hxxps://gofile[.]io/d/4rOUvH

Resubmissions

30/07/2026, 20:26

260730-y7tbeszsgz6

30/07/2026, 20:22

30/07/2026, 20:20

30/07/2026, 20:16

30/07/2026, 20:13

Analysis

user interaction
yes
max time kernel
107s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/4rOUvH
Sample260730-y169psfa46

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3136	Slinky.exe
2880	stinky.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	api.gofile.io
29	api.gofile.io
30	api.gofile.io
32	api.gofile.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2880	stinky.exe
2880	stinky.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299162232344234"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4E27299E-41A8-4742-B4B0-F44F92D2423E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2172	7zG.exe
Token: 35	2172	7zG.exe
Token: SeSecurityPrivilege	2172	7zG.exe
Token: SeSecurityPrivilege	2172	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
2172	7zG.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	stinky.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2320	4604	msedge.exe	83
PID 4604 wrote to memory of 2384	4604	msedge.exe	84
PID 4604 wrote to memory of 2092	4604	msedge.exe	85
PID 4604 wrote to memory of 2092	4604	msedge.exe	85
PID 4604 wrote to memory of 2092	4604	msedge.exe	85
PID 4604 wrote to memory of 1284	4604	msedge.exe	86
PID 4604 wrote to memory of 1284	4604	msedge.exe	86
PID 4604 wrote to memory of 1356	4604	msedge.exe	87
PID 4604 wrote to memory of 1356	4604	msedge.exe	87
PID 4604 wrote to memory of 1356	4604	msedge.exe	87
PID 4604 wrote to memory of 2928	4604	msedge.exe	88
PID 4604 wrote to memory of 2928	4604	msedge.exe	88
PID 4604 wrote to memory of 2928	4604	msedge.exe	88
PID 4604 wrote to memory of 3500	4604	msedge.exe	90
PID 4604 wrote to memory of 3500	4604	msedge.exe	90
PID 4604 wrote to memory of 3500	4604	msedge.exe	90
PID 4604 wrote to memory of 1572	4604	msedge.exe	91
PID 4604 wrote to memory of 1572	4604	msedge.exe	91
PID 4604 wrote to memory of 1572	4604	msedge.exe	91
PID 4604 wrote to memory of 3592	4604	msedge.exe	94
PID 4604 wrote to memory of 3592	4604	msedge.exe	94
PID 4604 wrote to memory of 3592	4604	msedge.exe	94
PID 4604 wrote to memory of 4236	4604	msedge.exe	97
PID 4604 wrote to memory of 5060	4604	msedge.exe	96
PID 4604 wrote to memory of 4236	4604	msedge.exe	97
PID 4604 wrote to memory of 5060	4604	msedge.exe	96
PID 4604 wrote to memory of 4724	4604	msedge.exe	99
PID 4604 wrote to memory of 2364	4604	msedge.exe	102
PID 4604 wrote to memory of 2364	4604	msedge.exe	102
PID 4604 wrote to memory of 2364	4604	msedge.exe	102
PID 4604 wrote to memory of 4516	4604	msedge.exe	108
PID 4604 wrote to memory of 4516	4604	msedge.exe	108
PID 4604 wrote to memory of 4516	4604	msedge.exe	108
PID 4604 wrote to memory of 3164	4604	msedge.exe	114
PID 4604 wrote to memory of 1608	4604	msedge.exe	115
PID 4604 wrote to memory of 2376	4604	msedge.exe	116
PID 4604 wrote to memory of 3836	4604	msedge.exe	117
PID 4604 wrote to memory of 3836	4604	msedge.exe	117
PID 4604 wrote to memory of 3836	4604	msedge.exe	117
PID 4604 wrote to memory of 5112	4604	msedge.exe	118
PID 4604 wrote to memory of 5112	4604	msedge.exe	118
PID 4604 wrote to memory of 5112	4604	msedge.exe	118
PID 4604 wrote to memory of 4788	4604	msedge.exe	119
PID 4604 wrote to memory of 1028	4604	msedge.exe	120
PID 4604 wrote to memory of 4788	4604	msedge.exe	119
PID 4604 wrote to memory of 1028	4604	msedge.exe	120
PID 4604 wrote to memory of 1028	4604	msedge.exe	120
PID 4604 wrote to memory of 3788	4604	msedge.exe	121
PID 4604 wrote to memory of 1512	4604	msedge.exe	122
PID 4604 wrote to memory of 1512	4604	msedge.exe	122
PID 4604 wrote to memory of 1512	4604	msedge.exe	122
PID 4604 wrote to memory of 1900	4604	msedge.exe	123
PID 4604 wrote to memory of 748	4604	msedge.exe	126
PID 4604 wrote to memory of 748	4604	msedge.exe	126
PID 4604 wrote to memory of 2992	4604	msedge.exe	128
PID 4604 wrote to memory of 2992	4604	msedge.exe	128
PID 4604 wrote to memory of 2992	4604	msedge.exe	128
PID 4604 wrote to memory of 1128	4604	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/4rOUvH
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3130140964553316838,3399888149110724264,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,8400506101951660997,5788267980715641446,262144 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,867274120889432460,476505120468342403,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,8331022634072789928,17375972819086378866,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,13124562800399570549,11908607765034175762,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,15811136812717771766,10372900085130705032,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,4404864474081629704,1845674579956994449,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4808,i,10329886195577979736,1771063063310433666,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,6911179685105459025,6533416965081761699,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,12723786261761047398,11260984374927719480,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5604163112936628393,8257834281085030146,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5604163112936628393,8257834281085030146,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6184,i,2532752750631354426,12862043809135503160,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6504,i,15683973563668259529,4474526204001130082,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15699022616868723432,9101850384543375035,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,14787321898429885580,3964203349620805172,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,11379890921059531016,809570676779123278,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6524,i,14067499980252080165,2219106902170334286,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5248,i,1040487735869589496,3584983294230758909,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,17412903117201459342,9204592698204080838,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4316,i,9048013363602532318,15227350689319677465,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8076629080190765941,18253303061580882537,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7028,i,9994885904392915224,14974009879088946799,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14549012837769816749,12632071455015703247,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,16689918273859609138,15789258603365912356,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7140,i,13651021709856011423,18255563935675228609,2097152 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7145350805829501071,6650108050576481138,524288 --field-trial-handle=2240,i,6554218479057841453,9778708895271939530,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\release\" -ad -an -ai#7zMap23308:76:7zEvent1920
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2172

