hxxps://131[.]204[.]178[.]68[.]host[.]secureserver[.]net/archv-coisa-adjminu

Analysis

user interaction
yes
max time kernel
78s
max time network
80s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://131.204.178.68.host.secureserver.net/archv-coisa-adjminu
Sample260804-1typ4ahe28

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 22 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
62	5972	mshta.exe
63	5972	mshta.exe
80	4400	mshta.exe
81	4400	mshta.exe
84	2492	mshta.exe
85	2492	mshta.exe
87	2492	mshta.exe
88	3160	mshta.exe
89	3160	mshta.exe
91	3160	mshta.exe
93	3160	mshta.exe
95	3160	mshta.exe
96	3160	mshta.exe
97	4620	mshta.exe
98	4620	mshta.exe
99	4620	mshta.exe
101	4620	mshta.exe
103	4620	mshta.exe
110	2492	mshta.exe
111	2492	mshta.exe
113	2492	mshta.exe
121	3160	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303542480931534"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{07BF22A4-5AA3-430B-857E-1F5562F9BDD7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4660	4772	msedge.exe	82
PID 4772 wrote to memory of 5020	4772	msedge.exe	83
PID 4772 wrote to memory of 4948	4772	msedge.exe	84
PID 4772 wrote to memory of 4948	4772	msedge.exe	84
PID 4772 wrote to memory of 4948	4772	msedge.exe	84
PID 4772 wrote to memory of 5008	4772	msedge.exe	85
PID 4772 wrote to memory of 5008	4772	msedge.exe	85
PID 4772 wrote to memory of 5556	4772	msedge.exe	86
PID 4772 wrote to memory of 1364	4772	msedge.exe	87
PID 4772 wrote to memory of 5556	4772	msedge.exe	86
PID 4772 wrote to memory of 5556	4772	msedge.exe	86
PID 4772 wrote to memory of 1364	4772	msedge.exe	87
PID 4772 wrote to memory of 1364	4772	msedge.exe	87
PID 4772 wrote to memory of 5232	4772	msedge.exe	92
PID 4772 wrote to memory of 5232	4772	msedge.exe	92
PID 4772 wrote to memory of 4356	4772	msedge.exe	93
PID 4772 wrote to memory of 4356	4772	msedge.exe	93
PID 4772 wrote to memory of 4356	4772	msedge.exe	93
PID 4772 wrote to memory of 4988	4772	msedge.exe	94
PID 4772 wrote to memory of 876	4772	msedge.exe	95
PID 4772 wrote to memory of 876	4772	msedge.exe	95
PID 4772 wrote to memory of 3944	4772	msedge.exe	96
PID 4772 wrote to memory of 3944	4772	msedge.exe	96
PID 4772 wrote to memory of 4432	4772	msedge.exe	98
PID 4772 wrote to memory of 3600	4772	msedge.exe	105
PID 4772 wrote to memory of 3600	4772	msedge.exe	105
PID 4772 wrote to memory of 3600	4772	msedge.exe	105
PID 4772 wrote to memory of 5032	4772	msedge.exe	113
PID 4772 wrote to memory of 2324	4772	msedge.exe	114
PID 4772 wrote to memory of 892	4772	msedge.exe	115
PID 4772 wrote to memory of 4900	4772	msedge.exe	121
PID 4772 wrote to memory of 4900	4772	msedge.exe	121
PID 4772 wrote to memory of 2636	4772	msedge.exe	122
PID 4772 wrote to memory of 2636	4772	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://131.204.178.68.host.secureserver.net/archv-coisa-adjminu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffaeaa6c188,0x7ffaeaa6c194,0x7ffaeaa6c1a0
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9210875218105155644,13393472758410180934,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16757429617909276289,7010715752679160198,262144 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,15661007801436387491,17166712621554308057,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5376282269895666843,14608682107521606385,2097152 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,17760543146055121477,10456489450323553825,2097152 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,663917011880715791,15621430779303071741,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5116,i,7891988334017151442,6315954097851604726,2097152 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,13433058767951304403,13024296831786649064,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11587442081388700482,1688997173368381289,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,13896406374213383421,2625271596711231495,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1166152153291511398,6496530758617796203,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1166152153291511398,6496530758617796203,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3596,i,7313440634424792419,1724356260789440142,2097152 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,1098527340678389138,18203891395375474472,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,10418012703998973654,4606123107556304700,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14658028439701325785,4233465990215922060,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2842604170316674672,17251264270091804480,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5952751415208417783,11393098178361942380,524288 --field-trial-handle=2104,i,15799371299722319578,1112106390275981642,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4764

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\47272470-acf7-4ba1-931a-0da96037b94b_DetAdj_545.zip.94b\DetAdj_7837º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:5972

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\959567c7-f213-4b90-a0f1-0e3b307335ef_DetAdj_545.zip.5ef\DetAdj_7837º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:4400

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\DetAdj_7837º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:2492

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\DetAdj_7837º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:3160

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\DetAdj_7837º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 7e1dad9c3841521e68746fcea9198bfe719f7369a6640ad763f89a1a24924eba
MD5 da87dc6dccfe9366114ec9282c6ce25a
SHA1 9d4ea238904d235f02f4b4cbfcd3f21d3514a28f
SHA512 cb76422bb423a7c3f9f6dd548991ab087c85083403027c31ad23ee60ea61879c47d6bfe646542e29f1cb27eac71e788be57979d65b3abfa8a4f51c54002a6349
TLSH
T19C31E9AF8EF23560BF42DD0732C5C5377DE1A2C02CAD142B5279A4EA1912391BF16A49
MD5 SHA1 SHA512 TLSH

Submit Download

4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67
Size 471B
SHA256 6491672083bf957fa10c203fe5cc49cb0e4c8b57f4f3dd9f9cb4ad5b5f08bb95
MD5 9cfdae1bbb6d88090e8562a7a33e47a7
SHA1 e15c00ff68af49f394b82833288d3fe52d08c97d
SHA512 2eb559f469ce2e9232ee8902c1ec2aa19edb24aa4f478bbdf1a5a5bcea6e08be08b66223076c3ad81287ce6e82d31ac77f15952be313776b4157e476fb304493
TLSH
T1BAF0D492AD5D0B493E004C4036FEA0AA64318F0C00AED74E593CE3E51489F280426554
MD5 SHA1 SHA512 TLSH

Submit Download

A84E363DC347F2E77C58005947D92EC5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A84E363DC347F2E77C58005947D92EC5
Size 39KB
SHA256 b371ff0707d300b32ea7202910fb5d17f4e6ef5a1a5a451e41a3cc9b5c416023
MD5 1861d2e693c3804b09e0cd496265a30f
SHA1 5d5bf6ccc15ecf2c9a08a6bc95246dbdabe90762
SHA512 5370a252c808f58945e044931636550c1adb4d5422eb53a052733ff308308241a54fa0bf69aed83a84f1b4394163ff529b7a27d4fabb30332b4e5c31bee36663
SSDEEP 768:9t27hI8+s7s25GuDR2Z28vZvf6R0Uy1zSBmx6oHXwxXIqBSVFr:y7h3x5Gs8RvQzy0BHoeSVZ
TLSH
T1B90384A8DC37F9A1AD0B9F214DEEDA9652F602D52D42832F4E307E50BC13A9BDB57040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 50de8f7669093bfeeb8aadfadd32edc6636703c91a17dbe13c9c3aa0a70490da
MD5 fdd050851ac35b1d4397a58340d83b75
SHA1 e938eea707455de9847810c1a5803dfbec9cefac
SHA512 dcbc897da6803bf2833544e053123f4eb1173a7ce891fe3370b8a9f136047756ca776e37410cac55d1603a4b6d9bbde754de891d50f59279817e0e4e0c0dd51d
TLSH
T120C08C1C1AA20E16F2A843BC42C139039B208141F641CF161BF12A08DA96B166938C2A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 711ee2b46bf37dff8f09560d2526c43cf9f85445a1e732db862707aa6946f928
MD5 7be78fb04b13bf45d646ede3d5d82f86
SHA1 aa0a88d08039fe0167cde29fc397c50e0d423587
SHA512 496b2e500a0d4a380946c476db91f56afe8febd710916b65c7acebea1cc70d650cf603e590c03fc6e1ca32964295b19699d9f3da19a850b0a092d2c07f96d320
TLSH
T111C08C1C4A72072AF2E543BE02C12D039B608630F6458F0617B12A08CD11F512D34C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 e9720945f79ada9cbfe55dfb42830e2ed8468558dd285fa58329d64a1ca55995
MD5 657475af182e1655cfec0a1545a14e39
SHA1 8fec231457fa62bb805dec0348c37223188ede53
SHA512 a595806d76168246e3a15062a4ca728a89191775f89f4d6249f72a7e62f5a9ef0bb5776866c2b14d4cf9258d4ed779aeb83a11d4e0f8117e032ff86da9ea0279
TLSH
T17CC08C181BE20616E2EC0BBE22E02A839A14E041F2858F0A163E2A489C50F145C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 c25b19e9f17613d672ba5d8ba50a1c75cc6beb62c413eb1912565109f43d1c9d
MD5 d4cce7311b2ce6dd153f1d860ca03e31
SHA1 10120cc5f960c8a7f4be8faddab74538059a5381
SHA512 0dbe9ca667020b77beb55e20973089e6afb0ea4f9a2d64cd875c7067fcdd0fd12b6abd70e7298ecc2df8b1de7317ecb4fc81ceb7d2625abd4f21a634c46e2567
TLSH
T141E0C0041A7D423CF030CA795ACE75A7036ED210315142F007F48B09A706E003D628F0
MD5 SHA1 SHA512 TLSH

