e9a719da8ec78e25d8fc03170f36f7ae25a7838406f7962b4621e57f902fa47b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PlanetVPN.lnk
Size 2KB
Sample260930-ntssmavbld
SHA256 e9a719da8ec78e25d8fc03170f36f7ae25a7838406f7962b4621e57f902fa47b
MD5 3c4d749c21a379f3ba41d0f8276f2893
SHA1 8534920660861d9ad07e0e3c7620eb2ff893b538
SHA512 5a99846dd113def886fc31b5a5925b5ba40b5ef2dcb5d92023838182badaa2b766014fc3f931a194191bf4a46e896cfce9271b29f5bb21774ca03dee35c30c65
TLSH
T1B641D62469E6473CF6B3CF3035FA331A463D7C95DB448B9D4284814628A2651EFB5F2B
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery execution spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1868_612081156\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2004	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31281378"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "752009935"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2757962786-3770611029-2102435697-1000\{6D1EF595-A051-4749-83B6-77ABE34E7B6D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1868	2028	iexplore.exe	82
PID 1868 wrote to memory of 2288	1868	msedge.exe	83
PID 1868 wrote to memory of 1076	1868	msedge.exe	85
PID 1868 wrote to memory of 2832	1868	msedge.exe	86
PID 1868 wrote to memory of 2832	1868	msedge.exe	86
PID 1868 wrote to memory of 2832	1868	msedge.exe	86
PID 1868 wrote to memory of 1740	1868	msedge.exe	87
PID 1868 wrote to memory of 1740	1868	msedge.exe	87
PID 1868 wrote to memory of 1656	1868	msedge.exe	88
PID 1868 wrote to memory of 1656	1868	msedge.exe	88
PID 1868 wrote to memory of 1656	1868	msedge.exe	88
PID 1868 wrote to memory of 4760	1868	msedge.exe	89
PID 1868 wrote to memory of 4760	1868	msedge.exe	89
PID 1868 wrote to memory of 4760	1868	msedge.exe	89
PID 1868 wrote to memory of 1064	1868	msedge.exe	91
PID 1868 wrote to memory of 2220	1868	msedge.exe	92
PID 1868 wrote to memory of 1064	1868	msedge.exe	91
PID 1868 wrote to memory of 1064	1868	msedge.exe	91
PID 1868 wrote to memory of 4632	1868	msedge.exe	93
PID 1868 wrote to memory of 2220	1868	msedge.exe	92
PID 1868 wrote to memory of 2220	1868	msedge.exe	92
PID 1868 wrote to memory of 4632	1868	msedge.exe	93
PID 1868 wrote to memory of 4632	1868	msedge.exe	93
PID 1868 wrote to memory of 1760	1868	msedge.exe	94
PID 1868 wrote to memory of 1760	1868	msedge.exe	94
PID 1868 wrote to memory of 1760	1868	msedge.exe	94
PID 1868 wrote to memory of 2432	1868	msedge.exe	95
PID 1868 wrote to memory of 2432	1868	msedge.exe	95
PID 1868 wrote to memory of 4708	1868	msedge.exe	97
PID 1868 wrote to memory of 4708	1868	msedge.exe	97
PID 1868 wrote to memory of 1124	1868	msedge.exe	98
PID 1868 wrote to memory of 4732	1868	msedge.exe	99
PID 1868 wrote to memory of 1124	1868	msedge.exe	98
PID 1868 wrote to memory of 4732	1868	msedge.exe	99
PID 1868 wrote to memory of 4920	1868	msedge.exe	100
PID 4920 wrote to memory of 5020	4920	msedge.exe	101
PID 1868 wrote to memory of 1508	1868	msedge.exe	103
PID 1868 wrote to memory of 2840	1868	msedge.exe	104
PID 1868 wrote to memory of 2840	1868	msedge.exe	104
PID 1868 wrote to memory of 1792	1868	msedge.exe	105
PID 1868 wrote to memory of 1792	1868	msedge.exe	105
PID 1868 wrote to memory of 4084	1868	msedge.exe	106
PID 1868 wrote to memory of 4084	1868	msedge.exe	106
PID 1868 wrote to memory of 2172	1868	msedge.exe	107
PID 1868 wrote to memory of 2172	1868	msedge.exe	107
PID 1868 wrote to memory of 232	1868	msedge.exe	108
PID 1868 wrote to memory of 232	1868	msedge.exe	108
PID 1868 wrote to memory of 4588	1868	msedge.exe	109
PID 1868 wrote to memory of 4032	1868	msedge.exe	110