C:\Users\Admin\Downloads\release\protected\Slinky.exe
"C:\Users\Admin\Downloads\release\protected\Slinky.exe"
1⤵
- Executes dropped EXE
PID:3136

C:\Users\Admin\Downloads\release\protected\stinky.exe
"C:\Users\Admin\Downloads\release\protected\stinky.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 80c2c7052338ed5be4b5caafd2c47ba312ebd1490bf8ed29a539e2aaecb296ca
MD5 8c8a79f4f5600b613dbf714e261ab5e1
SHA1 fb6f052c1d141e8a70bca10875ad1fe5c53cfff2
SHA512 7f38877eea1b08b08e2b0df48946ff259100c92af3e6cea24ad615c4e2ebbec865dc69104452c60a54ef4f2a15c5e9f226572d8e5353b5706794e7f00e5c6f30
SSDEEP 48:jBoUkpthnUftS1Ex6+we1aMRjANhZLyE6mW8wCv/0GsUNlXCO8gWCiLM:jBoKS1Ex6+UMRjShL/0JuXCTgWCiA
TLSH
T13081707503010061EBF12571ABE931D9707769ECFD979DA9301885FA69B836CC41DE2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a3fa4660df05cdee363f71e86c1f9ab6e94da385e22f0a158988d0c3e3e70bf0
MD5 7db3cb9b122c06e1d9592415fc5eb7de
SHA1 76bc1911d224b5d4e27d0e45cc4f3d12f0f9b787
SHA512 69dee2c740f915d1f35ac45190781114fc8a127faee6c8adf0a0e2827789ce02be5c830334e31601f0b4f11d2d4a223620838530e95e4bf65440977ad372d15e
TLSH
T14541ACF3C3E8916D8D2156F4AE24AE2BCE1C1516832C7E7986D4AE07A3F3931E10565F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f11888cd77c9065091c1389aff5c816039035d7a7cc72f17f3c12c611bb9a4be
MD5 5b609981f30deb6600e99cf9b7afeb05
SHA1 2a4e0b1dfae1cfdde6fd05e398613f3545c26b2d
SHA512 1e869d6373f6f9141b06dc14b9179b3b5131dc046b7b384b73175ff47c53be4f071bf06cf0b8cfc0eeb704e03c9294ec0a35ea0cccc33df6dce05a73d107dee1
SSDEEP 192:sxZCRuks/fKsWMDVSIdpjl7HW6+WNe4v/Yv9aNBVIgrJ:sxZC/s/fKsWM5xHbp/FH9
TLSH
T15822B9566E34A97B8CC7D219BA15BF53E6FA5031A1D11E58E6FC861C04E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5849e49f4a97dc43be46ca7ce7dc97da78ccca02e6a1536fa5d06d92c2f67a9f
MD5 f349cfa7bec128f10997e0a8bb9c6713
SHA1 9594ffd9c28db24ffa80fd0d3836a7279e27bfec
SHA512 bdf789ca83b4d1a453edf39c7a883a4fad515c20176674ac693394189037b93cd0493e59d708f4d35a5e3ed24e83de89d6edf3fd67dff8a2c4d187ba0d1249f8
SSDEEP 192:sxZCRu9s/fKs0SDVSIdpjlFHW6+WNe4v/Yvo+NBVIg5gJ:sxZCCs/fKs0S5THbp/+HS
TLSH
T1D432B956AE34597B8CCBD20DBA15BF53E6F65032A2911E58E6FC8A1C05E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b230e0e6a3c7ab9497a082d71dd935135baa03306550192e7ec2eed900232a9b
MD5 18d8a2e9ca871253bbb9707e87643f2c
SHA1 4b4e341114fd3ba7b7687ad1ab12d14e5672daa6
SHA512 90502a0e1974d49c98c8fd2eb72ad34b51e100cebbb9564d4840b8a6369f18cbaced2f820b066bf42e161cf5fe97646e6ba0617cd421a5c82bfadfca6ac77c30
SSDEEP 192:sxZCRuks/fKs0MDVSIdpjl7HW6+WNe4v/Yv9aNBVIg5KJ:sxZC/s/fKs0M5xHbp/FHo
TLSH
T11822B956AE38697B8CC6D219BA15BF53E6FA5031A2D11E58E6FC861C04E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 95e107aa6e2ef6ba3eb44038d5ab41817ef330dd27296ef25811596a558ad6d5
MD5 5140bc1f5fbe96ae3b5381155be6bed5
SHA1 3c670db8a7b2d7998c1138b27a59af45535a6eb4
SHA512 662faefed9a8ba4d59491cfbbfc0a855c193b0880e9c479668723c349bafade756bcc32d3db3be06a1b2039af12c2ea763efaa8bfe8099e8908a552522dc0580
SSDEEP 768:PWee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbYroM:PWee3rxWvhffnu1jatcL88bjM
TLSH
T12CC2FA3B640CCB7E4F800E9DDC5A6F976FA802C7A7548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6829a75686bcb504b6dd5f151cb060116f92d5914186e21fbc47df4fb48b7bbb
MD5 b3b898b93f41d7531afd158ac1dd000a
SHA1 fe4654183edc7fb905e9e39cbca0f181a785549b
SHA512 e24df7c689495645e914c71428665a3d12c71a1a396e822be8f41ea26b0178eaff5c67b404dc76d2b6f8843393ec0ae8449ed6c4a402beaed7898d943f90eb7c
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMpFIRVfDL:KYH+Kggmy+cKnKqimYKbagFIRVfDL
TLSH
T1CF917B16367B06423C7E2458B6A795374F4132673458E8AF7FB850A10E26E122DFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f930.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bdd992c60402eeccd1b7e3b06b75441d8c016c2fe22606cd993c776e876b93ff
MD5 9e8cfcc690f800b7fefdbca5e1501a74
SHA1 bf6f61ededef925d5bfc10772759945a1026670f
SHA512 76a27163e694e314d3f85c392481e6a331f2e99e6933a96c7c784cd8fec24d815e76eeb3d30548b65cac4547e5cf6c2b2c77402cccf6416e5fbbd02d39ecb5a8
SSDEEP 192:ugm+xasuheOwQxMGsNV1Q1NdabM7TYaLQmiU16pdW4MTwz+FdLD1WSJrm8z1cqe6:8ZcIhsNV1aNdh7kUS50dbJrHUAIA
TLSH
T145626D72ACB49C7BAEA3B146F44A36075EF49037E7C45B94E5EDAF1D00CA1A8130AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4f3b98a99631fa83f25481b7bf65545251c26fcdd1ea5061f3817efec41188f9
MD5 8c75bca6b1483eb82a98c82e5bb4f35b
SHA1 822a7dd177f01c7948d87378e0b68fe6043e4653
SHA512 0243848a90c56f5f74eb66f28f4cc22f8b0fb40505b700f584a576bac429875f252c9b0fef46ef6da8798d20091d9f1ede82519d273860c35f869a7a69d13b68
SSDEEP 384:5iFPZcIcusNv8TUNTUlIlEaNdh7kU950dbJrfUAIA:QFH9ewg93h3OVhf/IA
TLSH
T1CAB209F298D7883AE9AE9747B77D2E034EBCC067B6845650B3D85A1DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bd5fec96b1538e0cc5101556c75b065d8f68e9bed8f6ff1e81bba37cc6fab754
MD5 1d133839cc8302bd03c748071028f737
SHA1 1180c8b3fc36aa70586fa1f8f47fa7b5fde58277
SHA512 beaa0c5199024119c08c9beeb4d9f8a12fc90ef65c7b882afbb3dc43253f780619adb5b36ff140534993b68e630144e76763bec7c1ccdd7a5470832df00da1da
SSDEEP 192:ufm+xasuheOwQxMGsNVAQ1NdabM7TYaLQmiU16pdW4MTwz+FdLD1WSJrm8z1cqe6:3ZcIhsNVAaNdh7kUS50dbJrHUAIA
TLSH
T1D6626D72ACB49C7BAEA7B146F44A36175EF49037E7C45B90E5EDAF1D00CA1A8130AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1451400a9d78fb40a71b119a526fa0928f99630796943f1a8ac5643c9de93847
MD5 64f4ad0f77bff83dfe2cfc5d0c42e271
SHA1 e9c3975f2d986c6917f39767a3cb30592510d307
SHA512 cde8ed323c1439b4ad0e744674614e0683b8cb5fd8de6240d487377e5f5277311f354fefd60531f46e386e4045a5bae1c32474669320ade0decc6840561fb57d
SSDEEP 192:uff+xasuheOwQxMrsNVYVQ1NdabM7TYaLQmiU16pdW4MTwz+FdLD1WSJrm8z1cqz:wZcI8sNVEaNdh7kUS50dbJrHUAIA
TLSH
T1CB726D72ACB49C7BADA3B146F44A32175EF49077E7C45B90E5EDAF1D00CA2A8130AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98cfd90f138ff2c9994090e1ad17cbeb697da7b1bce3f5355f93fdc7d01cbde2
MD5 763574e7011197bd64def2e404a1b8d7
SHA1 94df5a6ddd0f8f3126a282b25b101489e171403a
SHA512 9519aac5c85ef0acc9a52706432dbb0431a1790aabb7617917b96928d0bd591482d57e91798126a3fee7e8941a358be43c2bd1aa65b5f539619687fe08cdf764
SSDEEP 192:lONr6vMtPQmiUyoJThTwz+FdLDf84776U/u:lONr6UtR5Tnd/+U/u
TLSH
T198020935BC786CABAAA3AD46F48A27171FA4517FE6D05B50EAE82F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2752e2722cba71c38cb12b6772dd26f264912bed958613a8ad2e2c7d35724172
MD5 a7239337bc98ce3feba93a8c0a1d8e73
SHA1 e33ba6fda816994b512473c86254510589219793
SHA512 7f6a7c73c28b7bca0591b06c8e87709a702723ecbd97dd0858904f23a8bf75862978ef28c603461bf91da345bebd5b1a2e15c9f2b72e28e28e4da9dcabb6e6e8
SSDEEP 192:KONQ6vMKPQmiUyfJ7hTwz+FdLD1WSJrH80IcqeAU/u:KONQ6UKR27ndbJrYUAU/u
TLSH
T1EB121A36ECA49C6B6D93B585F08B32175EA0816BEAC46B50EADC7F1D01DA2AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b0fc0b-dd28-4881-88fe-352d07da6fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65b0fc0b-dd28-4881-88fe-352d07da6fe2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 493ede66ebcfdb3df355d0d97c4777874cce135d688202fa188a8e8c1dbfd14b
MD5 faf182241486f9e766e4653cecb79df1
SHA1 852eca00b9b17706e0b75f0631c4ad0539bc2560
SHA512 ce765ba2540dadd1c5403658dc4c701593b52ce8c18211eab031dc0253fd14f08e1cfa4e1ffdfdc13127806ca250e60615685b83ae3ac0f4d4eff9cc32f8f5fd
TLSH
T1E2413058A7ED1149B3B37E5A9BF6A46E447BBC772E0AD4AD10110E4E0A63F41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

d7424f58-eaca-4454-a96f-eb1e6632072a.tmp

Path C:\Users\Admin\Downloads\d7424f58-eaca-4454-a96f-eb1e6632072a.tmp
Size 6.6MB
SHA256 5d506c60cfb3fdf05db8b67b1508a7c059c92bf03b69cf1e7ca13703e28e576e
MD5 712f12bcf4bce9a642dd0a805c69c513
SHA1 f2b567c2684e1240641566263a97104fa007ed95
SHA512 29e5dcf205fcdfbfdb3666a466a8e6ca2b6288ec4be2c8704bfc9f623abb77e3aa33162ec31737f95ae0d2121550fd221dcd48a5d42ff8d72d71e394f568bfd0
SSDEEP 196608:4gKOepHKsOhhXikwNfa66Etr7usPpSaXux4jXVRDqOtE:4gheosOhhXikHEtrjp24zVoOtE
TLSH
T1076633826C6F72B5ED78C732366A1FC620609C0FDE334C4AE7D3946562EE2265C74A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.rar

Path C:\Users\Admin\Downloads\release.rar
Size 45.2MB
SHA256 b9dd74f8f1992ba6f62062a7d4922c02a00826048d6dbe1d30b946de37c52c6e
MD5 6c60373ec6c4de75481d03a38471ee4e
SHA1 f88a1587dc95f5f19cb1fc588a8ee261e665ea1c
SHA512 dafe0daf15306aa1eba132858895e9ebdf2ed380f3723320c21b6a6c2b9e8bbb489b70fb484b603d351fac86e1a157a1ee3932c8fbea39432243153443c9e569
SSDEEP 786432:4/OhctXlVltaj/IDNsDSa6hMPPw8yJXnct6e6UuIHPO8xeqGtgSMDx4mjeh:zhctF+ApLjqWnnU9P/ItgvUh
TLSH
T190A73383FFEE762BC95BCD19A3429E22A76D768458224B0FA7727214F5B55023C1C273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Slinky.exe

Path C:\Users\Admin\Downloads\release\protected\Slinky.exe
Size 6.0MB
SHA256 3d68c709fb63cc90a01d3aaf2db427edf5c39cbfe42a0499090ce7c3ca67827d
MD5 029a0878d7b088c182fcd87adc7cf9f4
SHA1 7f9312aa81b3fb6d5c416907ffecb0b92a11831a
SHA512 f3e5c35c7934c71417614397975cfe31b90950e873e762056c8a8beff44a9c4de3586b8feba7313aecab370aa7052fc0408bdb035643a85bfe123d3fbd637d5d
SSDEEP 49152:PsAOFu7Rot3mMIKom+C8eq8+Ns7LlnU09HS4qjtkZOUMjO10o/aufKiK9KvRp5Ep:PpEg/NClnl9yNSLthbJEp
TLSH
T18D564A03ECA545E5C0AAE23589679212BB717C885B3627D32B90F7783F72BD06E79350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stinky.exe

Path C:\Users\Admin\Downloads\release\protected\stinky.exe
Size 23.0MB
SHA256 4fb030b137047c127b134051efb187c44b4fc13308cbb8c0dfb94de2627094ae
MD5 9f2c5ed3edd22492748e946533df0edc
SHA1 3b3f4cc501ceb0027ef80a646d43db2c31639d9d
SHA512 e30e463f14e0f85175e620c56c567c382a9d5c8329448ef8d3133be99772ff4ec14d7c66421b4f08d4ea982ce8718cf083e2442ab752a80c148919e33e8d755f
SSDEEP 393216:O2uL8awiLSKtiAT51av8CIeSmS80v7qnQxkoJp9sObdBzWt5KYv/U:O2ugaw5KtiVv8CyvenQyoJfbP
TLSH
T19E3712C678E191ECD397CA30D7CA6AF8D2DA768A0CB9542F6FCA04022631D51CDE5D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads