hxxps://gofile[.]io/d/nv4idm

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/nv4idm
Sample260809-yafdasvbje

Score

6^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	api.gofile.io
36	api.gofile.io
42	api.gofile.io
46	api.gofile.io

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5964	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1620	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6524	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3168	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307776986399152"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C06F05D9-9F23-435C-BB45-6DC06DF052CF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5872	WINWORD.EXE
5872	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5964	powershell.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe
6804	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5872	WINWORD.EXE
5872	WINWORD.EXE
5872	WINWORD.EXE
5872	WINWORD.EXE
5872	WINWORD.EXE
5872	WINWORD.EXE
5872	WINWORD.EXE

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 6804 wrote to memory of 6728	6804	msedge.exe	90
PID 6804 wrote to memory of 5720	6804	msedge.exe	91
PID 6804 wrote to memory of 6524	6804	msedge.exe	92
PID 6804 wrote to memory of 5720	6804	msedge.exe	91
PID 6804 wrote to memory of 5720	6804	msedge.exe	91
PID 6804 wrote to memory of 7136	6804	msedge.exe	93
PID 6804 wrote to memory of 7136	6804	msedge.exe	93
PID 6804 wrote to memory of 6452	6804	msedge.exe	95
PID 6804 wrote to memory of 764	6804	msedge.exe	94
PID 6804 wrote to memory of 6452	6804	msedge.exe	95
PID 6804 wrote to memory of 6452	6804	msedge.exe	95
PID 6804 wrote to memory of 764	6804	msedge.exe	94
PID 6804 wrote to memory of 764	6804	msedge.exe	94
PID 6804 wrote to memory of 2792	6804	msedge.exe	97
PID 6804 wrote to memory of 2792	6804	msedge.exe	97
PID 6804 wrote to memory of 2792	6804	msedge.exe	97
PID 6804 wrote to memory of 2772	6804	msedge.exe	98
PID 6804 wrote to memory of 2456	6804	msedge.exe	99
PID 6804 wrote to memory of 2772	6804	msedge.exe	98
PID 6804 wrote to memory of 2456	6804	msedge.exe	99
PID 6804 wrote to memory of 3748	6804	msedge.exe	101
PID 6804 wrote to memory of 4972	6804	msedge.exe	104
PID 6804 wrote to memory of 4972	6804	msedge.exe	104
PID 6804 wrote to memory of 4972	6804	msedge.exe	104
PID 6804 wrote to memory of 3440	6804	msedge.exe	105
PID 6804 wrote to memory of 3680	6804	msedge.exe	106
PID 6804 wrote to memory of 3100	6804	msedge.exe	107
PID 6804 wrote to memory of 3440	6804	msedge.exe	105
PID 6804 wrote to memory of 3100	6804	msedge.exe	107
PID 6804 wrote to memory of 3100	6804	msedge.exe	107
PID 6804 wrote to memory of 1620	6804	msedge.exe	108
PID 1620 wrote to memory of 3528	1620	cmd.exe	110
PID 3528 wrote to memory of 3316	3528	net.exe	111
PID 1620 wrote to memory of 5084	1620	cmd.exe	112
PID 5084 wrote to memory of 5696	5084	net.exe	113
PID 1620 wrote to memory of 6192	1620	cmd.exe	114
PID 6192 wrote to memory of 3836	6192	net.exe	115
PID 1620 wrote to memory of 5420	1620	cmd.exe	116
PID 5420 wrote to memory of 5728	5420	net.exe	117
PID 1620 wrote to memory of 3168	1620	cmd.exe	119
PID 1620 wrote to memory of 5964	1620	cmd.exe	120
PID 6804 wrote to memory of 1756	6804	msedge.exe	123
PID 6804 wrote to memory of 5856	6804	msedge.exe	124
PID 6804 wrote to memory of 7056	6804	msedge.exe	125
PID 6804 wrote to memory of 4640	6804	msedge.exe	126
PID 6804 wrote to memory of 4640	6804	msedge.exe	126
PID 6804 wrote to memory of 7092	6804	msedge.exe	128
PID 6804 wrote to memory of 7092	6804	msedge.exe	128
PID 6804 wrote to memory of 3328	6804	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/nv4idm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ff98fa7c188,0x7ff98fa7c194,0x7ff98fa7c1a0
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,6731534931375531853,2212031856409821914,262144 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,4409094024069292749,6674655395204910901,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3588847997202341212,16097043770810902482,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
  2⤵
  PID:7136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,11738657981906691286,2103777210224147326,2097152 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1253964593251779840,6658965652468345772,2097152 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5068,i,13695595340027473280,1386093433063891918,2097152 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,4491429599153243976,167558269534780807,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,5207609643058020325,3328696497300579574,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,2761577664438968560,3311488697313568773,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:6536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,2761577664438968560,3311488697313568773,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6304,i,864093432012548520,11315420673180242688,2097152 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15460320455011615254,18030267312875099389,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,5324722783266171531,5582947514612949550,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6428,i,5265480293940105834,1581605150979786447,2097152 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\cleaner.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\net.exe
    net stop wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:3316
- - C:\Windows\system32\net.exe
    net stop bits
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop bits
      4⤵
      PID:5696
- - C:\Windows\system32\net.exe
    net start wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start wuauserv
      4⤵
      PID:3836
- - C:\Windows\system32\net.exe
    net start bits
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5420
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start bits
      4⤵
      PID:5728
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -NoProfile -Command "Clear-RecycleBin -Force -ErrorAction SilentlyContinue"
    3⤵
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1738744297765846840,11455102207941622081,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,6655977114367140325,9047347672623760819,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13483574222358424694,16717467902035021066,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,10960115647426873935,9756756091928722772,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17706409922106008852,12843315152125701833,524288 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2272,i,2506771712097356039,3093256405026314736,262144 --field-trial-handle=2552,i,4517838671600549793,164982334756719675,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3468