PID 1868 wrote to memory of 820	1868	msedge.exe	111
PID 1868 wrote to memory of 544	1868	msedge.exe	112
PID 1868 wrote to memory of 544	1868	msedge.exe	112
PID 1868 wrote to memory of 3620	1868	msedge.exe	116
PID 1868 wrote to memory of 3620	1868	msedge.exe	116

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PlanetVPN.lnk
1⤵
- Executes a command shell one-liner
PID:2004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SwitchConvert.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/Desktop/SwitchConvert.gif"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffb27d2c188,0x7ffb27d2c194,0x7ffb27d2c1a0
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,9287631365470263382,6819075026464927295,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,15837397254937945646,18307241721022484711,262144 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,16253291099057316638,10248411172049827927,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2932,i,14239609530360777832,17646387988089862013,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3216,i,8654256805796483813,13422791087012333951,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,7549699032978434285,15138964175589574219,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17669260926611560091,4092631173810776060,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,18429113014762955210,12024326762359559262,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4296,i,10236726559422044482,15584262696090509233,2097152 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,11049000171503970670,10140715185012894918,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,415593151280894546,11765788130272351719,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,5461728978484075935,17373665667014552194,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,15484659209573445562,11207326392810318686,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6510900107872731427,14835116877135348601,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16964826511222504622,15896113539345225035,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16964826511222504622,15896113539345225035,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,13521317405449340669,3968411170058836349,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,17875863502684367027,1150391265086314607,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,13952529811895615837,10373913956624277734,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,2987220013418452357,14673918393650118798,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,15207057992866822411,9528891595489304686,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,8831214058112450802,10325843684481935934,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,1632581198906004578,9389915826956170466,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18410590210140688873,14857162778781291483,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,18236058262851890558,2757890450175769890,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1509568813600078797,3794262668150697165,524288 --field-trial-handle=2284,i,1473453645769955899,18078602568762189381,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0653c7dfe0810a5ba2c25399711a69ff5ccfc817819d34f6722ae2f2cd5878f
MD5 7d9ceef5daa4101fd9b28ee948203837
SHA1 ad81e9d42e96e81834610892e0cbe006311016fb
SHA512 5fcae862842c3f4a69612b1563a769c05365d02e6c1981b600f92a8204d1bccef7066e0f30e9f4cd820c979d8be93f5d5f5a0cbcc14e4c67fdb497df535a879a
TLSH
T15DD02230F32B8002C2C0B03B83C3C3203CCACA0A020E20AEE0302C203CAA02AF80E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3441efe89f40c49c2eb2faa60bc806081bb2ed5672b81b3317480a16d9defd0
MD5 48af34be1fd83b68e08abd8324fcc533
SHA1 15f0d4791b9ba48b92ee9290ab043242241b1137
SHA512 9687f23e1f8c4b413fabcf01b867bb71849109f11f20aeb0da3a5e1a25b610ec3fa85aa3ce714ace9479c0c98da93c7301d990baf3c243f6c14cc1010ae46a5a
TLSH
T12ED0243073574401C1C0703743C3C3103CC5C505010D515FD0301C103C57055F40D0C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f5ac298df6906bacbaee97c9662fe9bf8fbe5c672c1959464742980dedcc579
MD5 9190b1f6b5d16100a0376ecb876052b3
SHA1 813c5fffe0547c39e880663000655d84b2357547
SHA512 be01ae351d042556e2d89f96d328e09c7baa84179c1e0f338b7e6d2285a61f8f8c63e5e616b749b433ec5fba6cde85ca65becfd2fc50066d507a2c7d958e6fce
TLSH
T1E8619747443A44E7DFA87670A2E339CB353863853A836D120054ECFD4C1DB6B0752D4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cde5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cde5.TMP
Size 3KB
SHA256 6fe6c4f97bcfd0a4e5b5f4a7e3a81974da103778a2c25bb5620681e52a316ea2
MD5 4ff27226865630e63903adb550b0a121
SHA1 2c67a124adcb60d0c91338cfee53770f28615aaa
SHA512 8022a770130f0eb2e065376988bb01af99756e6a9bb48c02a2aa86cad1156e879c92f8b2b40d72e85949bb3a05f27de1f2ba3eda1397ae55a9e41255a83e85c3
TLSH
T18E619647453A48E7DFA87670A2E339CB353863853A836D120054ECFE9C1DB6B0752C4C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 87701361caba44d7d3fc265a7c61d9fc1b5ba3616a9692c0fa9b056108b76b88
MD5 cdb333b255ffcb3f1d615f63a45f4d8d
SHA1 7b4fea21f1cd1407def553314c6bacd2a3fb6542
SHA512 4338f5f5206cd26e4238d0520b029ffdbf3f036fec4e9b82b7e6ce7c53dd66b71219bd21f9d74145df93b9fa8f4d5e61ed9b656eb19696c782f1717d75ab5c5b
TLSH
T1D741CFF7C3E8C66E890156F0A728AE6BCE2D0914432C3D5AC8E4EF1B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8d1105143413ba2fd597ddae8b8d7db46bbe6c8746603e4258f0057335bfd5e0
MD5 bc92e959b955dc3e408baa65ec36d8ff
SHA1 b4c7e92346deee4dd8a8a7e3ba71ad8394258648
SHA512 c835942b1dd4041516e9cf77f6d066918e5aa62f5d97f55b054839ad4309a2f25df33fc6e3afb94df49794cacd85175171604bc9090a59219bf4ed35b2f4bbea
SSDEEP 192:sxZBRLLU/fhsE6bCmt3oIdpyZ/W6+WNGY0vH76Ig5PJ:sxZB5U/fhsEC+/bG5On
TLSH
T12D22B7516E28A97B8CC7E219BB65BF43D6F9503291D51E48EAFCC62C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac4d2a0a8e53d80d81b63931037b27d2ea0747cebcd1ef7c7a98ab18cbcdf9ad
MD5 6aa61392d823137e0a29833b09d8280c
SHA1 7b2ab73f471314c3e3d6613218235b39b7ec0230
SHA512 8f0cbf063f78400098ec24071839d991dcaab519918627afc5457ea9038cc237b494cd02f4a6fc2348cd548a4347e2c2d5fa56a22e8bf85b15e3ca62e0cc38ea
SSDEEP 192:sxZBRLLU/fhsv6bCmt3oIdpyZ/W6+WNGY0vH76Ig4J:sxZB5U/fhsvC+/bG5Oc
TLSH
T10E22C7516E24A97B8CC7E219BB65BF43D6F95032A1951E48FAFCC61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 753f083be57bdd76de73615841b02f97d8a2435c7c5e218da6656c7c5eb7691b
MD5 285378837b282d1278d42670d7459aa0
SHA1 2e652d5f675ff106ce6459055ddaa8925f7d6630
SHA512 c6682596560a76a0bd16f4ffd17446466427700eee348b548f8fc3c389d0507c8b9759266d37d0014af410c1b73b3cc1bdfc04879d09b59fa5aac00151f8d18e
SSDEEP 192:sxZBRLLU/fhsN6bCmt3oIdpyZ/W6+WNGY0vq76Ig55J:sxZB5U/fhsNC+/bG5DN
TLSH
T11622C7516E28A97B8CC7E219BB65BF43E6F9503291D51E48B6FCC61C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 8f49bf54d711c3798d187fc6f3eb8a11ed45011f0fe9c8d9891e38f2de4351f6
MD5 252ebda1bc1d3f3e21914d4a375aba69
SHA1 e9acdd6b9a31efa052e6b527dfdd5c06506b0859
SHA512 f76694eb655f4afcdfc2eaf41b9d996618503f54754d021f6d69fabe2c868031d62cd862f336ccfc257571eec246b224165325eaa3bbc22d395cdd02f631b4fa
SSDEEP 768:pDhnP8y32bo7pLuLbNFWRmaeQwe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3e8ClLlq:pDhnP8y32bUEbNFWRmaeQweu1jaKe8CS
TLSH
T156F2F97B284CCB7E4FC04A9DDC567F9A6EA802CB9698CD4047F9885C02C76EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a693b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a693b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7a5afcc557c6fee1e63971c1611b0808f82ee6144500aa699d0398a94de10a6
MD5 fd4fa3d1207ff15f3b45e7fdd65fff98
SHA1 6fd9c5ade8273cb092dcaf614d4383c6fb495790
SHA512 3110012526bf0c18bac11303d633f24f5bd8333e55986ad3a7716cfadc84185b22fd9ca3b6889327b077fb7a6f370c6efc38aeda60d569d067349fdb2656db02
SSDEEP 192:mGN+6FPhQmiUy7kd2LX56rjzoremSCPVGU6:mGN+6RcS2LX56b8P8U6
TLSH
T12802D834ADB87C7B5EE3AE46B58627139FE5106BE5542F84DAE81F2C009765C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c38e565ab0c343917e658ea15319b76737a7a063b7408839355d5934be075e5
MD5 795bef7cfbe9c8046b0e3719153c658d
SHA1 a1e79b581a43c86d5a4a22c75b4e70fcc924a3a6
SHA512 d93c2d474c3dd7bf31e9b1295a66917105bb29486c5604caaca6030d4eeab18d23756d3d80f8652dab27717e5fcbceac591b1fba50eb9acffa5f7cac5bdd1e35
SSDEEP 384:nFZcIh8NvfniqDfmX56b8XXbi5HtgOIwZOytjop:9hKuN2FXs8i
TLSH
T108828EB6A8BDAC7729EBE106F58633439EB410B7E9C55F44D5E8571C018B299130FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ce1c72336705950ec7ba72f155082e4d3115d704923fc73528a8c9f46fb6f6c
MD5 cfa318ea15fb602d1dcd6bb00b1ce1b3
SHA1 a34d996bbbb87e0784995f4aa90775ef298deb61
SHA512 ea9ebe161dd2114b1c120e72466603067ce31ee2beed31c7acc694a48c7921d67caeea9bbb563af00174ad0b7c605ad0b064c1d36330122ad18b2be5ef7f6dc8
SSDEEP 192:mGNq6FPQQmiUyyd9LX56rjzoremjXb/WU5nq+RU6:mGNq6e/9LX56b8XXbH5HU6
TLSH
T1881208B5B87CFC671DE2B545B1C632839EE52077ED886F44D6E81B2C049B25C270E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0c80fc33f757a1844066c53d1b34259c0830126e866e4a6049062c0b5203944c
MD5 cc44c01f49f28bbdeace3bf1744af6e6
SHA1 8eb2752e348ee98d44d449e73ec9a78e60bfc22a
SHA512 2b6151aa51ed1dd7dec9c196fd1f2b9872db83f1acbe78aeffa9681c6cd459c5d4c93be8fec4b213a7cf0ef1be24ae9b4f4a1b8c2967378ce05e04a95d06e221
SSDEEP 384:nHZcIh8NvwniqDfmX56b8XXbi5HtgOIwZOytjop:vhzuN2FXs8i
TLSH
T1E3828DB6A8BDAC7729EBE106F68633439EB410B7E9C55F44D5E85B1C008B299130FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 ab1f4f16f52ca3a2a89d84e096ab6aaea4d00c4abdff4aa4a582e4640698b5d9
MD5 84cdb4faab9bc648c8ac706fae374cac
SHA1 801f92a9257f33f21fbc7a276740feeb24f3f7ee
SHA512 31160ed0537dcd7a0c32e426d20e97bae5bd3b79cf2b4a1a7d64bb858938921f57fc82503f7291cfc0157ea82f010c5d0032819a15be2062d77e03a531cf7f81
SSDEEP 384:nGiFiZcIU8NR8TUNTUlIlwniqDfLDfwAX56b8XXb05HtgOIwZOytjop:tFQUowgawwNoFXs8i
TLSH
T124B22A76D8A9DE7BBDF79782B74672839EF010A389C99AD4D9D85E1C00872DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44044e94-2509-4062-a095-d3356db2e68f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44044e94-2509-4062-a095-d3356db2e68f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

04ef9729-6925-4cc8-aa91-95b1fc8a69e6.tmp

Path C:\Users\Admin\AppData\Local\Temp\04ef9729-6925-4cc8-aa91-95b1fc8a69e6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

503da85e-e68f-444c-8f75-f0f558bf379f.tmp

Path C:\Users\Admin\AppData\Local\Temp\503da85e-e68f-444c-8f75-f0f558bf379f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_222171063\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b38c2a59-e517-4a07-8a19-affc6110e157.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_600647190\b38c2a59-e517-4a07-8a19-affc6110e157.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1868_612081156\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads