3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Size 6.0MB
Sample260930-npg6bstfph
SHA256 3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04
MD5 1bfa69d124843dabda6c0daf96f35920
SHA1 0dfff80a16a4d5d2df1ded73330c2bef0e1b862a
SHA512 9028c998bc8353e239634626436c350e9ade1b8e0d7e11a852c0e997364095dc45083f8628505aea0d1e307960bb22681b5d76eca0ef2155bef40beb93108909
SSDEEP 98304:kuW5p3ZPY/10pH48u2vEf1LVdmDf4zga0AeMFHz5X9P3SCY4XA2n58UHMONAF5LN:knRY1u/Rcf158Df4zgaPFT5X53SCzA2a
TLSH
T193563302F881E0F1F2690B731A5645AA65763DA05FB6CFDFEFC032658972481B723B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4276	IE-Install.exe
2884	IE-Install.tmp
1992	Replace.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_752891184\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_720610648\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_720610648\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1128910010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1128910010\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1117196305\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1117196305\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1117196305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4700_1117196305\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IE-Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IE-Install.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Replace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6052	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c53e-12.dat	innosetup
behavioral2/memory/4276-17-0x0000000000400000-0x0000000000434000-memory.dmp	innosetup
behavioral2/memory/4276-96-0x0000000000400000-0x0000000000434000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{FACD1009-E4DE-44BC-9DCB-C2B9FDD404F5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{32698992-BF52-42C4-B60A-3065F7AF2285}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2884	IE-Install.tmp
2884	IE-Install.tmp
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2884	IE-Install.tmp
4700	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4276	5012	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe	90
PID 4276 wrote to memory of 2884	4276	IE-Install.exe	91
PID 5012 wrote to memory of 1992	5012	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe	92
PID 5012 wrote to memory of 2540	5012	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe	94
PID 5012 wrote to memory of 2724	5012	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe	96
PID 5012 wrote to memory of 4700	5012	3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe	98
PID 4700 wrote to memory of 4268	4700	msedge.exe	99
PID 4700 wrote to memory of 3864	4700	msedge.exe	100
PID 4700 wrote to memory of 6052	4700	msedge.exe	101
PID 4700 wrote to memory of 3864	4700	msedge.exe	100
PID 4700 wrote to memory of 3864	4700	msedge.exe	100
PID 4700 wrote to memory of 5808	4700	msedge.exe	102
PID 4700 wrote to memory of 5808	4700	msedge.exe	102
PID 4700 wrote to memory of 1840	4700	msedge.exe	103
PID 4700 wrote to memory of 3260	4700	msedge.exe	104
PID 4700 wrote to memory of 1840	4700	msedge.exe	103
PID 4700 wrote to memory of 1840	4700	msedge.exe	103
PID 4700 wrote to memory of 3260	4700	msedge.exe	104
PID 4700 wrote to memory of 3260	4700	msedge.exe	104
PID 4700 wrote to memory of 5584	4700	msedge.exe	106
PID 4700 wrote to memory of 5584	4700	msedge.exe	106
PID 4700 wrote to memory of 5584	4700	msedge.exe	106
PID 4700 wrote to memory of 3204	4700	msedge.exe	107
PID 4700 wrote to memory of 3204	4700	msedge.exe	107
PID 4700 wrote to memory of 3204	4700	msedge.exe	107
PID 4700 wrote to memory of 824	4700	msedge.exe	117
PID 4700 wrote to memory of 824	4700	msedge.exe	117
PID 4700 wrote to memory of 4640	4700	msedge.exe	109
PID 4700 wrote to memory of 4640	4700	msedge.exe	109
PID 4700 wrote to memory of 4640	4700	msedge.exe	109
PID 4700 wrote to memory of 2476	4700	msedge.exe	111
PID 4700 wrote to memory of 1092	4700	msedge.exe	114
PID 4700 wrote to memory of 4184	4700	msedge.exe	115
PID 4700 wrote to memory of 4384	4700	msedge.exe	116
PID 4700 wrote to memory of 824	4700	msedge.exe	117
PID 4700 wrote to memory of 4836	4700	msedge.exe	118
PID 4700 wrote to memory of 1092	4700	msedge.exe	114
PID 4700 wrote to memory of 1092	4700	msedge.exe	114
PID 4700 wrote to memory of 4184	4700	msedge.exe	115
PID 4700 wrote to memory of 4384	4700	msedge.exe	116
PID 4700 wrote to memory of 3196	4700	msedge.exe	119
PID 4700 wrote to memory of 824	4700	msedge.exe	117
PID 4700 wrote to memory of 3196	4700	msedge.exe	119
PID 4700 wrote to memory of 5080	4700	msedge.exe	120
PID 4700 wrote to memory of 5080	4700	msedge.exe	120
PID 4700 wrote to memory of 5520	4700	msedge.exe	122
PID 4700 wrote to memory of 620	4700	msedge.exe	123
PID 4700 wrote to memory of 5856	4700	msedge.exe	124
PID 4700 wrote to memory of 1748	4700	msedge.exe	125
PID 4700 wrote to memory of 1748	4700	msedge.exe	125
PID 4700 wrote to memory of 4840	4700	msedge.exe	128
PID 4700 wrote to memory of 4840	4700	msedge.exe	128
PID 4700 wrote to memory of 3200	4700	msedge.exe	129
PID 4700 wrote to memory of 3200	4700	msedge.exe	129
PID 4700 wrote to memory of 4472	4700	msedge.exe	130
PID 4700 wrote to memory of 4472	4700	msedge.exe	130
PID 4700 wrote to memory of 1576	4700	msedge.exe	131
PID 4700 wrote to memory of 2704	4700	msedge.exe	132
PID 4700 wrote to memory of 2704	4700	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe
"C:\Users\Admin\AppData\Local\Temp\3c0089726519dd3c74a9352d0008afc208ec22ceef69f419536dfef99d340c04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\IE-Install.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\IE-Install.exe" /silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\is-RHM2N.tmp\IE-Install.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RHM2N.tmp\IE-Install.tmp" /SL5="$70016,3202491,172544,C:\Users\Admin\AppData\Local\Temp\RarSFX0\IE-Install.exe" /silent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2884
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" delete "HKCU\Software\ZyntaXis\IE\2025\PR" /v "002879" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\ZyntaXis\IE\2025\PR\190282" /v "0190282190282" /t REG_SZ /d "NsaneForums-800B1E8F1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cybermania.ws/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb8cf0c188,0x7ffb8cf0c194,0x7ffb8cf0c1a0
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,16119230880260958206,5764780948337853547,262144 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,17249791504706773199,10462874977010130091,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,14781664701730701595,14567442080432746862,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,8847695927663416301,3417338485698016392,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2764852886641114325,12268467671635507670,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,2565089552542314762,14658029303728576892,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,5726652504828237714,8470379376105350363,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,9506302312921051216,14387949419251418146,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5392,i,8166483453853057290,4981577719560771804,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5216669406362119502,1526498700285091298,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5216669406362119502,1526498700285091298,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5024,i,16212558265814025094,6289586027920905774,2097152 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,13365089700990150122,17104227913118812931,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,658475976732409480,3964576282200223148,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,8987559909290124989,10331450007884759945,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:12
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,2870957810705780379,9255420662248361935,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    - Modifies registry class
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,1682876754015014234,9204242302381467366,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,5330960887101288749,12674780382850787523,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,16177841258084068325,7035408664757544420,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,7014930634561210490,5278515329981312817,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,16524059395596929788,46002401464926125,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,13954663991854737575,15944180141025401539,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13661790419182464100,13016731867417938973,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,9665233221981335939,13808433422768639623,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:14
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,223413929427620385,14893896016022521267,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7144,i,14355330899934180100,2268125432526928322,262144 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,7054677561368864557,144348968835495774,524288 --field-trial-handle=2400,i,5464020169562819738,2594335974964947520,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
    3⤵
    PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InnoExtractor.exe

Path C:\Programs\InnoExtractor\InnoExtractor.exe
Size 4.7MB
SHA256 a83aa4891425502a77380869e084e6d31ad10ad9e22b3e1901a214ea32cf79a1
MD5 8ac98f68b24ee8a4d20337ef7e6e9d76
SHA1 8735e99de994fcffdafdff9a5fe1baf154a288e3
SHA512 c876042cf9c06d2c7f65876e42d869b7001ce86bb6a8fc9c60a44a2b86d0a61ebb754e583ac392fcded7ff52284fd1642257fd8c634b7841c50700d01c7d40d6
SSDEEP 49152:v18JCSnFy1J5pYSg7umBFyvP0OT14GzaxFPR9sZgggggguSsAPM+wAjo7r3a:v1IbnFy1J9mo0OTenY8UR8K
TLSH
T152368D13B384643ED26B1B3A4827A6645C3B7EB13A1A8C5B27F47C4C4F766812D2B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InnoExtractor.exe

Path C:\Programs\InnoExtractor\InnoExtractor.exe
Size 4.7MB
SHA256 87a9d962cf421f49b41a69553f4a94cac7c4e00455a3e3cbf0dbe14b6cffc93a
MD5 bd44d3776267ec3698d715c7a1d32958
SHA1 e04b36759204ede35962591b60dcf9a2e5cafa3c
SHA512 64bc19462cf0021e2518192c24b9c76f1125bcc070eea91ab3b75f0882288456a98e750e1b38cd6d28bd2b86f19badde2b220910101eb9344d52bc01d1858606
SSDEEP 49152:+18JCSnFy1J5pYSg7umBFyvP0OT14GzaTFPR9sZgggggguSsAPM+wAjo7r3a:+1IbnFy1J9mo0OTe5Y8UR8K
TLSH
T1A0368D13B384643EE26B0B3A4827A6645D3B7EB13A168C4B67F47C4C8F756812D2B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71e7a02022379852a029df3215fff0a279a1329c31318c4987ff6db3653db7e1
MD5 c265201f2f5407f6005e8e0555becbcc
SHA1 87276fe1329e8ab7dcea87a48ba0df104114af7d
SHA512 ec3e39cdee2401a2467f56a4ce9546e74cdc08cf74651a46b7863ea3b571d0d22c2a1970c2e259e16693a780f42f14f6b881aa96f6a889dc39682ade1ab22618
TLSH
T17971959BF2E41051F7E643F18CF4EC8B39306581A443CE910EA6D9766D9BFD4851C684
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c162.TMP
Size 3KB
SHA256 78ee587a81e8a30f58f6f361000431ea9fb083b742600cd54cef7ccbf2b69e38
MD5 7e36dd92a9a46895f82eb75969d275eb
SHA1 e4161e969ca5713a852bafba09c548583d893f3d
SHA512 bc05a3328974914eee642bfc9a573714dde76d33c02a37ceaccdeefb32594b5262a42d9468baea3022269978931a6fbfe5b4aeb494761d9c97bfb9bb5251fc8e
TLSH
T13061709BF2E44095F7EA93F18DF4EC873A3065856043CE810DA6DEBA698BFE4C15C584
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4b0ab269c80ca61a2eef5dc5a70e51d44e4d107d932d50d7756f32a3b52b8941
MD5 9000162bf49d31dc8a27204187526356
SHA1 0213a5614252ce1c1e52bd8d81e852dd6a6beccd
SHA512 a18167a5d9f6a0a178b7b501e190fc4785f8281a8b565243645fe9da1caaa43b014b6120d27d83e383859f1ed68cb45993dfd63cff25ed14c47a64fa23681bdd
SSDEEP 192:Du3OQZKY1JIR2tVVPa11qL/qVmg3lOKq8JkYNfSOCVitPi6T:Du3OQZKYDc2tVVPa11qL/qVmg3lOKq8d
TLSH
T1E2F18EF7C3E8C96E9A5155F0AB64AE1BCE1D0528421C3D1A8DD9DE4BE3E2471E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16ee2c2f273ca39713fe4d66ffeb50873e2f99fa040f4d128c94daefc598181a
MD5 db9b8726fde028f895de27e1baa8e113
SHA1 fb653c7d0eaaa24d6551add5581e5dbaebb43106
SHA512 f1af51237524838c9e8c8caacc5e0020df4c4328f84213aa5953840e597f608f182254c7d836ec0abfc6d2703b1fd9d2b419ee6c4cfb480754aad32d8c815d7f
SSDEEP 192:sxRZR7Cp/fDsTZZKbBzoA8p9A/g6+WN8E9/BOItmgVIAyFtPL+GXIgVIJ:sxRZQp/fDsT3Kb8m/5F/jVg5i
TLSH
T14442C955AD78A97B4CCBD61AF655BB13D2F9103260911F4CB6FC8A1C04E7ADD6203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ab0a1fcc13ae3b37aaf9c8fd9991bc73c6ad06bf276d5bf0805122155fa7b668
MD5 67914e0d56edbb4635f0fda4a41a5a92
SHA1 c05db8ba237cdde3d9ddef23120652a003dd8813
SHA512 d07a9816a5908a70dfef2fb10ba05918f644ecf4346da790a31d250d8bb18d39d322fcaa4155806fc40308811db41d12f2c6773d33b5dc00d68ef21be7395024
SSDEEP 192:sxRKR7Cp/fDsRZZKbBzoA8p9A/g6+WN8E9/BOItmgVIAyFtkL+GXIgDSIJ:sxRKQp/fDsR3Kb8m/5F/jV75P
TLSH
T15E52C855AD78A97B4CCBD61AF655BB23D2F9503260911F8CB6FC8A1C00E7ADD2203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 19d88153431648fa5ae2e3135c55ae881e6b8d8ca6b17dbad420a161633dec92
MD5 20797dfd1dff7177a0947994225afca9
SHA1 7dd4712b01817a44997df79cb941fdf28bbc0bf9
SHA512 6fcdbaf18fa390bb485fe153ddf5b6f99fcbd5c2abe5d60058d86b89bc21fe57d56226d0cb6674b50c9ac43e52957df4b52757aaafdfbf1a54b7409d7d6c90d0
SSDEEP 192:sxRKR7Cp/fDsMZZKbBzoA8p9A/g6+WN8E9/BOItmgVIAyFtPL+GXIgDAIJ:sxRKQp/fDsM3Kb8m/5F/jVg5l
TLSH
T15042D856AD78A97B4CCBD61AF655BB23D2F9103260911F8CB6FC8A1C04E76DD2203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d8897829756cdb9057c7ccc46701225c281e44c3c647a2bd67a5e5dcb61795f
MD5 309a4e7228ee144432ed27e9066b126f
SHA1 0dfbe20b8a7253aaf11c951a81b843818152f0f6
SHA512 f11384e226411991b4cae2972b9e2a720b29e629236ab16af646e7e3b9239b16aecd7857f4009bff26f6a57c4cdda843311ae8f135acf91bef8f4df284445999
SSDEEP 24:KQydKMYI5KWho1KSHcpyXQ7L2p4+dd5ZhwlR68IHNhK2eh+Hh1UvxSyDsGclxQfA:KQvI5KAosHyRUI/K5es5DItKQcQXyS
TLSH
T1BD912F24323A0650397E2A0C95E5B72F568131623124EA7F77FF04BA8E27E441CBD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be3304c0-613b-487e-9d5e-fcb04f0bbabc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be3304c0-613b-487e-9d5e-fcb04f0bbabc.tmp
Size 29KB
SHA256 e3ea061373015c0fe9561d3ab8b55e57d48c68b98e412c53361ea367616c7308
MD5 d5a999d8e445ed2df6661b089a20cc82
SHA1 419c07f6a515bb63882e5647704951a8fb5c35a3
SHA512 2c8bbe3d5d3a1ca7bb13d2e19cb10beb012a7ac5b4f827d3cead8047552436ec96da288f88f472d5e4645d967b29f7b66a8e0a70ef2819460449b642cca5010b
SSDEEP 768:dmGxlF7pLuLb1sWgmMfQ68F1+UoAYDCx9Tuqh0VfUC9xbog/OVeHXUGe7romLM7V:dmGxlTEb1sWgmMfQ6u1jaVHXVeI/
TLSH
T154D2DA7B740CCB7F4FC00A9DAD197A9F6DA802CB9698CD8447F9981C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86f15569-f544-4163-b4fa-3e4ddfc70a10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\86f15569-f544-4163-b4fa-3e4ddfc70a10.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e70f8a3155e9d6847d089e2d9abfe71bddb3ac7e7d8c40e2ea154fd011cb1089
MD5 97af0e249ed5998f46ec2f24a077280a
SHA1 ce81a787cb9bd515f3b8317c6cd3735b95c81df1
SHA512 f4762714e1db74215c08599821f98712a93e8b245ba38a3f92d1cced65a291ece16ee0e3d41443592e0ca313de89a78680723fa8c8d72ebd513492b26aad0ef9
SSDEEP 384:n5ZcIu38NomQ8+sop/199fw7DJnzRanzdvLcN9YkWwJJhoMSboCzfnFLj/KigOIQ:Ru3fpPKnJNanxDc9bsMSJz/Fn/K2sH49
TLSH
T16DF2BFB5DCA18DA39CEBA6807A8A76436FF40953D5895E48D4DA6F0C05833AD234B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3fc507552e3c9c739bffdee26fd4a94004f8d2d0a08228a36df63bc4961272ab
MD5 14131d07c16c868c4b0d12cc727bcedb
SHA1 296e275ff3970cd483d265c65bf97183f934a364
SHA512 2fe81a7f89ed6f8655cbf0bd8a7005d94878cd765564c0d40bcde288f53cb45e47f6ec1550e69ac616cc1ad06982f40c4baa207a2ca93648d007ef14c6c3bf74
SSDEEP 768:CFGq3HwgX8E0nJNaBxDc9bsMSJz/Fn/K2sH49:pq3i3mVQbs7JTI2sY9
TLSH
T1FE1328F588D389B6D8AE5783677D6E429EFCC053B5899984B7C95D0CCC821BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 74b78a3a7184062cccf216186da99aa67e43c31d7f41d02b0c64f6bea7929ef1
MD5 4b5e7afff240099915bc7264c8da74a9
SHA1 3536129dd5aa5e43d30444d7894d5ebf67f2126e
SHA512 bb9979570d580ee2bad4d5bfb460f9eb82d28ee899576e82ef04085e492105f0e3184b9bfa0344122c569fd814092bfb4238258f6763c3e8f0c63c0ed493f2d3
SSDEEP 768:z/UxvxjgC+U3H9KnJ3xDc9bsMSJz/Fnn7SHXPyK/:GZj3+U30RVQbs7JTRSb/
TLSH
T1CB03D07AEC905CA7CCF767803A8AA657AFF94953C5C5299849DD6E0C07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1012c8001b540fce06f073dbd53cd1e37f50a4c7ae99f280d27730d52f6e4d68
MD5 e038dd8bd535411abb251c09f5632bc2
SHA1 35b07aae4edeac38fdbe4a5d01f45b6da9147152
SHA512 d50ad3cec852c1ab527fbb147b8e4909da24435050f66c67304d353b25c1c6acbf2127725b598f664ddc64367c9ce455c05ecf2fa964bac7004efa695b8b6894
SSDEEP 384:njZcIu38No5Q8+soR/199fw7DJnzRanzdvLcN9YkWwJJhoMSboCzfnFLj/KigOIQ:7u3CRPKnJNanxDc9bsMSJz/Fn/K2sH49
TLSH
T19AF2BFB5DCA18CA79CEB67807A8A77436FF40963D5895E48D4DA6F0C05833AD134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

87cb5527-9776-4744-b3c0-f47e4fc473ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87cb5527-9776-4744-b3c0-f47e4fc473ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CyberMania.url

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
Size 77B
SHA256 ae6a476ce9024230ccaf426ba9f0f6f3dbe6a54547fd317f5e014dacd1671121
MD5 3e3933a7ac69bf93db24ede95157ef1b
SHA1 933b24eede9d059fc6638bbd52fcfcb5c9e039e8
SHA512 2ad2a807e9d45cf229f75b2f18769958bb775f9b557c7a90ed73ec6eeb045de0e823def26106ef21a1c75644e590e684993c267f7bb6c8b74a6d5c6e4275a2ce
TLSH
T1E7A0020CC60BC0558306140992008E14980114D1C412C95DB1504B0C954A041C58524C
MD5 SHA1 SHA512 TLSH

Submit Download

IE-Install.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\IE-Install.exe
Size 3.6MB
SHA256 67efb4b19d2c5862c38b83bd8a058b0e4d98758e0b2b3e5cd51a018ad962bf87
MD5 1e874c00e2b877ccb1b1a82d4cf2a492
SHA1 7df6e3eebe3f0f57b35aa6bdcc0ac60cefe4c97e
SHA512 dceda4df48d83f8112b0a628542c631dbf40856ecc705fa5f6ddad9fcffc5b8d0c20ef80731880f8cbe3905b6151b586dddf8e82e77ab311fa63ab617e46919c
SSDEEP 98304:Aq9ZSNcDsq/znH3WdFfr9bm20iGc5mZCjv8OG107iNKa:AMS+Dsq/LWDJC2XmZCjUOfXa
TLSH
T13C063355F2C7C472E4112A3A89624395EC263DFC2DF8605E2EBCF5CD56F134188B6AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Replace.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
Size 2.2MB
SHA256 3fb39e3a61a46f0957d1ad5167b841319c152cde1f6ed765b5f6a16ab81132e1
MD5 f390a66cc9b11992f377d6b280380472
SHA1 9882e3a8a95f83a7695ace83ea26145de14df05b
SHA512 c6eaefc74e9f6b222a02c1bcf4c1535198cc16e4c51bd3a897399f6d8b88d4319aacc35aa23b8e02f45c877aa530b191b1b94691f477097b8b65ddd3ccb05333
SSDEEP 49152:XB7YqqfFl4eqVdvovlGCTMuKCDa1/e/Y6a4KV:RAlV8BovlGYuSRYbV
TLSH
T128B52302BAC299B2D0761C355E225B61253EBD305FA5CDCB23C4772EFD726C09A317A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IE-Install.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RHM2N.tmp\IE-Install.tmp
Size 1.2MB
SHA256 ea1095f16291879e7e1733342ec92c6da0343e930a1dfac224fffec3869a2749
MD5 83dc3a7568fec2b7875dbdc9a01031f7
SHA1 5ee499da367d0e1a93ac524c1165852637a9188d
SHA512 d6a059f15ef65c4340d3d7cdfe542a93bfa0f89486656e9429d284bfe01d0a3861eed55f33ef8430d0869cf165f40acf1eeb39e671d16311aeab56730278fb5c
SSDEEP 24576:VnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtQqx9u3:9HeKh4nqzF3PYdStdo
TLSH
T18A452922E3E18437D5732E359D6BD2946835BE202EA4D44A7EFCBE0C0E75B41AD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4700_1277710268\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InnoExtractor.lnk

Path C:\Users\Public\Desktop\InnoExtractor.lnk
Size 946B
SHA256 70099c513353993e2d1e080a8d73de90606c415ccf2a28897d7360ecc5346bf0
MD5 992903fc79c4bcb3e3dcf087487ff327
SHA1 0decf0db6939b47c600430cd16f1c94fd413d891
SHA512 e0da55231571516a7f92ed228a4214f6d3e5e020904acb8a3b5315bd342e40fb3441f1cfd8b26b1592f48464446231869555d6a11baa7dda03b0a3eaf7a4c36c
TLSH
T13A1126022BEBA24DF2B393B61A375D2296737C14AA4C8A2E130D544959795401F38F7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2884-95-0x0000000000400000-0x000000000053A000-memory.dmp

Download

memory/2884-24-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/4276-96-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4276-17-0x0000000000400000-0x0000000000434000-memory.dmp

Download