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UnpublishStop.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 51253522b53f0827cb326959ba67d38efed516e01435441ae0a077aef5cea818
MD5 996dc5e60ab497068ed1a3148fb8f782
SHA1 092af4ab92552754bddc6bb43b36620cc991b96a
SHA512 205ac206201681e4606449606474102df89feb9b77efdf20fd5a95bf6990094c42af5613eb059d982d8164e852d58f60439d727d3ba22c1715059433a50e645b
TLSH
T157E0EDAAC860A82759FC5B18A054474BEB40235B3B41884B3A3C822C8FF063B838AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 059854fd84de61d3118e91d56058429eeb500df3e1c06c8b90a66e8bf3e3aa8b
MD5 fb5161d122615a6f48d6d1d7c21a13a0
SHA1 a978683e61772dcc067d1d6319b08864cbc4c934
SHA512 7d87cc444b79dd2557a334bbd2046226c47a8c39607e2b1f5eacbb7faae9fd3f8c0cb008044707ff3e6eda2692cfbabf60f46d6fbce6fcbae4fb27f885fe4987
TLSH
T1EC81947E43B19AE9D31816709AC1FEF931F76B5531CB2E2286588E345CA7F089EC0053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599b4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599b4c.TMP
Size 3KB
SHA256 b91304db67eca6447f7795c3b752dfceec1137485b988580d5dd57e482da6aa1
MD5 66e0bd13ac9782310078fa6056ccf8e1
SHA1 d5e32b99df050ae446fbc0622be2a210f0d6f4d5
SHA512 7b12d8fbfe245dd2283239637a196283c4a6ffad52c0ab8a0a6b3de74bc85ea0cadeab7caf1bc8c30d1db19eb05a6aed43d7d693764849a5d15692d2ee61e222
TLSH
T1E16163BC43329AE2D32C57B598D5FEB931F3A79A31CB2A2088545D385C63F502ED00A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 79ab101ce9cf102bd127ac913999ff85db75c3476d3e6ef5cfef1eb316de4472
MD5 59d79bebe357cdb26c76188e477e2883
SHA1 e0449e0e9e88ff5c387e754bef712d63831b2ae4
SHA512 58ea5c918dcc0e26800dfb4dc7ed13efd6d2ae5e39e2b1e03cafcce4a13be2f6354d8ddb40c0273c11018dbeb894831c24bd86f9a0bb4160bc729195a0258830
TLSH
T12951AEF783B4856EDA1196F0AE04AE1FCE5C0415832C7DA989E0AE17A3E3871E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0dbfc4b031248069788324ef5c4b63e5f6cbf7aafa65404134e3910f10034f66
MD5 73a883a5447c3defe09c99e5177d20bf
SHA1 c3f72f03572bedbeeed150f39e25a530301c5200
SHA512 7b5b1e386dd6fedea5c7eee602f9a612f8fd5ba6607f14fb37401bbee91a08b742d799905945840cc48f8a6b5dfda7e7b7f92e6f0df0c003d4795d28cd60d8e8
SSDEEP 192:sxRyRAyMqZjK1Ml8wO9V/f+sF53NRZihzoD8pWlD/g6+WNMm1/YcCex38sGQ5Gto:sxRydI9V/f+sT3N/iFE/5T/WeusGQsj0
TLSH
T1A262C815697899378CDBD219FA55BFA3D2F91133E1505E44AAFC9E0C04E76EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 99a981853c82b6b7de30a620987bfe0c0855284dece34ac581e61e2c140208b3
MD5 bc5efd297ce107557b154dca20fe22ed
SHA1 90c3a8a396b8707bd70f78b251fab7012bb8655f
SHA512 375ba6a728e0e222d3ead163529786fb48cd8944ade0840ff43511139017d40d9676f713ae4030786e08469c920a9fbbd98bd87de682b4e4f3c559bc98162019
SSDEEP 192:sxRyRAyMqZjK1Ml8wB9V/f+sO53NRZihzoD8pWlD/g6+WNMm1/YcCexY8sGQ5Gtd:sxRydn9V/f+s43N/iFE/5T/WefsGQsQ0
TLSH
T1B062C815A978993B8CDBD219FA55BFA3D2F81173E1505E44AAFC9E0C04E76EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1d0165c41bbdf76a378548a8eea0afcd93f6d22ecd8b151ba01afe3246aa048b
MD5 af030e5c100ecfd44f7622372392418b
SHA1 eb746737265bc6c73156c7f9db5dd11481948136
SHA512 6e7cf6869b4573df18e86eac09b480fca674aabe5be83ba05626ba6706b69318275c71e3711c09d141f6b80d610f3ad5444d28ed1a7dddb6237daee7c7d995b1
SSDEEP 384:sxRydqy9V/f+s4jN/iFE/5T/WeJMsGQsy0:sWsyT/fKpT/5rWeJMsGQA
TLSH
T10E72D815A9389D3B8CDBD219FA55BFA3D2F91173A1505E48AAFC9E0C04E76EC211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 02bae4f1d7d4c722ebe27bc833e8700ba4f3e09b7eacaab6a448e9f4280c669d
MD5 e41862474587529d2f6c22172dbd36eb
SHA1 e1422ef4c5cb6a867bc928203c3f4d3a5533541b
SHA512 9beb27e94ac2175b4beaa9d649998891176f339a67ebbc1a81a6a569817db63f262205cee57bdbb13ad1d299e8fa9a79a509aaa3c7aa9926d7b76e318898b70e
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9Jbj:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR8
TLSH
T179B25D11713F4280383EB50C91B8981E92C2B4A37519F52F7BAC46A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1ff77bfef276eb831a6f1b737f1552531f5bd000b751fbe231fd502927759c88
MD5 78d2edbe39fd55c52f3bd7e5c088c0a4
SHA1 5cf9aabec94c6aa7cf671835ae9932e54f5bebc6
SHA512 634e3501e043e238f5c495022dc10f8ec7d4a8848ac62e071a293be4ef7789546f258dc92d64370170278e2b3b42cad848c17162a882416fcc0eeb0c83ea3319
SSDEEP 384:n5iFmZcIt8NL68TUNTUlIRoPvuTd7CeffoGGcuDgWcjYxIWbre5lanTKwBODNZOF:QF0tQ6wgquJpGzDcsdHEgnewBKZOSc
TLSH
T1D1E2B2F198E79977D8AE4B87A73D2E0699FCC153B4885994B7C85D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d104adf0eeee29fbd13dd0bc23fda08180329a4ca61344b17defa175f807e896
MD5 07af57460e141bba1237c4ee1154a838
SHA1 7163ea94973e66b93a9ba2ccae58780e9421a895
SHA512 bef0f20014c3e347e0e300de92ada9aaf3e692e39dbb290e9889f8fb7c53a496be861d27a41fc946361f33fc93d27c8ac1e5093e358616892845ec6de3f7a4c8
SSDEEP 384:nEiFmZcIG8NL68TUNTUlIRoPvuTdpCeffoGGcuDgWcjYxIWbrgNlanTKwBODNZOF:fF0GQ6wgqunpGzDcsdHegnewBKZOSc
TLSH
T195D25A32EC68CAB7ECEA9EC5A6497607DEE44263C58C5AD8D6DD5D0C00C72ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f9dbed788fb8680311d1449e137401253647ad5cc47c35cc243c8c81650e3e98
MD5 de03888f196b8353bb0d3239e8e92247
SHA1 e05c1574e4fd6c9a430cb14dcbfcf08a6f609709
SHA512 d4676ee7ae29a881a4c93c3bcc48c5e58356cf923ca9ca7afc122639a801c5a008a8bb9734e4d8c699d93a1688983e58f65b997188b17e9c1d747d7051f9d2a3
SSDEEP 384:nUiFmZcIG8NL68TUNTUlIRoPvuTdpCeffoGGcuDgWcjYxIWbrgNlanTKwBODNZOF:vF0GQ6wgqunpGzDcsdHegnewBKZOSc
TLSH
T183D25A32EC68DAB7ECEA9EC5A6497607DEE44263C58C5AD8D6DD5D0C00D72ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 98d90e7af11e37bb717f07ef1134df7fc0ca09e399fb7044eb8d70b2ecb1fd4c
MD5 3b6ac21b02f7c80d1df3e401f6922147
SHA1 95c98739a6d8b0220f23bb4a4ad60288d90626c6
SHA512 f423b16033d3b954d8532f5ff043d95604ac86b7f6936f9fd0c32d83bdf811d1ef9601ae1f613931cb3bc5b1fba48efbf35ca76e35663aee99a7c4f7b3b2c83d
SSDEEP 384:n2iF1tNn/s3n9Sn8NgV8TUNTUlIRiPvuTuOReffoGGcuDgWcjYxIuLXFO6AV5XMJ:dF1j+9SXVwgUuH6GzDcsXXFTAV5Xjq
TLSH
T183C25B32E865DEBBDDE64FD9B30A7A46EEE0125781D859D8DAD85E0D00C72ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 936c34ecc0c8b828362ce0a6adf3a90554468aef9755b0f6dfcf4b5bafff369f
MD5 29d8dab1a3355a8553da2d5c25c6b8be
SHA1 bbce4f3ab15eec7c12890e3c3c071a94a58e2818
SHA512 f292b2f0629ffd95a4f32deb0f71b5d87efccbfae8ad0b3b3d31b0d309f4cb629145f1094df31158ff88143155b61037ffc4dc3ac91839735590ace4c79ef8f9
SSDEEP 384:nKiF1tNn/s3n9Sn8Ng68TUNTUlIRiPvuTaXCeffoGGcuDgWcjYxIWbrgklaFO6AS:BF1j+9SX6wgUuKpGzDcsdH5gFTAV5Xjq
TLSH
T152C24B32E864DA7BECE64ED9B30A3A46DEE05253C58DA9D4D6DD5D0C00CB2ED430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 470799c6636ce61ecfbaef2c912a736c1688f485e479269dcadcdc5c054da879
MD5 5727340a44ddd3c9b2477e40bf68ad7d
SHA1 6e406b27fc691a5c3b9196c66f0413de6e22c589
SHA512 2d9972515aea5eba21f53412a609939045a1007bc6aa3080a3483e944cbad269eba4f2518023ecbb5f95aef09d295b7e56cea052d5e27aa54e3a73021d232cd2
SSDEEP 384:nEiFiZcI58NL68TUNTUlIR8PvuThpCeffoGGcuDgWcjYxIWbrgslanTKwBODNZOF:fFQ5Q6wgqubpGzDcsdH/gnewBKZOSc
TLSH
T162D24A32E868CAB7ECE69EC5A6497607DEE45263C58C9AD8D6DD5D0C00D72ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 1d6e986ef0c6fb1691bb5e3120d803d3c0b491f4f4853de44bf74b7fe690075b
MD5 a329d3eca3ee96d2cd083e36f972c73e
SHA1 13f1b628cfcf24c140d03b3109fa269d3b819618
SHA512 6fc7264d9c994c9d9af8850074c90ce709338c9364cc76b05214de07b5891e7b29480c3121e6aa6dbd0220f910f04461b90a33a70298be7fcb4728bb56d001bd
TLSH
T15C5129913932727F47C787E860664C916860F085432E5A6CEE0B9438FE6CEE0A35E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

cleaner.bat

Path C:\Users\Admin\Downloads\cleaner.bat
Size 1KB
SHA256 a7426e4dd922992fb25eb8f4453f6f667f146b4a4a7170f480297ceafef0994e
MD5 2cd8d56cfc0370778af5ad196c6141a9
SHA1 c9a7ee3dd98c0ca1093f3d4074d2639296543547
SHA512 c0a57e9d9630d46be331165f01c6ba09bfae160d2fd6e92b238c7e66253618c9fc9b658d84470550dc6acef2fedf0ca3066e34edd4cbb77b21afa320cc5be311
TLSH
T1C121E22B785A9F9A01713DD288FE1251F7D5229B4D403FD5F0C14095BA053B61726DCE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5872-339-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-337-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-340-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-341-0x00007FF96D9D0000-0x00007FF96D9E0000-memory.dmp

Download

memory/5872-342-0x00007FF96D9D0000-0x00007FF96D9E0000-memory.dmp

Download

memory/5872-338-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-336-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-385-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-386-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-384-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5872-383-0x00007FF970580000-0x00007FF970590000-memory.dmp

Download

memory/5964-286-0x000001B66D550000-0x000001B66D572000-memory.dmp

Download