Submit Download

4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67
Size 406B
SHA256 1afa353ac15b891693c67ca7eaf2bf61964578f3df5303209af1186b68b035b1
MD5 acceeb62e29b834640ddfa94a540c180
SHA1 539e77e6059416078465266c7333bd68f89803f2
SHA512 333205b308bf01e31dab688547c76d29fedd408ff7903fa1c09341e0aea6441d939f1bb0caea8e6229c56edff4512ea750bd8063252cbab092bee3695111ae67
TLSH
T139E0207421AB011CF454D4B84FDAF120855BE216944457B217AC820DA7029436C71638
MD5 SHA1 SHA512 TLSH

Submit Download

A84E363DC347F2E77C58005947D92EC5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A84E363DC347F2E77C58005947D92EC5
Size 246B
SHA256 319fb1e9ce2992edce854148aa78191724e2b84396bb93e2ee2b93c64891d84f
MD5 b158d4703ec404ab55887a65892986d1
SHA1 faed9b566d05f7c47d0d4b719e2e55afacbca79c
SHA512 dbf655bb0f6c20d64a75ef7c7e640b5b4476b12e137467c3f5c8c0dff2b5388bc51457ed8ec0791e141bf41ceaa17ce5ec6477f470dca6bc7aa8456739bf4684
TLSH
T1AAD0220C2B464136F00A9FBBD8BA01827EA83412B9648F1D1BB002CE482CB121C23909
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2fc9a1749bb9e28216555213d9bc5ba176b3eef0e03f7cab9392204ca5c1236d
MD5 84cbc3919996fc30dcf518e1535e1273
SHA1 3f808f48a6770fdb20bce676c53ab2ba84ea9a6a
SHA512 3394837b0ea038f0d64f3fc3b53058333a93402c6e7e93a0d752d8084fed12ffcf5cf3ae49e14faa52ec94f19f9d0fe3269029035ee8bc7230d9802a40171f51
TLSH
T1AAE02BADC921EC3704FC172D64590746D654131B2E81856F3B3D900C8FB173B1586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8a29c8af16545b09fc93b1387084bd0d850331c3acec23d4f321926ad37fd18c
MD5 34dbf880c7fe9e24a2c092d91cb753a5
SHA1 230f57b268d287614f65e61958271ee78b2fdb19
SHA512 7e8755b5c24b5273abf71c1e5f4a82b18630e114d0d9cbf002608d9ec82982b423066bd842612d2062ab054631f6e9adbcdd4eadba44f6cd4a2a4151192d91fa
TLSH
T1A641AEF387F4866ECA1196F0AA187E2FCE1D0514432C7D6A89E4AE1B93E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5807368867b8073146f75b03328495943ca6793c54f29b3c1ff5cbc4ca114a04
MD5 1f0a911b88d486f862b08aab70c1d1d0
SHA1 9d9b80923828e084782cc2c2288250318d80620f
SHA512 a1f450bad1a7a081f8a4ac25347eb5ced0e04d40c8eee1c48203d25716601aa0fe4b9340c5b36c700c518975a9ea964112fb7cb897a1ee682b4fff9b2c875239
SSDEEP 192:sxZLcRoyMqZjK1Ml8Mj33/f6sc4uo4tgnBzodptMfHW6+WNlvyE/YXpr6ldIg5+B:sxZLc9b33/f6sc/CqQHbN/cw87d
TLSH
