hxxps://cdn[.]discordapp[.]com/attachments/1520220324178690158/1539235741882912830/Launcher-3[.]exe?ex=6a85947e&is=6a8442fe&hm=65e57ebb4eaf2f775d2e4b184ad6cd2faec3923ee324d64173178ba529cece43&

Analysis

user interaction
yes
max time kernel
75s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1520220324178690158/1539235741882912830/Launcher-3.exe?ex=6a85947e&is=6a8442fe&hm=65e57ebb4eaf2f775d2e4b184ad6cd2faec3923ee324d64173178ba529cece43&
Sample260818-sy76bsaa38

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	3196	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4700	Launcher-3.exe
3040	Launcher-3.exe
3064	Launcher-3.exe
3928	Launcher-3.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Launcher-3.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3196	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher-3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher-3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher-3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher-3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher-3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher-3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher-3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher-3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315407982736910"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{F89C4625-CD75-4A03-8BE9-D95F9D380C43}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Launcher-3.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 792	3052	msedge.exe	80
PID 3052 wrote to memory of 3196	3052	msedge.exe	81
PID 3052 wrote to memory of 4460	3052	msedge.exe	82
PID 3052 wrote to memory of 4460	3052	msedge.exe	82
PID 3052 wrote to memory of 4460	3052	msedge.exe	82
PID 3052 wrote to memory of 1948	3052	msedge.exe	83
PID 3052 wrote to memory of 1948	3052	msedge.exe	83
PID 3052 wrote to memory of 3204	3052	msedge.exe	85
PID 3052 wrote to memory of 3204	3052	msedge.exe	85
PID 3052 wrote to memory of 3204	3052	msedge.exe	85
PID 3052 wrote to memory of 4312	3052	msedge.exe	86
PID 3052 wrote to memory of 4312	3052	msedge.exe	86
PID 3052 wrote to memory of 4312	3052	msedge.exe	86
PID 3052 wrote to memory of 5012	3052	msedge.exe	88
PID 3052 wrote to memory of 2836	3052	msedge.exe	89
PID 3052 wrote to memory of 5012	3052	msedge.exe	88
PID 3052 wrote to memory of 5012	3052	msedge.exe	88
PID 3052 wrote to memory of 4088	3052	msedge.exe	90
PID 3052 wrote to memory of 2836	3052	msedge.exe	89
PID 3052 wrote to memory of 2836	3052	msedge.exe	89
PID 3052 wrote to memory of 3644	3052	msedge.exe	91
PID 3052 wrote to memory of 4088	3052	msedge.exe	90
PID 3052 wrote to memory of 4088	3052	msedge.exe	90
PID 3052 wrote to memory of 3644	3052	msedge.exe	91
PID 3052 wrote to memory of 3644	3052	msedge.exe	91
PID 3052 wrote to memory of 1068	3052	msedge.exe	92
PID 3052 wrote to memory of 1648	3052	msedge.exe	93
PID 3052 wrote to memory of 1068	3052	msedge.exe	92
PID 3052 wrote to memory of 1648	3052	msedge.exe	93
PID 3052 wrote to memory of 4464	3052	msedge.exe	95
PID 3052 wrote to memory of 3624	3052	msedge.exe	94
PID 3052 wrote to memory of 4464	3052	msedge.exe	95
PID 3052 wrote to memory of 3624	3052	msedge.exe	94
PID 3052 wrote to memory of 3624	3052	msedge.exe	94
PID 3052 wrote to memory of 4916	3052	msedge.exe	96
PID 3052 wrote to memory of 4468	3052	msedge.exe	98
PID 3052 wrote to memory of 4468	3052	msedge.exe	98
PID 3052 wrote to memory of 3100	3052	msedge.exe	100
PID 3052 wrote to memory of 1192	3052	msedge.exe	101
PID 1192 wrote to memory of 4876	1192	msedge.exe	102
PID 3052 wrote to memory of 4000	3052	msedge.exe	108
PID 3052 wrote to memory of 2516	3052	msedge.exe	109
PID 3052 wrote to memory of 576	3052	msedge.exe	110
PID 3052 wrote to memory of 1716	3052	msedge.exe	111
PID 3052 wrote to memory of 1716	3052	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1520220324178690158/1539235741882912830/Launcher-3.exe?ex=6a85947e&is=6a8442fe&hm=65e57ebb4eaf2f775d2e4b184ad6cd2faec3923ee324d64173178ba529cece43&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff974b1c188,0x7ff974b1c194,0x7ff974b1c1a0
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,4098420695631311121,8586091327351096387,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,1860330573812655639,6481146478608442228,262144 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,105051160912238292,13023836367228067367,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7552087888501073196,12856745367811284193,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13295550645675459443,15516096986931601097,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,9820006486025236711,18067790206943719516,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12404127308379565624,3411929371425298467,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4324,i,15827292764396435059,11873389386453245236,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,15373462478008207209,10890926976593494881,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:9
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,18164759610201093670,4960899274501774361,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,11222782759763445053,17733086532344592824,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5872,i,2234504885438622724,15898810136834369752,2097152 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,17607487716585888914,10570759500986730298,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,10786239757708414169,17284406132428282820,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,6503125142513125403,14608604641786214868,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,4137574810768344910,5598426795917759261,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,4137574810768344910,5598426795917759261,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,11440762436539089510,11860759092662620804,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,1931343211883726092,4526024942448046984,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,3023227551996220955,4875334249361988343,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,14523264803735531138,14444870278627506350,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14728786874873595972,15400243689483835037,524288 --field-trial-handle=1944,i,10190544172527905845,16055068251192757928,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2116

C:\Users\Admin\Downloads\Launcher-3.exe
"C:\Users\Admin\Downloads\Launcher-3.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4700

C:\Users\Admin\Downloads\Launcher-3.exe
"C:\Users\Admin\Downloads\Launcher-3.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3040

C:\Users\Admin\Downloads\Launcher-3.exe
"C:\Users\Admin\Downloads\Launcher-3.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3064

C:\Users\Admin\Downloads\Launcher-3.exe
"C:\Users\Admin\Downloads\Launcher-3.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9efd6d18795130d74d1ed1d7e571c792e82b465ae350be8746269b37084c440d
MD5 ac7b2bfbba54558cc9088ae2e63ed975
SHA1 96e56bd8d63f362becc2aac3e25c9673f399b0b2
SHA512 84cb66fc5952178c256aa93102e2ca6e897edfd7fa421bf18ec76a9cc4bebc1f673b5cd0c81103caf854110ce78662c0071c8ca1704f153cd3c2d408d138a8bf
TLSH
T152610939CD56CD43EF61E130A8EF620B317F0C66CA331EEA01D4A5716F66625CCAD408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585bf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585bf6.TMP
Size 3KB
SHA256 da52904059a04b62a6f08ab5824691ba6f9fb52960de8e9e02b7267b1040fff6
MD5 b61c3732406400cb98d31f8a7c5e08fb
SHA1 5c38ae4e0f48ee20b4d7bdc95c0aee94261ea8d5
SHA512 d317fb111f35ce2c13b51279ae5584b33ccbc13e893d988efb2f94831c0afb604d502887eb5fe6f7becb6d619169cdc339273681df85564fc84f268db761b5b5
TLSH
T12D610939CD56CD43EF61E130A8AF620B317F0C66CA331EEA01D4A5716F66625CCAD008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ad0b59a1a5d546af9ae0956f069745494495c02f93fdf8ebf367923dcd427f35
MD5 50b11cf65941a1b0cfb883c58043a584
SHA1 e64a8ae33b3ab266a339d5ba47bbfdea9c2bf4de
SHA512 1f44d83cee099cafe850fc316d92e7c83c1d1b9d6872be215ad284dcb3a25a5e20e64ff9ae2ec2b72d9ca1b8ddc9632730c9800c6e3ae8166e45a379dc495802
TLSH
T1D7213DB3C7D586AE890116F06A28AE1BCE2D0A0543287C1A89D4EF6B97E3475E11155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fa2f7899a719090d0f75890e2b73f55e5876cea63dfa0dac7fc53cae291af5ec
MD5 c2f7276b95b361eac2cf7887d3d0ebc3
SHA1 4f0d583e0606d0f6c23b807ce0d37984666d8acd
SHA512 077b5b5e70d47fa3ff56000e39bb00b1a0e43c5abe647eac33f4b773ed2fe5003dad1ce4b7af816d997746691c54b0c405daff27926f9c070d2506916eb5f736
SSDEEP 192:sxZ2RYyM/jK1Ml8MoX/fXs0JgQZIdpM/W6+WNGY0a+qz6+DIgrJ:sxZ22QX/fXs0JgQyM/bG51Xw9
TLSH
T1EE42D612AA34A977CCDBE209FA45BF53D6F9447292910D44ADFCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 15623e08ab80550f38976de8ed0cdf1775c54ff76f3655248aabf6999f8d2880
MD5 3d1477c3b56912023f37f257b20af724
SHA1 3a15d6d7ebb45b7d0f40b104f0da6e7d0281789f
SHA512 fab8c477cd210dedebdb0d2aaa3d96d96b81f97911793db743090ca0347304dce435a42ef67555ab7c2d5775cd5039da282908ee5845c8e2a80b1f0bc199a9e6
SSDEEP 768:gT/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VmErotS:gT/zh8dF2PkWRmEcQXwu1jaKWjLp2tVr
TLSH
T112E2092F280CCB7E4F845E9CEC26AF976ED801CB66684D5447EA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0709dafc1f6f0385f73cd8dd6094d4f822aad43eef703c9b28bf9b2f48233558
MD5 ae200f311f96b81e246b9d3b66a0e0f8
SHA1 7a8a3c624f60f3626fcabd4928ca4760ae6e29da
SHA512 70bf5c363cbe9d73e8d14ffa6ce974c2307e1bb4fd720081164c10d4366ba2a503a715f65370ba6bb1757e2007531cb3b53a98972eaa130e64cd3f545edd85fc
SSDEEP 96:KEWgKvLu4KHK6yugKbiYicKPKee7WKkog:2IvnorNp
TLSH
T1F0D1361273BB12123C7F2908D29487575B8272A37014A52B7BA800728DE7E795FFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fa3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fa3a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad930791b1660821366a0cbe844a4b8c5b443a527dd2e76f8cecd83c23fb4c28
MD5 47c3e4f1983af5420e722180628689b2
SHA1 c31b7d2d5df283b4b08457ea1a96c45aeff1652d
SHA512 4f8d1c891308ea23a51addb1414d01dba6fb9302cb1768e9ae4f2f817538e04ea47dd8ab15d8bfc70d40768487bc9dc7c21b87deb5b1339b83a07de8b8eaf784
SSDEEP 384:ZZcIs8NzUfcfDuNEYgnsUOUnJwySllYJTfY81F1cQBu6:xsYfDuIsUOUnJwZuTHfZBu6
TLSH
T143926D761C245C779ABAB149B88A36074FFCD067C29A2F80D4EC6F1E02DF59C1316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 94f7696ae9ff7a4daa2bb0b2be000e69fab83edb5c786fa38499b897ef2a5ed3
MD5 70c3630c65ad0134d45a80ffe162a30b
SHA1 6cc6433339667691f6d96c6f18408e5ee05b21fc
SHA512 43ca8c6ed5192b277ec9f698256093a137c8fb0efde62c48d602df9481de9a31a0961136929fac7cdd5148d6565d1cf94ecaa38901d714ee1e797c989eae32c4
SSDEEP 384:PiFiZcIO8No8TUNTUlIlEcfDu+EYgnsUOUn5wySllYJTfY81F1cQBu6:aFQO1wgrfDtIsUOUn5wZuTHfZBu6
TLSH
T17AB27E730C54987BAEBAA645F94A32078FF890B7C69AAB80D6DC5E1E01DB5DC1307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 84387078f89fd453ba5988db8adb59ffaa41e134abd74d28f907d63a4a791918
MD5 a1a7840ddd8114f7ab45c07a650f2b69
SHA1 48b2911f075aa34de8a8dac97c70f54fefbf3873
SHA512 d0c59a811b94ffe24da5b288fbebce18c8b582d16ff6128c2c97c672c812e3fb6ff344ebf86f814ca4789051d97aa69cc25122c39e01ba6b75221879362463e8
SSDEEP 192:BGNHU6P2UOcQmiUyCIUzqGv0UOR1wSj1U6:BGN06eXslIMqGsUOnxU6
TLSH
T14A02D8396C682CB78FA2AE45B98737179FD8107BE9952B80D9D41F1C00DB65C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 360c6c1dc5e2812ba8702de9cd8fd3701561d5a915aa9999f562e4c79076ac8a
MD5 48f4ed699643bb70695739a7627ea8c2
SHA1 034d701bad89ec8ff140994b9b05c45baa1d467f
SHA512 68204bec11fad6e3eedff64fdc1e37bf1b37dcc32150f64bcc2722ab9712ea5e10eab197eaf0ef3893b3425bbc9e2e8e4499674fe9ee5b98d1d3d1d88b7d1760
SSDEEP 384:hZcIg8NzUEcfDu+EYgnsUOUnYwySllYJTfY81F1cQBu6:pg9fDtIsUOUnYwZuTHfZBu6
TLSH
T101927C761C246CB799BAF145B88636074FFCD067C69A2F80D5EC6F1E02DF59C1316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c207db28ecbc54ecbf1361d29f127ada417bd93eabb36bec7396c6298e1047dd
MD5 464b8f7a86d68722bc15d21847e5bb2e
SHA1 58504407444bf5ca41027716b3a6d4fc0275fe3a
SHA512 8f442ff7796338b40b503c3a715d1de2e744a798fbf93bfaab40ae41b6f53c4fdec95c5cdfe9876bf26c664e2612dc6bb8bef3f24185e55345813972408c783f
SSDEEP 192:gGNp6P2UAQmiUy9EzAGv0UORynb0BbqvU6:gGNp6eDU8AGsUOUnMwU6
TLSH
T1381209766C686C775EE2A544F8C736078FE85067DA8A2F80D4DC2E1D01EF95C234B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 84c641df0df59863093f16cc94c3f809e4d3ef95252418e3edfc49cabffe93c4
MD5 f75033186de7f9943bac06af0962bd96
SHA1 7a81763f4022396470d2e8c0def4446a8bdfb350
SHA512 2877e1517dc0641e932ab97670c4a55f179ffac1d5d5beaed85823e434d3f9ac0c025088f97ee03e9a799c730e8f674c8320b9c9354fabd82af2cdfcb384bfb8
SSDEEP 384:TZcIg8NzUjcfDu+EYgnsUOUnYwySllYJTfY81F1cQBu6:LgMfDtIsUOUnYwZuTHfZBu6
TLSH
T1B2927C761C646CB79ABAE145F88A36074FFCD067C69A2F80D4EC6F1E02DF59C1316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Launcher-3.exe.crdownload

Path C:\Users\Admin\Downloads\Launcher-3.exe.crdownload
Size 1.1MB
SHA256 9f67292e0a33037b17bfe3460dd37f8e71193002f1a22d7478f0725b541f4e18
MD5 cba43d3a1bc38daa601a46725b22fdb9
SHA1 eb5157903011bc7fbf9f7c92d282994b4035826a
SHA512 aa4dd8b718c0f12919c730ccaed021908312791aa47ef719c7adcd5e4fc91d8ddd4f5142c0020361a61270014ec84f0c852bf9febea06fa91d0477a86cc771cf
SSDEEP 12288:Nbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDFvfqItNqdg:NbOVE5ifGPRZwBvf3fd
TLSH
T1B6357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher-3.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Launcher-3.exe:Zone.Identifier
Size 222B
SHA256 7e93078bc965ddbbf933978c038ad007ffac56ee64291ee8643451eff50f666b
MD5 147e45de88b13a6393339e0e0ac7fe80
SHA1 a82a336d8b185786e4d8ca34e457fc00bb285708
SHA512 e0c7d351ead7e35cad240a64027a65f72d0be268eef4008127cbe2c346350216f508ab3d3e48cc1d4c685a0cc04a48f62024528bcb9733294881cb02f4f019cf
TLSH
T1BAD0A797804895491A5ABECC56C98301610C5845D8296480E44089AF88EB45D51F8C46
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads