc72adbec83e9969719f8b736
SSDEEP 192:sxZ2RhyM/jK1Ml8M9d/fZseahIdpjl7HW6+WNecA/YwotoqOIgrJ:sxZ2H1d/fZseaKBHbS/J9
TLSH
T13252F752AB749977CCCFD209FA55BB53D6F54572D2900E44AAFCCA0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba732727763d6bc41b09ac3d9d37576849772cc9e65ff0e4d2b1601373bd04ae
MD5 acbb3cd3152bd407d6b56a0f7b0031a5
SHA1 1d6a0f0becd8b1908525204f1f8844ed07a3fc96
SHA512 b80943fbd811680c6e1c86a8b1617a0715fc02109cc339deaf284ad60002539b863cd17f1f74b552ace23b12a2f9826de7922ddc20aa92f8438d38f1d948736b
SSDEEP 192:sxZ2RhyM/jK1Ml8Mjd/fZs0WhIdpjl7HW6+WNeuuXYw00oqOIg5CJ:sxZ2Hbd/fZs0WKBHbmXuA
TLSH
T1F052E756AB349977CCCBD209FA557B53E6F94572D2900E44AAFCCB0C05E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c55cbe0f43e81c49141c734db3a4073a7612856cbfb5e5c47d5a13c83b78a230
MD5 1bc2fdc3486c17fd39ed368bee2fe9bc
SHA1 bb05fd195be09d7c89207d81b63722b22d26139e
SHA512 85bc005c99d730b0821f234aeab379315522651d4295f8a480ffd907d4f1476d382e523b65b5a35dea54cdcad6b5ceb67c917fb97a3fac1b4169baa782d75530
SSDEEP 768:LM4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dMrohYcTar:LM4jeXmWvmKLEu1jacPLZQdXFU
TLSH
T150D2093B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43dfd28df94c156b4ec5b9bb1a50ca8938e54aaa7a337b0906bd600078731617
MD5 69ec8097bdf401aee8756a6843e6d223
SHA1 25ff05a30e3dccef99c1f1c746e072abef32b082
SHA512 6399ffd57677bfcdcf4de07b066571f7f00f39fa2fe8689039f91bb7d1fd4d17befd31eaee3b98029532f9f1308dd676d14c91489a5d4e7e7ac94902ad42b42c
SSDEEP 24:KdXfu1Mapdddt45V+AIjptKiahant1E/9SmHMC89WyXYOfhSTaAdUws4EQ+3IjWa:Kk8I3KJ2UTyFDIFKMk4EhINKqYgfyyz
TLSH
T1AF919902307B16023D7E151C92A49626478275A371ACB42B3FE945F68FABE230DFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594349.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594349.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b7419db847d11119c4c9e9ff4f6eebecba6cd5d7ca2832dc33bfbb60ac1b709e
MD5 a3d305f5a39782b6761bab46df59b887
SHA1 5e44ae24f6b9364e644fadc84afb1adfb6eec109
SHA512 05001b93f48861a4ad729c880e53ed0a77493bdfc903914755af862bd14ba1a84c5c9e87c03168643072cdb7c1912055d4da377ba498f5bcdce379a165b2c2fd
SSDEEP 384:AiFEZcIlTsNB8TUNTUlIlkfVKvg0Ukf+w8kZyXH+2lFQScjmwazt:bFiVwwg6AIkbKHlfQ1jG5
TLSH
T1D9D219F299D78476D9AD9747F77D2D128EBCC063B9849A40B7D85A0CCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7653ea8fbf7d26e2ceae266d9cee85ce07882da54f5abdf1eb35a55f26990be
MD5 67d1a4761d8ac175080f3e25d04ef9c9
SHA1 a027f10773243551a58cae259999ba0eb602c02d
SHA512 a59ec48928d04972b5c4deaeaac8617d462fead862303cce61ca539668ff4e6cc4d64e5a92b8b60f980dc86e0995bb06080a7acbd51e30853113ea8e0dc5ac8d
SSDEEP 192:EONp6hZ0QmiUy7vpc/+jV6jzorkZk5wOZwxU6:EONp6oQpu+w8kZb2QU6
TLSH
T10B02D935A8686CB78EE2AE45F48737135FE5117BEDA56F84DAEC1B1D00C769C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0c136310e1ff00836c660c0fdc18e357202aede37a5afb42d5dfaedb80702373
MD5 f1ca1ce109d31cd5e019b651e9da7245
SHA1 819c6e50c1dffe4a55e2b1f98d6ba858d2aaa43c
SHA512 6348df988870198727ffc82c320112d62fea268a5b1a4cfc8790f1d42620ca9a2a8abbae469637146002cccc656a33cc5d9ea412c9c2e9bb97d2bd199d98ba9b
SSDEEP 384:eZcIBsNfkfVKvg0Rkf+w8kZyXH+2HFQScjmwazt:cBhAVkbKHllQ1jG5
TLSH
T16F927D33AD789C6699E6E156F49622138FB89077DBC59F84E5FCAF0D00C96AC130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7ad8e1579a5a613bdb6dbecac7c02790ea773ec8827b6a8770c0097a5430ccab
MD5 ea9b45c848c4e284161983c7abe98bd8
SHA1 0f54fe8bdadf251624b1f236268d5ed1a4022cc2
SHA512 91c771b12d657805a392abe8229d1f7c6283d43ac6ba7e6ebc4c947c2804e767a2d72168f29a1937edf30eb4e93d93ddec9be7560d3294c4726180220cd85914
SSDEEP 384:gZcIRsNfkfVKvgVRkf+w8kZyXH+2GFQScjmwazt:eRhACkbKHl4Q1jG5
TLSH
T187927D33AD789C6699E6E156F49622138FB89077DBC59F84E5FCAF0D00C99AC130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0b4022e335495ded29b0f7f5b99dd813ef8e288c75a534076f61b22bc34b4f28
MD5 6774b569f46b3dff82ea1a10fa9a1dc1
SHA1 2b7ad1e9a7b76615068054fc0c61cf72ff777165
SHA512 f8c2c14223af893e3b8927dc34282efdfe2fd92cde4bb0fd50ab311cd231bb8708e63722802bd9ea4c111760f9874890db8ff992d19fdc13a8c68edcbc0dca74
SSDEEP 384:rZcIhsNfxfVKvgVRkf+w8kZyXH+2GFQScjmwazt:zh6ACkbKHl4Q1jG5
TLSH
T128928D33AD789C6699E6E156F48726138EF89077DAC5AB84E5FCAF0C00D95BC130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 251fd55935b207593b56a52c3e2cc0cb5e19338a02c26d4966f5901bc061c130
MD5 20443b3e05a0b9332f89fe01002c59df
SHA1 6ae88c84c042864f4deae9816b0cd859e0759305
SHA512 d4a4fbd18d6de47f7ee569cb82ad5be5b56ce5074ce495f188bd1383f86aabd65848c893370bed7709715fbe3d0b3ff450be864e78db9490311d82c12920effc
SSDEEP 192:aON66hZHQmiUyMvkc/+jV6jzorkZyXH+2T5cOq3qLU6:aON669Bku+w8kZyXH+2u9QU6
TLSH
T14312EA36A968EC674DD1A555F09732235EE95137DEC6BF84E5EC1F1C00DFAAC130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f36b5efa8cbd7ad625a68d1d8e8b731932b642fb873399a8b30ab171fc724b9b
MD5 fd338aed359346851902d04a9b23f0b2
SHA1 3ffcbbcd757665da7fe22ce9032b8779cdae81db
SHA512 7a3ee2489da4b6ee9b180aa09297c6b2df573dcd0cdc6d3148b5befbb873f9949f6a50fe7fa8d9fd721672eb336e2c726c4560ddc78fe0e7046d3731d15253ef
TLSH
T12241C898BAFA1158B3B36F5AABF6A86D487EBD772F06D55D00110D4E0662A40C872733
MD5 SHA1 SHA512 TLSH

Submit Download

KeyGen.exe

Path C:\Users\Admin\Desktop\New folder\KeyGen.exe
Size 8.7MB
SHA256 0a9bd822f41786b2786da4019a7de7c651b6f29d5a2b63f08c674397ff771083
MD5 815b1b5becc06dfd859449e22b790f7b
SHA1 d99fc663405c1ad6c988742e76bcc3335bbe9372
SHA512 1fe493dbedeb0357e0f645c445bdd655a67a94024a02a25a31b906bc4a93a179bbbd107aa50aff6f1a1612283465fc0dcef1e868dc817b6e4b8349a2e0cae8f9
SSDEEP 49152:lxiQciNkco1Pdlj7934xLwG38SKSCrRdQdc3z0sEIrLBL3OOifJDJd7fJOBxHren:qXgTD7RQxHr
TLSH
T1CA96E82FB2618D68E139BD3BC0778E40963372752B36C6EB519182574E2D9C37D3E6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1940-671-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-689-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-673-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-685-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-670-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-684-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-690-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-686-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-688-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/1940-687-0x0000024FEAAC0000-0x0000024FEAAC1000-memory.dmp

Download

memory/3180-667-0x0000000000400000-0x0000000000CC4000-memory.dmp

Download

memory/3180-697-0x0000000000400000-0x0000000000CC4000-memory.dmp

Download

memory/4576-648-0x0000000000400000-0x0000000000CC4000-memory.dmp

Download

memory/4576-691-0x0000000140000000-0x0000000140052000-memory.dmp

Download

memory/4576-695-0x0000000000400000-0x0000000000CC4000-memory.dmp

Download

memory/4576-696-0x0000000004E10000-0x0000000005539000-memory.dmp

Download