1df605e3dae7e0ec53ab04c3873c43b0bcdf872d781fb3c7e34c36d95234350c

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
120s
max time network
122s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac.rar
Size 467KB
Sample260817-rw2ebsscpf
SHA256 1df605e3dae7e0ec53ab04c3873c43b0bcdf872d781fb3c7e34c36d95234350c
MD5 a0dd329c62b93dd15a240673a4d0f916
SHA1 8f3a7d61040bada9e7fb56c01be4fa0b2470e77c
SHA512 3906c8a125638d5e072767f42e40ba48cbc088532a9c0c18acb3e515331a7a9ec2df403339fa3290a57190c4c96dfe0d8882818e6eb02712df35f59ef0a1c676
SSDEEP 12288:wU4CzzAVFcEVBx7sq/u2feQvd9QJpV+z9lGfb:rAIOBx7PbrEP+z9cfb
TLSH
T137A4237471079BF640FDBA12DF6D80E580B4C1B11EA231428E6F61B60517BBA83DF6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GgQvSHkbnYVzleaYDyuvYqxI\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\GgQvSHkbnYVzleaYDyuvYqxI"	nf6dr9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AEMMxGifWp\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\AEMMxGifWp"	nf6dr9.exe

Executes dropped EXE 7 IoCs

pid	Process
4044	nf6dr9.exe
4488	test-redo.exe
4128	RuntimeBroker.exe
2184	test-redo.exe
60	RuntimeBroker.exe
648	nf6dr9.exe
2948	nf6dr9.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
46	discord.com
47	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314509163132714"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{8069D92A-75C8-4009-9ECF-0EAA51AB5D54}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{0ED20FD0-E0E2-430E-ACCA-2876EC7823E7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4044	nf6dr9.exe
4044	nf6dr9.exe
60	RuntimeBroker.exe
60	RuntimeBroker.exe
648	nf6dr9.exe
648	nf6dr9.exe
2948	nf6dr9.exe
2948	nf6dr9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1124	7zFM.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4044	nf6dr9.exe
648	nf6dr9.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1124	7zFM.exe
Token: 35	1124	7zFM.exe
Token: SeSecurityPrivilege	1124	7zFM.exe
Token: SeDebugPrivilege	4044	nf6dr9.exe
Token: SeLoadDriverPrivilege	4044	nf6dr9.exe
Token: SeDebugPrivilege	648	nf6dr9.exe
Token: SeLoadDriverPrivilege	648	nf6dr9.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1124	7zFM.exe
1124	7zFM.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4044	nf6dr9.exe
4488	test-redo.exe
4128	RuntimeBroker.exe
2184	test-redo.exe
60	RuntimeBroker.exe
648	nf6dr9.exe
2948	nf6dr9.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4128	4488	test-redo.exe	99
PID 2184 wrote to memory of 60	2184	test-redo.exe	102
PID 60 wrote to memory of 1748	60	RuntimeBroker.exe	103
PID 1748 wrote to memory of 2520	1748	msedge.exe	104
PID 2520 wrote to memory of 3664	2520	msedge.exe	105
PID 2520 wrote to memory of 3132	2520	msedge.exe	106
PID 2520 wrote to memory of 3516	2520	msedge.exe	107
PID 2520 wrote to memory of 3516	2520	msedge.exe	107
PID 2520 wrote to memory of 3516	2520	msedge.exe	107
PID 2520 wrote to memory of 2124	2520	msedge.exe	108
PID 2520 wrote to memory of 2124	2520	msedge.exe	108
PID 2520 wrote to memory of 3848	2520	msedge.exe	110
PID 2520 wrote to memory of 3848	2520	msedge.exe	110
PID 2520 wrote to memory of 3848	2520	msedge.exe	110
PID 2520 wrote to memory of 3692	2520	msedge.exe	111
PID 2520 wrote to memory of 3692	2520	msedge.exe	111
PID 2520 wrote to memory of 3692	2520	msedge.exe	111
PID 2520 wrote to memory of 2740	2520	msedge.exe	112
PID 2520 wrote to memory of 2740	2520	msedge.exe	112
PID 2520 wrote to memory of 2740	2520	msedge.exe	112
PID 2520 wrote to memory of 2508	2520	msedge.exe	113
PID 2520 wrote to memory of 2508	2520	msedge.exe	113
PID 2520 wrote to memory of 2508	2520	msedge.exe	113
PID 2520 wrote to memory of 4944	2520	msedge.exe	114
PID 2520 wrote to memory of 4944	2520	msedge.exe	114
PID 2520 wrote to memory of 3852	2520	msedge.exe	117
PID 2520 wrote to memory of 3852	2520	msedge.exe	117
PID 2520 wrote to memory of 2460	2520	msedge.exe	119
PID 2520 wrote to memory of 2460	2520	msedge.exe	119
PID 2520 wrote to memory of 2460	2520	msedge.exe	119
PID 2520 wrote to memory of 2780	2520	msedge.exe	120
PID 2520 wrote to memory of 2544	2520	msedge.exe	121
PID 2520 wrote to memory of 2780	2520	msedge.exe	120
PID 2520 wrote to memory of 2544	2520	msedge.exe	121
PID 2520 wrote to memory of 5164	2520	msedge.exe	123
PID 2520 wrote to memory of 5400	2520	msedge.exe	124
PID 2520 wrote to memory of 5400	2520	msedge.exe	124
PID 2520 wrote to memory of 5488	2520	msedge.exe	125
PID 2520 wrote to memory of 5488	2520	msedge.exe	125
PID 2520 wrote to memory of 5668	2520	msedge.exe	126
PID 2520 wrote to memory of 5668	2520	msedge.exe	126
PID 2520 wrote to memory of 5708	2520	msedge.exe	127
PID 2520 wrote to memory of 5708	2520	msedge.exe	127
PID 2520 wrote to memory of 1572	2520	msedge.exe	128
PID 2520 wrote to memory of 1572	2520	msedge.exe	128
PID 2520 wrote to memory of 5428	2520	msedge.exe	129
PID 2520 wrote to memory of 5436	2520	msedge.exe	130
PID 2520 wrote to memory of 5436	2520	msedge.exe	130
PID 2520 wrote to memory of 5132	2520	msedge.exe	136
PID 2520 wrote to memory of 5720	2520	msedge.exe	137
PID 2520 wrote to memory of 5704	2520	msedge.exe	138
PID 2520 wrote to memory of 5984	2520	msedge.exe	139
PID 2520 wrote to memory of 5984	2520	msedge.exe	139

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\retrac.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1124

C:\Users\Admin\Desktop\nf6dr9.exe
"C:\Users\Admin\Desktop\nf6dr9.exe" C:\Users\Admin\Desktop\bd1a1d.sys
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Users\Admin\Desktop\test-redo.exe
"C:\Users\Admin\Desktop\test-redo.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4128

C:\Users\Admin\Desktop\test-redo.exe
"C:\Users\Admin\Desktop\test-redo.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/easily
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/easily
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff89061c188,0x7ff89061c194,0x7ff89061c1a0
        5⤵
        
        PID:3664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14598806692909393611,1780134168899043411,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,4868801592939072042,6107447158831479564,262144 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,11349662266311463869,1838459346851340070,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
        5⤵
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,843456599331392259,12843676665241155437,2097152 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:3848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,17714808531645027463,14318178426630146550,2097152 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:3692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17741394964451707670,12748714671340232400,2097152 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
        5⤵
        
        PID:2740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,16406361131895019769,6153463995880934418,2097152 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
        5⤵
        
        PID:2508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,462233095442075889,1439989542168931525,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5381538690636699034,3472891290321823504,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        
        PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5156,i,964551242705032830,10816563683967340236,2097152 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,15477495593226372228,11939036238853662354,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,3400865225290777877,380737990884747423,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
        5⤵
        
        PID:2544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17147778832369366236,2482253249767770929,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17147778832369366236,2482253249767770929,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
        5⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,3425168979486360793,10748165627976041086,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,219410734308913354,17873720306948169167,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
        5⤵
        
        PID:5488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,217335877919201976,3083601129986252045,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,7570787087771819117,1532972179305269083,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3750377935038149115,7760054884040433451,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
        5⤵
        
        PID:1572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,16371682480985793779,14028980072728920236,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:5428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4015738185593799438,8960543370785320992,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2887513147946466103,15234388446898475196,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,6100564847535546704,13140735262036628521,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,7851039192621251078,5899582335397621139,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,740565390888489314,7382472681603672830,524288 --field-trial-handle=2292,i,18259617009203075000,1326260308826767364,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
        5⤵
        
        PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

C:\Users\Admin\Desktop\nf6dr9.exe
"C:\Users\Admin\Desktop\nf6dr9.exe" C:\Users\Admin\Desktop\bd1a1d.sys
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:648

C:\Users\Admin\Desktop\nf6dr9.exe
"C:\Users\Admin\Desktop\nf6dr9.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0ac4c2f08eef0430676370559bcdcdc5fc5a0a6933182d8bd324f1353fb1c00a
MD5 fb98916903ef9b1921ee296aa3eed049
SHA1 ecd8f09389669656b6a14b2994b5a228a9639076
SHA512 743e5ff4c823259fad1103cbe9e8d4d2222eb6ca173a7d363ff1c70e1dacbb82f84f64cc8b5a1a4c28842357c171271439880f1494e4618b2f35e993c7935118
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T127B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a3d10b16d8afe0c105f8b187f8f3616b1a6a5acead1299db43d8132ffbdd701
MD5 b1909b2a7b7440e7b9a3adf7750f7e70
SHA1 b05948679b364b6e193b3dfce38acfcbbce327a5
SHA512 6e1a661cdc2dcd861ab31eb46bd839bfe8a465393ade11a2c8d9ad612b4cc1265fdb4cf2a0d373288d8cd20cc1cb7f3e8bf565e575e5204858390018dabaae28
TLSH
T16FD012A27A0DB840F6055331E25283012666256028539702B261D41CC6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7073226b4cd1cfc4cf618f45a53939bc635bacfa557eafd1683ee91614cda0d8
MD5 5ff1793d8c9849e8aa6f4b07eaa08bef
SHA1 f5fe82f06b14c36eb220d075b1991d8ce3ddd649
SHA512 12cef1a00cae76ef3fc336350f290b288914eff9dcc7d486d3ac1f47bd4fde52db613b450bb58f380ab912b64ce3ec0b76fcdbb59da73ad728aa42c2e562ab9f
TLSH
T177D012A27A0DB440F6055331E25383012666256028535702B261D41CD6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a6662d259a220cb95ff82a3dc162fffab34a67e18ca63bd241b363d178688640
MD5 ec7013bb132a1b989b8af85707d18266
SHA1 c93adf40178a0f4692495344a509bd0022639d35
SHA512 ff1f59e1523f16b6b0af3118c661145583218344db73904fda3e777eb1fa461df8af87473cfb8c0eab4b875d23ef1de8c0a266e5b5b79c627432729d226041f0
TLSH
T106E0DF9806C8D66EAE90B787517C534CA2A0374AD3C9FA0A27049888360BC54BAD2590
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 1f0cdb6c59c7c6c7e6180048bcda23ee1354337a804a406c7a44531353eebc7d
MD5 9de12a11b0772c1cbe5ec88d14b1ef32
SHA1 10afcc7b83c5bda12998ef47ffce75337eb2a1a7
SHA512 2318554f882bb447f01e436d6d4444068bcfdaf287f614d7e9d9cc5f81dc5d22ef8ff0085b47cf104194615c13b29c3c4ef95572a2810e56e4a8855e970e883a
SSDEEP 96:Z8BUcJtFna2dM6KhDef5yxet2gn2I13GDFAN0fTO3gTpV8TOu7W7qAGc2RcMPa:ZncJu2yIYK138AMTO3gTrO7W7qFpa
TLSH
T11FF1B4E387935440EBD9077007D68C127130C752BAFBAE69AFEC4DB5219CF51882E60E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f5df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f5df.TMP
Size 3KB
SHA256 b766396db43d9d2391c87bfbee4203879c557f50dd1f3a55e73d565da154078a
MD5 77352218d13297e8a0f14e65bece8a8b
SHA1 321df022b20fd7c6ff4f313b285ae8aad2c0cb2b
SHA512 99160735b7141ee3dbe0f220a83fd14c489a65470de978c04a51a17aa35a0728d2f845f34ed88220eddd5bd44bc2b80dd10bb75bd6ed65baffec3a6f49542fea
TLSH
T1B671E8210B429811EF5A0B3084D34E027171CB8BFEF37DAD8D5C443A7A1DB21A86741F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5f6cc610cef20ddca19f3ddcc7864da3cf851eac914d805390753aeed32836bb
MD5 ddee64b1d7fe6222849e468175acf5b6
SHA1 df8655d839eabbad7b395a04264e7467a5c118f4
SHA512 8b795cfd9dda28ad7305e9ebc6a1e55caedada0b3b5169b36765dc28ed76042726aeb49829ae8876d99805049b0c4b52cc6b6697dceb00ecb445f91b4173f93d
SSDEEP 192:sxZVRmyM/jK1Ml8MyD/f5XsgJD1laagAdIdpEgHW6+WNz/F/eB+cbQAlIg4J:sxZVUaD/fJsg1OhpHbB/eBc
TLSH
T1FE52D906BA34A9778CDBD209BA457B53D7F50572A1900E84ADFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 830db0131526cb584207b3b2b1a10677292afece6a75581a2cd4a1a183577173
MD5 4951a66fea83c316391e33360ec62268
SHA1 6be44167d133bd1b63292e780f96ae45c6e3cb5c
SHA512 b536e5931529b41dfafcd139e22628c4ca0d319244c5471c6750a115df5bf681c8bde92e5982a13095409cedc4ad480aafc1563dcb2551f48304266f342a8b50
SSDEEP 768:VO03iMY7pLuLzqCWvqGrm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjD49Ll1/CB+ro9:VO03iMEEzqCWvqGrmu1jaOD49LfKBVo2
TLSH
T1F0F2FB7B2C0CCB7E4F804E9CEC26BE9A6DE801CB5698C95447FA884C02C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 39bf6276875ef1f1eca46096e06b2f4921d5413e018bd5fb67e73d2d64fa02a2
MD5 12cef490b1917662bbe8723c5db0d4dd
SHA1 a7a3f78bda3f13c6335450ca5b22deda4d9084b0
SHA512 e4cd7f0f0184b43cbc4591e6afd4063bd3278804c9e08f07cd6406e9440403bffa9c47fec2686a55d0b197535b2bc898af83809824347b7e89dd0bf4613d58cd
TLSH
T15DD09727A0182AB0C7AA0BC2062110BF0B083C8820DAD038E022292B4C98603E203FB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 af4c9f639f040b28a49ad48295396ac7fe55b05216e829e61bc2c572a7e7da0f
MD5 6ce2552db3707751a2d939e00bb71336
SHA1 678aecdfbd891b3b18d40530c78dc4ec96ec5f66
SHA512 efe76781c324e725e6950ce4840cd0dca037a147dba8958cb20af958cdcf3e3245ee30c5863a196e04d6b35c9601986c8de32c1c20b3fdf289e526ae6fc7c2c8
TLSH
T14ED09727E42429A0C76A0AC3072111AF0B583C8834C6D038E022382F0CB8603E313FB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59905f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59905f.TMP
Size 138B
SHA256 40903a9370c8fc7d57605f455329beb5bea2c5a818684865939cc07f6468c0df
MD5 fe23479d6aad2c1da891ea637caf889b
SHA1 a47afc6bb5be7b3d69875ef38e2f13290218c100
SHA512 21290061ec526adf3369b2b9d39e385dc2a5b3d62d3231eadc8c4afbb87fb92f82ac59560c94a1468b7ac120b731ddc7dd20b1e0d71abe3469d51379e59ae1ce
TLSH
T150C04CA7A45916A5C71906910632555E570D2C8898879449A013396A65B4E277202FB5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 91041c6af7ded38fe105c295b578816745c80098adb1cab294041c0adf1cc444
MD5 d950850129140701c4c11e485a4f976d
SHA1 48c0464a182ece00182709016d9ce74f150148e5
SHA512 7d4673a3b1189366bd9fab75fdf9cd9859ff8cf2e25d941c10e27c75ea989bbce2f3c5be973ba540da5f124c7b5a5999a6d7f08f361cbb9a063b587a65f4e50c
SSDEEP 96:KUEwKlW26OQKvq0cgKdqmCIwKF+SrqKgoCeNqKmQD:Cn3YbrgZNy
TLSH
T145F10E12367A02113C7F250D96A79A374F4231733118E96F7BF851A21F66E616CBD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc35f6e6-408e-4fa7-86f1-f334b34678d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc35f6e6-408e-4fa7-86f1-f334b34678d3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4ae7534d4ab282171ba5d2567e2bcbdb7036e515da21602962ed7812d08663a6
MD5 5c274b12220fb78541b5266dff39be6b
SHA1 22af1b53c16002a0173d5f2e51ad22a3108ee159
SHA512 8a02fe618f72f117ebce6c761f3e6e90159d038c4001dcbf72054f7f10b35448f8ee0d2189cf292299f712be8cf5104f457c82591f99c6004a3b58613c51a40f
SSDEEP 192:uunzsNbYX7QDX5Q7JBa+rk7QmiU1Y4zY4pbgoIL7DPO7WI8qlU8:nzsNbA7YX5Q72q09nwL8vbU8
TLSH
T17F320A36BC68AC7A8DE6B640F04632139FB48167DA863F80D5ED5E1C01DF69C630792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2da48baa3be126f3e6e6ae59b9136a548f4265b125e728ab97ba4dee5a5dcd5d
MD5 bf8962a6240ade7026dce8074ee00f0e
SHA1 35fcb680a48dccfb2cbc49466d7fffda272d3006
SHA512 73e0c9d90872b20558be57390ad4ec0758b83bb640f981869964e5281c3230d9cfec0b98e856d48af46775f0ff7832c274c14e2913b9e439457aaa5fb8024fc5
SSDEEP 96:7qONkkQsjpfQu+X/QE5ih/cIPURHl8h4otop5uMD4jBQPQvYjQf0gZg17HlRWIn3:eONk6v+XaQmiUyP49CmbgzlRWIe3mU6
TLSH
T19202CA39BC686CBB9DA2AE05F48737135FA4106BDA963F44D5E85E1C00DB65C134392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b3f0372a259be34a705359e8fa5120758d86275e6b6c73f2cc4168603da62652
MD5 66d4ac885a3fdf9080256f32c8dc5cef
SHA1 9987f5087f9137b975c37bb924a37b525e7efcd6
SHA512 f0d4733db78d1724944e239a36a23c9489289563c91597431ef87697083d412c842d56edb5dc06ccc12d10e6c6b53abc591855b53b0d098dbca342969b5e9544
SSDEEP 384:nSZcI+sNbApYX5Q72q09nwL8vbOOPrXLpe8C/Kyh:g+2LG8vbOi9P9yh
TLSH
T195926D75AC7C6CB69DF6E640F48633039FF89163F6C62F44A1EC9B1D05CA598130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2f23b3371654254cb32fd71e015f819104f9fa0130c671b04c3814807a38832
MD5 dd28ab5b7cfa28d3468a8ff7ba4d0f61
SHA1 9612aff989b08a778afef3a015980f1cf6688de9
SHA512 2f7a3bf87d94859fdbce7f6399c9d2af444c75c745a1cd02e521d837004cb3e0126185100a73f72fd2362d20216d5fc7593b7e98779d9c8002f5eec55c28683e
SSDEEP 192:5ONO6v+VQmiUyt49VmbgoIL7DDRiWI8qlU6:5ONO6vUlVpLQvbU6
TLSH
T12712D83ABC586CBB5DA2B550F08732135FB58167EA8A7F40E5EC1E1C01EF69C6307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fccba499-22d2-4349-a327-da802e559f29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fccba499-22d2-4349-a327-da802e559f29.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5cc0f503f6986e92435cdba8de83ebafc375df124eca4f2ea19454fc8e79f0f3
MD5 8784daa5ba650c56390d069b4b731738
SHA1 fcf8b3c11334e7ddb981a6a65fe840d9031b8714
SHA512 1729cb154b685c914332a81693842dbf80d03be3ff369c8428edf71c13f9dfbe4c06510a81c60db89cd81b03642de7ff4d9a1aeea228661784e7081bf5f3e353
TLSH
T1C941F45CAAFA1108B3776F5A9BF7A86D587BB8772E0A905D00110D4F0627B40D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

c66eafcd-b8e8-4130-8fa1-f87be934c1e6.tmp

Path C:\Users\Admin\AppData\Local\Temp\c66eafcd-b8e8-4130-8fa1-f87be934c1e6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_1417989052\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nf6dr9.exe

Path C:\Users\Admin\Desktop\nf6dr9.exe
Size 150KB
SHA256 e48f6cf038c5fe69e4fe1c7a224df32e963a48a82ea428dfa38a5dcf221cad7c
MD5 1dfa88a8807eecb32e106c1b2c82bc44
SHA1 79456941b6c816ce3fe8d4ad3137d80e0c1c8a3d
SHA512 91df5fcec141bde821e05014333cc71c653c0598bc71b4f093bb07a677747e3104cd9e42b860efbec9caa57d53c76e078f051d8ed8505c696d252f70d8739cac
SSDEEP 3072:0QeuLZ8OB7/Us7sMDcFS0DzbskwBmJTQSaMm5/6Y5vg8h:0gNpBDUs7ncFSQ31JWljGQ
TLSH
T1A7E32A1797A9106EE1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F327D0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test-redo.exe

Path C:\Users\Admin\Desktop\test-redo.exe
Size 808KB
SHA256 e64c44caa75c52ad0db779c9161e798eaf673f58d8575dbd66ad303ef5f2e826
MD5 5df3aca69e630825ac835379542fd613
SHA1 62aedd3c4354a0094220e4275e936382dab9c514
SHA512 97dc5a18cf4651e68376c1e4d18ddbea738f1fe17e21fef97f7c002446a4f1d43e9eba09c02d27f30ef5ea8e8597f4905297bd019e4f7c70a332f984ff1e3ff5
SSDEEP 12288:4PQ0NxRKj9NgrY/QU/bW6c1YV3khDx72xoYO6a8UgYibncv6f:4P3NxRKj9N1Nvc1Y9klxJv6a3ibnDf
TLSH
T14D05AF41F6F941E8D03BE13896DAA90FEA323855072029DB63D049983FB77F05BB6752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download