gh0strat | ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
Size 4.9MB
Sample260903-mk8xta1vdv
SHA256 ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9
MD5 b30a3398e832ea4c80b2f22fb1d1e3a8
SHA1 6b2fe978164dc5e2c4d3e068ad01ca815dde8740
SHA512 126f93c638bec2ea67f3c74e06da8818932548b623f03404cc62361d55e89387e71c339b9cd5e8df0ca55c18e35a5092d44a52b586033d197f7c7aa17f8c3f63
SSDEEP 98304:Rws2ANnKXOaeOgmhONSMXyN6htR5jWUgFyI2OhkgA:DKXbeO78NSQygbuP28VA
TLSH
T15D36AC82E1920862C3851971DD7EDAB26B243EAE47F305F7BA84BDC47A753C07736219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution gh0strat purplefox persistence rat rootkit spyware trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4576-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4576-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4576-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/6128-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/6128-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/816-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/816-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001c4c8-6.dat	family_gh0strat
behavioral2/memory/4576-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4576-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4576-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/6128-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/6128-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/816-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/816-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240749718.txt"	R.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

pid	Process
4964	R.exe
4576	N.exe
6128	TXPlatfor.exe
816	TXPlatfor.exe
2660	HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
2880	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
4964	R.exe
3844	svchost.exe
2880	Remote Data.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240749718.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4576-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4576-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4576-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4576-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/6128-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/6128-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/6128-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/816-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/816-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_540486834\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1649126927\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_540486834\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1885637717\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1649126927\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_540486834\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_540486834\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4160_108410947\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1885637717\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4160_1426075502\_locales\cy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4408	PING.EXE
4620	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3752	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329051739235637"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{59A56711-D94C-4510-91C3-9CD061FDD8D9}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4408	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
1016	msedge.exe
1016	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	TXPlatfor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4576	N.exe
Token: SeLoadDriverPrivilege	816	TXPlatfor.exe
Token: 33	816	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	816	TXPlatfor.exe
Token: 33	816	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	816	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 4964	5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe	88
PID 5496 wrote to memory of 4576	5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe	92
PID 4576 wrote to memory of 4620	4576	N.exe	96
PID 6128 wrote to memory of 816	6128	TXPlatfor.exe	97
PID 4620 wrote to memory of 4408	4620	cmd.exe	99
PID 5496 wrote to memory of 2660	5496	ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe	101
PID 3844 wrote to memory of 2880	3844	svchost.exe	102
PID 2660 wrote to memory of 2424	2660	HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe	103
PID 2424 wrote to memory of 2060	2424	iexplore.exe	104
PID 2060 wrote to memory of 4160	2060	IEXPLORE.EXE	105
PID 4160 wrote to memory of 684	4160	msedge.exe	106
PID 4160 wrote to memory of 3752	4160	msedge.exe	108
PID 4160 wrote to memory of 1524	4160	msedge.exe	109
PID 4160 wrote to memory of 1524	4160	msedge.exe	109
PID 4160 wrote to memory of 1524	4160	msedge.exe	109
PID 4160 wrote to memory of 2764	4160	msedge.exe	110
PID 4160 wrote to memory of 2764	4160	msedge.exe	110
PID 4160 wrote to memory of 4704	4160	msedge.exe	111
PID 4160 wrote to memory of 1964	4160	msedge.exe	112
PID 4160 wrote to memory of 4704	4160	msedge.exe	111
PID 4160 wrote to memory of 4704	4160	msedge.exe	111
PID 4160 wrote to memory of 1964	4160	msedge.exe	112
PID 4160 wrote to memory of 1964	4160	msedge.exe	112
PID 4160 wrote to memory of 3052	4160	msedge.exe	113
PID 4160 wrote to memory of 5116	4160	msedge.exe	114
PID 4160 wrote to memory of 3052	4160	msedge.exe	113
PID 4160 wrote to memory of 3052	4160	msedge.exe	113
PID 4160 wrote to memory of 5116	4160	msedge.exe	114
PID 4160 wrote to memory of 5116	4160	msedge.exe	114
PID 4160 wrote to memory of 2808	4160	msedge.exe	123
PID 4160 wrote to memory of 2808	4160	msedge.exe	123
PID 4160 wrote to memory of 5524	4160	msedge.exe	117
PID 4160 wrote to memory of 5524	4160	msedge.exe	117
PID 4160 wrote to memory of 5524	4160	msedge.exe	117
PID 4160 wrote to memory of 1900	4160	msedge.exe	119
PID 4160 wrote to memory of 4696	4160	msedge.exe	118
PID 4160 wrote to memory of 1900	4160	msedge.exe	119
PID 4160 wrote to memory of 4696	4160	msedge.exe	118
PID 4160 wrote to memory of 3452	4160	msedge.exe	121
PID 4160 wrote to memory of 5832	4160	msedge.exe	122
PID 4160 wrote to memory of 5832	4160	msedge.exe	122
PID 4160 wrote to memory of 2808	4160	msedge.exe	123
PID 4160 wrote to memory of 2808	4160	msedge.exe	123
PID 4160 wrote to memory of 2160	4160	msedge.exe	126
PID 4160 wrote to memory of 2160	4160	msedge.exe	126
PID 4160 wrote to memory of 1292	4160	msedge.exe	127
PID 4160 wrote to memory of 1292	4160	msedge.exe	127
PID 4160 wrote to memory of 1140	4160	msedge.exe	130
PID 4160 wrote to memory of 2024	4160	msedge.exe	131
PID 4160 wrote to memory of 5744	4160	msedge.exe	132
PID 4160 wrote to memory of 5308	4160	msedge.exe	133
PID 4160 wrote to memory of 5308	4160	msedge.exe	133
PID 4160 wrote to memory of 5628	4160	msedge.exe	137
PID 4160 wrote to memory of 5628	4160	msedge.exe	137
PID 4160 wrote to memory of 2944	4160	msedge.exe	138
PID 4160 wrote to memory of 2944	4160	msedge.exe	138
PID 4160 wrote to memory of 4660	4160	msedge.exe	139
PID 4160 wrote to memory of 4660	4160	msedge.exe	139
PID 4160 wrote to memory of 700	4160	msedge.exe	140
PID 4160 wrote to memory of 700	4160	msedge.exe	140
PID 4160 wrote to memory of 1016	4160	msedge.exe	141
PID 4160 wrote to memory of 1856	4160	msedge.exe	142
PID 4160 wrote to memory of 1856	4160	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
"C:\Users\Admin\AppData\Local\Temp\ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4408
- C:\Users\Admin\AppData\Local\Temp\HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
  C:\Users\Admin\AppData\Local\Temp\HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://se.360.cn/"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x110,0x304,0x7ffbd0dec188,0x7ffbd0dec194,0x7ffbd0dec1a0
        6⤵
        
        PID:684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,18219506717155160881,805693986397101081,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,8133617883578286449,4145904469752790326,262144 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
        6⤵
        
        PID:1524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,289620391161523407,8836475977320341501,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
        6⤵
        
        PID:2764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,8396763487909089095,6839431440769044023,2097152 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        6⤵
        
        PID:4704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,5161390940206609226,17760584243676692783,2097152 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        6⤵
        
        PID:1964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,17322448832717064000,12328914610246894843,2097152 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,6616922973617210052,6035537427852898768,2097152 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
        6⤵
        
        PID:5116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17634982895534634478,16070521156007723671,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
        6⤵
        
        PID:2808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5240,i,215490012814150605,3058498032038493984,2097152 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
        6⤵
        
        PID:5524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,8558171402355590294,4951242158559341819,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
        6⤵
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,17181158862427192588,5710357887652797442,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
        6⤵
        
        PID:1900
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16812825282555336545,8001137825251398194,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
        6⤵
        
        PID:2020
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16812825282555336545,8001137825251398194,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
        6⤵
        
        PID:3452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12898487501599710592,7896601133311259831,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
        6⤵
        
        PID:5832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4931431551028686918,1644663538137922400,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
        6⤵
        
        PID:2808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,1868871345868744366,14406148968741314601,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        6⤵
        
        PID:2160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,5977130846299742650,12508576920191876975,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
        6⤵
        
        PID:1292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,5618839210213361508,16112520548543766647,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
        6⤵
        
        PID:1140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,12063077764708270089,12781828433343335532,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
        6⤵
        
        PID:2024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,12328498018530384268,3677418489313142583,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
        6⤵
        
        PID:5744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3279151461985931060,8679754151049779397,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        6⤵
        
        PID:5308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,17993755496599853937,3523902802510420570,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
        6⤵
        
        PID:5628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,1690357442341654477,7626842875163646867,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
        6⤵
        
        PID:2944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,17935565673199366238,8074001035977295598,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        6⤵
        
        PID:4660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,17095815573418727416,246275396053279384,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
        6⤵
        
        PID:700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,11742822234732700504,14844944173571743708,262144 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15037038717569356543,6943127682461982441,524288 --field-trial-handle=2516,i,9718282479236452201,2101437899260317099,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
        6⤵
        
        PID:1856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240749718.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2880

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "Remote Data"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

018ac842-b601-4181-aac6-3ef6b3ff022a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\018ac842-b601-4181-aac6-3ef6b3ff022a.tmp
Size 12KB
SHA256 e3dde5164499d3bff2467258c4678a0f67b1827aaa1925ebf3582a6d10ac304d
MD5 7dbc14f5f4afe99bed76872c2d3d63e6
SHA1 3c9a0d5b0b978afedb9c6b5b0a96ff65f264312f
SHA512 2864472f6ea6941bce2c4e393361545c4989899257ba10f7bbd238c8ad173ec665091fa02731d8c529aa115534cc91f5043bac8ba5da4ce90e7d046967e3f2f0
SSDEEP 192:sxR1RjCLf/f8szT2/ZHB5zoA8pK0/g6+WNeHA/YnBULuLGTIgDI48oJ:sxR1wLf/f8sP2hy//5P/stej
TLSH
T14E42B656AA28AD3B4CC7D21DFA15BF53D6FA6032A1D01E48A6FC9A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 89a8fb3b18c11c3c16f23e74288fa0a7efaa1be102c2f26c39fcac4c74416ba4
MD5 49828947023e7ca4f5ccaacd02346c20
SHA1 c8afd863084fa69cac0ca0037d9e095ac94f596d
SHA512 320e556867d29030cc182b876335b25837f5298702e826b487d33851c217696691304b6f871e02864f31e696cfd76e04acc6445f775ba64d56f529c7f2d6cc6f
TLSH
T1DC512D5CA37605DAE76047B2BCE384953FF18CAB19035E072050AEB819C6F075EC2D97
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f9c1fe8d2bc27b081f10c394e316563b3e36b0e631ea37cf6aebfbc06cdd28b4
MD5 e9785820103f700ef8166521f5e8fb50
SHA1 2285a44e7f742456d3a8e581a65a8565f73ba5b5
SHA512 38b20c3fcfeb030e10543a2187741b71412f034a2d1436f2a5b4f3a8807452387188a9c27cc42686e8563cd73a2bc43d284014943e744e220edc12651b79c808
TLSH
T1E3512E5CA37605DAE32047B2BCE394553FF58CAB09035E172040AEB855C6F075EC2E97
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 798c5c15779a38d24c89775eee5165a8e71cd8f069f12fe2803a3ca8bcee7ca2
MD5 8cac4968d063b11a6c27d10e661d5b68
SHA1 38e4e1e53f3d50a74178714af85e99d8f955e686
SHA512 cee917171a22d88b92eba87e8ea1075de7599a3738db55a0090db6793d4d051b751d51b55c2df385ea825cb985ae0b9bf3b1ebfcf58ceb04f6bbc321baf735fe
TLSH
T1AB51BCF383B9857ECE1196F0EA046E2FCE1C0912436C795A85E0AE1793F7871E180A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb1e4fc41ea13aaf685d55b7a9936d9978026535d09f073d0f1fe1c64b424619
MD5 291bedb1337d2c9d3bf46ff35f7813de
SHA1 af5219f5b42581b36ce2464f1eefadd987aedcee
SHA512 9b3db291e53b2dddcf997814300b6ad76eebb2759cf3271b619c6017c2289307148498e656bededf501abf544bc3a2c24ddc711a9eca009b8fd19dae3a79e85a
SSDEEP 192:sxRbRjCLf/f8szTP/ZHBVzoA8pK0/g6+WNeHA/M/nBtfuLGTIgDq48oJ:sxRbwLf/f8sPPhe//5P/w4e9
TLSH
T14342B6567928AD3B5CC7D21DFA15BF53E2FA6033A0901E44A7FC8A1C14E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 91e52f924b4c84587e3b9ca496f0ae1587c1a3f815283edb5153571ed1cbeba4
MD5 105862cb0b11b9bae082c5d250ed0864
SHA1 d9c47df78a29f6bbec202d35cb0c62a6fade1fce
SHA512 48b0d2a1e6d95e112f0813c3d2c682f2e24d01249c24618ab9ab465c559e5cf2e12d22670b7f2ce4b107cc20c7790eaed7871d2cd34ba5ea26f0cd6275e31d7c
SSDEEP 192:sxRWRjCLf/f8sgT2/ZHB5zoA8pK0/g6+WNeHA/YnBULuLGTIgV48oJ:sxRWwLf/f8s62hy//5P/stei
TLSH
T1CF42B6566A28AD3B4CC7D21DFA25BF53D2FA6033A1D01E48A6FC8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8f4e743ae22693dd5af6cebcf3a8e492827bcfe532a5f41435600fac3fd64175
MD5 c8372f869a6dc9a1e6c538a09190bb81
SHA1 eed0ad5936f7562b674caef4ae72b6766a1f8592
SHA512 06a63ef067b0227124e01ba28e5c629d404550c6fc1a83838fb63f69e25c5a32c0dcba1c832f812c73e6dcb6b67c855e472b4bf932625a00f57897d615155a3f
SSDEEP 768:wb8dYE7pLuLzR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmZRu46yrohV55Z:wb8dYIEzR6Wgouf6Mu1jaNZRV6pdj
TLSH
T1F5D2DA7B740DCB7E4F800ADDEC19BE9F6D6802CB96D8CD4447FA851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b09f8b41d221d25014bbaa3e2c103168ac8b250e14d12fbfd734afbaf1e9b38e
MD5 9b86c3147e300322b68b07c6c81ec2d1
SHA1 9eb24e7ceeeb93d18115b03eb146e2dbf0280b47
SHA512 2465e8c3cd1ff057f56fb8c95291d2209e564a0d94a983eebe67ae4e7711c99d48ab82f1626d7e75eb5bae646f26af06cce41e8ff62d88bf2277104396c2c682
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHCHuC0UECWMZxgyCK4ngoCcSaBgJFGK2UV:CoZs4q26neDsgU1gC/wgziItHCHuC0U7
TLSH
T129919890307B0244387D6A0D8175995E96C178A2319DF6AB7BA801A24FA7E074FFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9e83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9e83.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5dc772a63f019df52115023a96386fdfaa64d11cf20a51a0fd6740b847a4de8b
MD5 fa3fc3203f220253b31b23cf044b25b8
SHA1 cbf138c23b40043587680d32624d5ecc03be971d
SHA512 3803c538fbc2affff5261b547feb706a23ffe8256c2b978cb34859f0f6df2f5e4b1c043fec6b9bed60a4ce6ff27a3ce677cb5e6dd8f07294f8bb67e0a1a2c63f
SSDEEP 768:ej3DanDZIO0nBJ6Nzc4ReyIsPlD184p4IY:ej3DXBJ6tc44bsdWtIY
TLSH
T134F2AEB1B8659CA7ECEEA246F9073643BDF4516B81C85E84D6ED9F0C08436AD0B1F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 09fbfdfc866cbeb28de888eef1cf7429bfd52db1e7ca4697dc288352df36161c
MD5 144410a9da04326dda8f3b8d70f4ad08
SHA1 d3b0d666347c6234b09a70f46ead38b1e308a792
SHA512 d853f4bef06ff646045aedad986b783867a173cf7ddf17d29ffa5028f22d2e9666f777b5f31637d9f45bbdc23fb041514e0967c46e84cd734bdbf0f5a0b72823
SSDEEP 768:JFQ13twgRrGZQ5O0nBJ1Nzc4ReyIsPlD184p4IY:I13NRBJ1tc44bsdWtIY
TLSH
T1F21306F5A8D78977E8AE5383A73D6D429DBCD167B0885984B7D85E0CCC821BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 21660e42e3b3b08f843e556a7f1ce25579bb4943b8ec91d33cf90e6a60e35097
MD5 b1a7a21350b70c7b8c7f882780baa1db
SHA1 bebc1acdd3bf81c0e83555394dc78a10b164bb9c
SHA512 4cb4cac8f0095a8ae8ad2273001b5b08b32426eaa32ede421b33eb7e8103e2d45b2429f0c1287a4c71ec06c44b9eba7437bb4cdfc3e780c01ad5e2013b0ce671
SSDEEP 768:Qj3AanDZIO0nBJ6Nzc4ReyIsPlD184p4IY:Qj3AXBJ6tc44bsdWtIY
TLSH
T17EF2AE71BC659CA7ECEEA246F9073683BDF4516B81C85E84D6ED9F0C08436AD0B1F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 00ef6cdad39a9f2b3bd27ff28e4ae53bd374e533580bcc1a3c82098a8b1a09b2
MD5 50308ea710f29f8f5d630ae6b4dbee07
SHA1 d64a17b0bfe8e62da7f013efd0b2ccedb53e3e4d
SHA512 508e7e78bb4032977734574500e22f6e69162807bc677241a69a1889a06901e18ffd8e76f03c2761e227330e28bad1451623757e972bd006af9330a49acba359
SSDEEP 768:6rv+4UNbds3EfDZIO0bNzc4ReyIsXTeVH1S5D:6bsbS31tc44bsjEH1Y
TLSH
T16A03CF36A8688937ACFAA686B50775137EF8512B82981FD0C5DE5F4C4A8B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 66bd5ce5ea42198789702764f1f67e7835bfd89c092d49cb198d27aa9ad4bd09
MD5 30fe51915d71565b56fc5fbed4c8b85c
SHA1 7ddf86430f7876b6d018b317766a7ef00243e134
SHA512 72b08d50964adaca07d3d28af34885c107ddecb374707a7a397297d35eb5d88518c9796fb25798d4fc49033b99c8332573f86c4aa1a0e2f10da08dbc4693e145
SSDEEP 768:0rv+4UNbd83WnDZIO0nBJ6Nzc4ReyIsPlD184p47:0bsbG3DBJ6tc44bsdWt7
TLSH
T13503BF71B8289D73ECFAA246F50B76537EF4216B80C80E94D6D99F4C49472ED170F912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cfa93bb43a89b0ab81ee5e699611a17adc77acd636faa9ec22edbb0d51539392
MD5 edf991eb07b3ca73e168612967e942ef
SHA1 833f07d8c7ad054ce7b60a06f9616c38329c9a45
SHA512 69cee029091d194450bc39f4eff5a6a9b8a209d58da9c2aeb5de54aa5a0c00befaf39353bd07d3f0c8d08253e854a50f79c8c458ac01cb0e22791a49f1ee889d
SSDEEP 768:Erv+4UNbds3Z9DZIO0nBJKNzc4ReyIs2leVH1S5D:EbsbS3uBJKtc44bs2EH1Y
TLSH
T1DF03CF32A828CD33ACFAA686F04776533EF4226B81880F94D9D99F4C49472DD174F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.3MB
SHA256 081170d6ebb481a8f9b9bb5bdeca6725f9e7c512772a6a3734008effbc550997
MD5 afd14196d4948795c7baedbeb75ae857
SHA1 2f1d6b652638d325e402a6030d6c91d6bc24b479
SHA512 0102b8cd268a35cf71da55f5a6e905cf29909ac2b7fd003876568f141fef53bf89914bdeaba0f3223456a92deb31cf0a386098c8325453c0ec5f95eca7df3044
SSDEEP 24576:mCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHz:mCwsbCANnKXferL7Vwe/Gg0P+Whlhk
TLSH
T1B3B58D47B5A54872C3C84671DE67DAF39B207EBE57F306367A48FEC43A352447A22224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9.exe
Size 2.6MB
SHA256 629fbc17f835cecdc1e2f50dee24a371223edf028b0fd9e835cf68dcbada2529
MD5 04a433fb9a29275cbfccda52cb1dca90
SHA1 609b3aa9918ce1f874ea82ba2340f9de117a314c
SHA512 e2be5e8ee2856e5dc1d01cfb87784f70bd8e81f294b0429bf289c532f5268da3a7f5434d4a57c87c0db8ca491b1ec85d947e378f5824b64cd2a42a67784cc1ab
SSDEEP 49152:I3/lSI5HmPJhtG6ToOKOo0vfN6htBz5jj2HUgFQJ6j8r42/rTmJ7kgdcROG:INSMXyN6htR5jWUgFyI2OhkgA
TLSH
T127C5BE81E1921860C7522871EC3DEA3927293D5D97F644F3B780BDA4BAF53D0733A689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f991fb54-d077-42ee-97d8-940013bd4f1f.tmp

Path C:\Users\Admin\AppData\Local\Temp\f991fb54-d077-42ee-97d8-940013bd4f1f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4160_1356346086\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240749718.txt

Path C:\Windows\SysWOW64\240749718.txt
Size 899KB
SHA256 11eb1d4602cea7cbca15890f36f5d91b87e200cb1c594c74dac774d8da258e77
MD5 b32d660cd9df00ad939f397087553c6b
SHA1 34efded7ea8e6b3eb4eb9de809522640049328cb
SHA512 3e970074ffb2da27ac5b7a7a975047ef40fc7cb67bf677c8b4ec02ca6c9a07237bbe82924537b78e67336e4deb0fcadf275603e5391e87ded566a8810b4006a5
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXj:7wqd87Vj
TLSH
T116152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote Data.exe

Path C:\Windows\SysWOW64\Remote Data.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/816-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/816-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4576-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4576-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4576-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4576-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/6128-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/6128-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/6128-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download