T16762F9156A34A97BCDDBD20AF9457B93D3F9142395904E449AFC9A1C04E7ADD3203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b5f8928d6688671299f372ca4c705c0e6a8b4d7188ca45fd87a68d71ed212706
MD5 52833e99d2977be6a5fd89479eb2a0cd
SHA1 ddfa5aeafa18a4229e654d55a53928395164fdeb
SHA512 a1ebbccbba58a2fc783a3627131a1727ae9a9870725c052b321db500eb6b7bba656eef83c428c476bfa9e8eb90013d10b16cea17f8ba2979c291ff41aa42d3a8
SSDEEP 192:sxZLcRoyMqZjK1Ml8M933/f6s+4uo4tgnBzodptMfHW6+WNyyE/YXpr6ldIgS7LJ:sxZLc9133/f6s+/CqQHbM/cwS7d
TLSH
T18F62FA156A34A97BCDDBD209F9457B93D3F9152396904E489AFC8A0C04E7ADD3213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8c2b484d0522d980fd12bbcab6c5e05c0b9fa70f3fc925461a586361ce0a8186
MD5 0595dc028a7f62466d579e1f0733bd06
SHA1 ca0a8efc7648219190e8a463f2f44d32bc152a87
SHA512 c8dd0af3e721e119dc072fe05fa72cea23c73fefbc666b3acd14d1111a855b74fb1960f101b4b895275cfe3315c8dab4b17a95a615f9a2c90fe4e07bca486acb
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1a1N0:EJGnYNSv9PpHV/qj8z0
TLSH
T105B24B13313A03423CBE2919A2A686779E4231B3301DE66F77A904B64E67E125DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3f2c03569bcb8493cb77e6282c857851a277b6992c05c98693fdbb5f9bc96aff
MD5 0a5464645d880c2dc3a47e2ca448a768
SHA1 ac9f556c649d214effbffdf56b5310792574fabf
SHA512 8867831275666490317a6b47c836dc41928833ae981ca6229077461ad61b4274d391ce89fc3f9ffb075a7c4aa8b912bc7c7c3e70dd84f82e544d5798a1a2af76
SSDEEP 384:nh7iFBZcI69sNy8TUNTUlI4ABzoNm//ygpwBfcVrdQnZXudZBeRs9JKgqijUHbHz:hWFJoNwgBFJvVxQRaZTjKgqmUHf
TLSH
T1BCD24B32D894DABBECEB9AC6B74A7A079EF44113C9C89AD4E6DD5D0D008719D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ae9f9a612e9378bfd23f8949e3444874d6a7bedb822e8426e980e99f3ef4f717
MD5 e89046c6501b9e451bc91e5a08d969b1
SHA1 488569a9320b26175eb48242fc049bd4e899b7b4
SHA512 d84719f5bfe9f45d99aa52617ba87657cf95d9bf8a5a827e6cc36a64c03d58c131d7bb2c1bde9d2b2fce510c2d8570f8bd460b059131b4ee33e6257d36649e48
SSDEEP 384:nhgiFBZcIDsNy8TUNTUlI4ABzoNm//ygpwBfcVrdQnZXupQpZBeRs9JKgqijUHbT:h7FJDNwgBFJvVxQRWQpZTjKgqmUHf
TLSH
T18FD24B32D894DABBEDEB9AC6B74A7A079EF44113C9C89AD4E6DD5D0C008718D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 704c9a1df5d886cff9234ab5cfb3960e15ecf61512d141f5572bc8575994e7de
MD5 1257a2b457eb877d5d18e49e79dd5504
SHA1 f9af81cb4ff03bd95e01419dabf847447de03254
SHA512 d4bd09d046d985bd4f74997c2e7e56ee9712260d536369eb57097988d242c9938ae64674e719df5e81df54e0c51e69e5072e72e76b005912632430dbc3123852
SSDEEP 384:ndgiFiZcIcsNy8TUNTUlI4kBzoNm/7ygpwBfcVrdQnZXupQpZBeRs9JKgqijUHbT:d7FQcNwgVFdvVxQRWQpZTjKgqmUHf
TLSH
T12BD25B32D8A4DABBEDEA9AC6B74A7B079EF44113C9C89AD4E6DC5D0C009759D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 61b74f01fbea45161254dfc96a00d4acd3ce92df2950b7fd673e04ddb3eef590
MD5 c96a35ba1e62441344b05e3f129831fc
SHA1 10830fea3c1abb9ee70a0db751f4e1b6713da2df
SHA512 fe8d2c4b81c0055cf1c122ace9b2b81975e13089d7e0f3042980ac42fbbd5af6049c4b602f10347e69c681e3172b90185df24704c6c386209e69626c93e3b979
SSDEEP 384:ndgiFBZcIDsNy8TUNTUlI4ABzoNm//ygpwBfcVrdQnZXupQpZBeRs9JKgqijUHbT:d7FJDNwgBFJvVxQRWQpZTjKgqmUHf
TLSH
T148D24B32D894DABBEDEB9AC6B74A7A079EF44113CAC89AD4E6DD5D0C008758D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 67f0f46f66bc2218d40ebefe9db2640017f0bbb81f64fe90d447fd9d2ca0434b
MD5 915429498e2516814ae5f0f501b4dcc7
SHA1 f6dc2b43b2433c41edfb22160428d29890b327fd
SHA512 0803ab605edfbd862b43ab87f0eca7fdb41eeec7d477e8fb43da001cfbb7ce3d915d6e1c4a10ce6f85244f0ddabe60f3967a10ef70769e9399a5e9992d4ddf10
SSDEEP 384:nmtiF9CcmyWCs3sNH8TUNTUlImkrzoNmfDvwBfcVrdQ6Q1JrahkP+lFYS/8IHy/G:mkFccps3YwglBFVxHQ18hkoFYS/8O
TLSH
T172B25C36EC98CEABEDEA4FC6EB4A7A47DEE00167C58899D4DAD91D1D00971CD034BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c9eae4c3b233f3c000031dc91fff0d528bbcbd2621037e98c28c98c2496f8a8e
MD5 37d0253b04de2ba218300d79fbdd01cf
SHA1 d4bda9a9b08a7b096e3881be16c89b6d588f36df
SHA512 9b0cd814a18ab0aa53252d883dc35e861510b6f8f61b0484c606451fd682c91751282ecd83b248ed87744548b2b91d2e2e65dcf7a74ae81094131dc872d4c13c
SSDEEP 384:nJgiF9CcmyWCs3sN28TUNTUlImkrzoNmzjfC6wBfcVrdQnZXupQ6ZhkP+lFYS/8O:J7Fccps3dwglB+yVxQRWQ6ZhkoFYS/8O
TLSH
T121C25B32E898DEABECE64BC6EB4A7A47DEE04163C58C99D0DADD1D1C009B1DD034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07d5d9976873254ee37bdada5794b1370f878e6b6664bc24e518bfaca755aec4
MD5 20f3e1f2da981f54d084f672482e6977
SHA1 9a60ea3f13e0f8ec5792543ced7e4c0772f97075
SHA512 6b4c4b4040bd295bc2832cbc8a394e0802a208aab2534c49699c70eb324092831ef1a767c62f9bfe1c4c78a0e1cf631c99badff76a00c4c936de0b7e8e586e71
TLSH
T1AD41F858B6E91108B3B76F59ABF6A86E487FBC372F4AD45E00110D8F0666A40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

cid[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C7BRW94A\cid[1].htm
Size 37KB
SHA256 8b04aeba63c6071ce04d2f24dfb0b909c21485085bd8a391dea0d9f44746e2b3
MD5 7a607cbc11a8178826b36165b66a4fab
SHA1 b09eceb21b2ece2521d178213c9669b3e7b89c2f
SHA512 4d311f4c171c0e668c5412d058f0398ed2231bd1b6a3a4e3f8625e802e51dd806af3e75c68ffb71c35a8b2c1f393f0683f9fdbd92d4fa36035ba327d4979bee0
SSDEEP 768:kixQZXx7FAwVi0jf2KuKA6CT4/9GY/XGvbFR1WMjSAxnKQAyPaDXnPPQcVlm1P9v:KXd224FpjS8nkXCNW4
TLSH
T14B039481B3D0688502471BB72A1BF0CDED6E2A5B7C41499AD754FDA47CE432AEBF1630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

css2[1].css

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C7BRW94A\css2[1].css
Size 416B
SHA256 7b7e7a0c6e5e4b8d6814cf82c3d30bd044a6af46757137668e3f3bcc521d21cb
MD5 f86e59c5622f2fa65df7e18260ab80bf
SHA1 3779405947e6671c5a98ed975dfb6a1db8167bf0
SHA512 eea84fea82b8e2e4470d75ad183162e257fb22f764a6a1c165bd8f7f0499b8ffaac6777817c24698c9540fc654abf45c349c34c4fb6fbb9c5191b01e35937ebc
TLSH
T150E02B540329D8C0DE210CAA739FAE2CBC4D44153551C5BE8B720CC8CCEA4234340B5F
MD5 SHA1 SHA512 TLSH

Submit Download

afTchogvG[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DM84O020\afTchogvG[1].js
Size 95B
SHA256 1583eb90bd50550d946dd42eb51c83aeab6595babaaee75e78c800566c243111
MD5 455b877d83b80a4d7c36ac1c99581f37
SHA1 d99454ad801424c96149d22616b9cbb80dcfa218
SHA512 181b7973a9273968db438ccc954d55cb5805ff92b0c520df1b6084dc9c53dac6c4f7c3b7ffc9d620e77bf1e9930d30869b016c187f23ebf7d91546083947220d
TLSH
T163B0124C4300F0C985B35210012A04900074040A2056FE9CA50C4CC24D54C8431F1004
MD5 SHA1 SHA512 TLSH

Submit Download

font[1].eot

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DM84O020\font[1].eot
Size 45KB
SHA256 4a89784cb419ada32899e66db07de8cd1411fd90ae186c2bda0bbdf466be8328
MD5 da4c59c5f8652b5055ae6187e98bf727
SHA1 fdad78c946f488500f025978053d16b005569962
SHA512 d88795a6575fadd530ba9df7a40df6db78b61c2e30b6a7840c9e996dc87c0f9efcdd1c1f6e051915de853f78012ddc5581a85d7d0ebcb5245350165aa3e44f3d
SSDEEP 768:v7J23DIkbQFRGYUyx2YyWakAShC48FoCCZiZVB+:DYL59yxdtAGC8As
TLSH
T16E234A26F392D309EB0B9EBDB073D3E51336BE24FF568307A4767B195E490669E01248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cid[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U9TJF6KO\cid[1].htm
Size 360B
SHA256 c80999de8cd44a9eef2ca93b92d92ee1e126526a8f9738f7e139243f1f7bd6da
MD5 9ce68c09621bfaf09bddcabbad0a723f
SHA1 670ba34096ba50ce42e0b0f6cc0cc0f67f165bfb
SHA512 8c9b1f9897c829f96761134622bc38cacc7780419d5f5681d3a8d590c38b83cc68f6118fb5cf376296728d2a523e67174748e9618d3da27ed6b033b6516a53fa
TLSH
T15CE0C0BD5301F0C198833600548014E022AD10F2555ADDFD26DF4C43D058832BDBA0C4
MD5 SHA1 SHA512 TLSH

Submit Download

DetAdj_545.zip

Path C:\Users\Admin\Downloads\DetAdj_545.zip
Size 479KB
SHA256 709eb9de66bfd82b0aad4937c8b0444d3689942d1a6a53373c9b8eadf6814edb
MD5 6d55fbe954ce39fcb68485aba65a4e4e
SHA1 585a18db0b1a91950b8117a94a3dc961310908dc
SHA512 03f4839f45c798b84cfa454c01418590fbfab2ad4a79e341877d50dd207bf17f5dc14fecb04365c81052d04e4e538dd63674f50a3b595cf99a855fd44c76b76d
SSDEEP 12288:DnL36rrXKCfTmgyUnOgmM6lxoOo+q3NQzdKrT6BRe:irjFfTfyUnQM6laOo+q3NUdsuw
TLSH
T12CA433E11BB25A1F8F6EC56BFCA3AC89DA7605F27D522D4E03B6021597C0A1154AC3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4432-216-0x0000016744C10000-0x0000016745C10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads