7fe4a5241395933b2cbe5e775ce04d5da5f951b0267a415dc095ebe330d219ad

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xillys_Program_6.0.exe
Size 1.7MB
Sample261012-vl7edacy81
SHA256 7fe4a5241395933b2cbe5e775ce04d5da5f951b0267a415dc095ebe330d219ad
MD5 70d9a5a84b0a8c6afc8cbe2cd3f084db
SHA1 0850873394f2bddf8a28bdd0ea33039c2401ee3a
SHA512 1ca46de83c96c4d64e0e0e9d9372e89120b37d345a0a44b0e023d9983e20331cc8e7f246673e6e6f790682ac3eb206839741e902ed8c4438d8e00fce341d8c74
SSDEEP 49152:XYXwh9my4q9my42dI1cn5+whEsYuZGNG2:XqwJScnFhOuZGNG2
TLSH
T1B9850163734A0B89E53957309533EF7563BEBC684B2AD219B88E67B384B339C4C41167
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
256	Xillys_Program_6.0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_217275486\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_291522686\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_291522686\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6132	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{0492092A-62D5-4D36-97F4-3E7F1E84FC34}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{B0F0AF12-2378-4FD0-A727-FA171198DDB9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3848	vssvc.exe
Token: SeRestorePrivilege	3848	vssvc.exe
Token: SeAuditPrivilege	3848	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6076	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 6076	256	Xillys_Program_6.0.exe	88
PID 6076 wrote to memory of 2496	6076	msedge.exe	89
PID 6076 wrote to memory of 3380	6076	msedge.exe	90
PID 6076 wrote to memory of 4224	6076	msedge.exe	92
PID 6076 wrote to memory of 4224	6076	msedge.exe	92
PID 6076 wrote to memory of 2508	6076	msedge.exe	91
PID 6076 wrote to memory of 2508	6076	msedge.exe	91
PID 6076 wrote to memory of 2508	6076	msedge.exe	91
PID 6076 wrote to memory of 2028	6076	msedge.exe	93
PID 6076 wrote to memory of 2396	6076	msedge.exe	94
PID 6076 wrote to memory of 2028	6076	msedge.exe	93
PID 6076 wrote to memory of 2028	6076	msedge.exe	93
PID 6076 wrote to memory of 2396	6076	msedge.exe	94
PID 6076 wrote to memory of 2396	6076	msedge.exe	94
PID 6076 wrote to memory of 4624	6076	msedge.exe	95
PID 6076 wrote to memory of 4624	6076	msedge.exe	95
PID 6076 wrote to memory of 4624	6076	msedge.exe	95
PID 6076 wrote to memory of 2832	6076	msedge.exe	96
PID 6076 wrote to memory of 2832	6076	msedge.exe	96
PID 6076 wrote to memory of 2832	6076	msedge.exe	96
PID 6076 wrote to memory of 5648	6076	msedge.exe	98
PID 6076 wrote to memory of 5648	6076	msedge.exe	98
PID 6076 wrote to memory of 1448	6076	msedge.exe	100
PID 6076 wrote to memory of 1448	6076	msedge.exe	100
PID 6076 wrote to memory of 5908	6076	msedge.exe	101
PID 6076 wrote to memory of 5908	6076	msedge.exe	101
PID 6076 wrote to memory of 4240	6076	msedge.exe	102
PID 6076 wrote to memory of 4240	6076	msedge.exe	102
PID 6076 wrote to memory of 4240	6076	msedge.exe	102
PID 6076 wrote to memory of 5976	6076	msedge.exe	105
PID 6076 wrote to memory of 4856	6076	msedge.exe	106
PID 6076 wrote to memory of 1932	6076	msedge.exe	107
PID 6076 wrote to memory of 4856	6076	msedge.exe	106
PID 6076 wrote to memory of 2544	6076	msedge.exe	110
PID 6076 wrote to memory of 4704	6076	msedge.exe	111
PID 6076 wrote to memory of 4328	6076	msedge.exe	112
PID 6076 wrote to memory of 3320	6076	msedge.exe	113
PID 6076 wrote to memory of 3320	6076	msedge.exe	113
PID 6076 wrote to memory of 6136	6076	msedge.exe	115
PID 6076 wrote to memory of 6136	6076	msedge.exe	115
PID 6076 wrote to memory of 4784	6076	msedge.exe	118
PID 6076 wrote to memory of 4784	6076	msedge.exe	118
PID 256 wrote to memory of 6132	256	Xillys_Program_6.0.exe	120
PID 6132 wrote to memory of 2376	6132	cmd.exe	122
PID 6076 wrote to memory of 4164	6076	msedge.exe	125
PID 6076 wrote to memory of 4164	6076	msedge.exe	125
PID 6076 wrote to memory of 3472	6076	msedge.exe	126
PID 6076 wrote to memory of 3472	6076	msedge.exe	126
PID 6076 wrote to memory of 1804	6076	msedge.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xillys_Program_6.0.exe
"C:\Users\Admin\AppData\Local\Temp\Xillys_Program_6.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/intent/user?screen_name=x1lly
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd20adc188,0x7ffd20adc194,0x7ffd20adc1a0
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13272721695396720111,892661919925173724,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,17288860192901520579,46884286684725984,262144 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,17898087777745889485,16535708184128655165,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,16745969126086848261,13759014048974583570,2097152 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,16519024503483651880,7006357283853483474,2097152 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,4551056503853992722,2763916720008378229,2097152 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,13078130939415578195,13046169902986319991,2097152 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,17197724870173835367,338018886470520974,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,14812650823787113647,8160566840988367382,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,5917876300180003731,5398374542307398562,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5920,i,11701594086035375149,13797246048108843796,2097152 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12195653367876513090,4461979722958661287,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12195653367876513090,4461979722958661287,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13194241298213878954,5372154321009084561,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:12
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,5269961409295614298,3968819360873059298,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
    3⤵
    - Modifies registry class
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,17153116820404054493,4092776909787360340,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,4360312663400572491,1079700495667159245,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,5679774381584276191,10041513413696336157,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10313733139261924618,6938516085870522335,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,9471467590493109760,7154199446622386223,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11029234845379856322,3897922470777333006,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,16507713812732851069,11888831110462875856,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,11487671352291282836,1756597050492340076,524288 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,1664998591689847031,17345633161544134568,262144 --field-trial-handle=2540,i,10954039239083074973,4587765858231356412,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:/Windows/System32/SystemPropertiesProtection.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\System32\SystemPropertiesProtection.exe
    C:/Windows/System32/SystemPropertiesProtection.exe
    3⤵
    PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

163c40ae-92fb-43a4-9fdc-6d413c9721e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\163c40ae-92fb-43a4-9fdc-6d413c9721e8.tmp
Size 37KB
SHA256 050631a5f5b0b67d7010b5746b55bd1756829af0f50c68de7cd6650f43544a96
MD5 5ec287070f5f6948a0fe44c6bfb7c535
SHA1 ccb63ad0d437726bb9b2afc6f421a625e27dbfbf
SHA512 67ad902794c4484ab45a131b190b795f4bc6f3dde7af720b61048ed3c9fd2190ed13aa55da4f28b4bd56111356a863c0a9875173ea00d3cb9df456eb745fe459
SSDEEP 768:+FHc3PwgUOsAerK11t2p5XSwQs88uBkiT2RGJCbETA:Ic3apr2YILNBAICbD
TLSH
T1B3038D36E8D0C967ACF797C2BA463B569EE06167C4C84AC4DADE9D0D00872DE170BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2426bdcc-b3b0-464f-94cd-9686c95fc0a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2426bdcc-b3b0-464f-94cd-9686c95fc0a5.tmp
Size 38KB
SHA256 b1a33a550579d0f517ed112c18fe5cd9f5bd15497f9c2b13770276e994159f3c
MD5 2f03a7a4f2b3da323d118391c02a7a47
SHA1 fbf29cc3bc882ee2ceb237c8af953505f667ea2a
SHA512 a2abf5b2ed692d3db3580dcf2ce0c7eb4aa4f6627a44f2b36adf353c2334606e5bc84ab626e8b703f67888719d7b28b18d21eefd1cceb5a6aa919531c0fe18cc
SSDEEP 768:S/UxvxjgC+/3kWYc7fZrK11t3p5XSwQs88uBkiT2Rs1y:XZj3+/3k2tr2pILNBAs1y
TLSH
T14403C039BCD55C639CB7A341364B2797AFF02153D4C40E98C9EEA60E028779E274B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48aa33dc-ced3-410d-96e5-680389ec4589.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48aa33dc-ced3-410d-96e5-680389ec4589.tmp
Size 38KB
SHA256 02c2f333e39395cdd36165c2fa38c1baebd220886a88fea6b61544a740871bbe
MD5 a03c385aedd480ca5a41ad7c6d3333a9
SHA1 e9133b6d65277d59de8d6cfdc17bdb8c369b668e
SHA512 6736689749e64fb44f4fb645cbb1d6cf856887cd3b3edc3d219b93e10163af24e40e6e972c32d7d2f7097449465bcbf4c0d57b2d5b14e657a0676e8f0c3b4e65
SSDEEP 768:L/UxvxjgC+W3kWYc7fZrK11tMp5XSwQs88uBkiT2Rs1y:+Zj3+W3k2tr2CILNBAs1y
TLSH
T1F503C139BCD55C639CF7A341368B2797AFF02153D4C40A98C9DEA60E028779E274B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b7da959-7f85-4733-9e49-959f78f526f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b7da959-7f85-4733-9e49-959f78f526f3.tmp
Size 37KB
SHA256 202f66bb564aea90350198d8cb12089a25954b521dadc6e6296fa687658d9b58
MD5 b53b77c5d591e1a39b6ad3fd7d375a56
SHA1 f74faa5d82d752f046ba5f252fc6f7ccee3f9043
SHA512 3e18d056afd839784a297f25c8daa2553c3bcd00ac24ded1daf4a88fb1cc8a831a7a428d94bc8d8ebbb0fe2333cb371d087b87c4121c248158226b4d4aa974d5
SSDEEP 768:R/UxvxjgC+W3DSfc7fZrKup5XSwQs88uBkiTCj/P84g:kZj3+W3DptrxILNByHg
TLSH
T11B03D039FCD46873ACB39381365A275BAFF06153C4C41B9849EE7A1E028B79D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

44034c9f-af7c-4f0b-b446-10ec0214279e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44034c9f-af7c-4f0b-b446-10ec0214279e.tmp
Size 12KB
SHA256 4bc27171a0c35375330830438c085ac5181cacd37d26ead05145608002d979ed
MD5 3c0362056e5266276020481784e9d6e5
SHA1 b794adb2c8bf321904a8cc0ebfe0d9103ba9daef
SHA512 63b6da84efd77347d1be9bea7a6703dda1031f5beb044c56168c68ae2d6903a1c5681fe78d09246c186564e76c53d26f61f8abc2525c26d03e5fb1a37b432b11
SSDEEP 192:sxRorCL/fUss0HRp3zoA8ppAt/g6+WNJfw/YEmHfGcsIgD+gJ:sxRoeL/fUss0OG/5W/Bz
TLSH
T19842C916AD28A93B8CDBE21DBA557F53D6F95032A0C16E84E6FC8A1C04E76DD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46af2c0e-caaa-43ab-b23b-d028579c8c55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46af2c0e-caaa-43ab-b23b-d028579c8c55.tmp
Size 11KB
SHA256 bd33b7e1cbb00b029dedb5c04d00706fa5aaf802341564492ec28305cb82fc29
MD5 ecf1ae8dd7db8bdc68f45a4ad969464c
SHA1 8faec3af950cb7ce89c73dc31efa1c25eca35ba3
SHA512 a5fa27ec061062602e6866bfa3ab74b4a842fc86c32a9fb73be6ab600895c0069de5475b96b7c3eee6640827265d0546035b30fefdf23aedb66a79a3d68cced8
SSDEEP 192:sxRLrCL/fUsV0HRL3zoA8ptt/g6+WNJfw/YETfGcsIgVgJ:sxRLeL/fUsV0gD/5W/Qe
TLSH
T10432B815AD28A93B8CDBE21DBA657F53D6F95032A0D06E44E6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83cda69c-9aec-4cce-a095-dffcad7c2a07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83cda69c-9aec-4cce-a095-dffcad7c2a07.tmp
Size 27KB
SHA256 459b36e649d829d3e70f2ba264b20a46b75587498d6580ab774367d38c269875
MD5 15c4b1b88bc4e28d4e7fd3913afd4f0c
SHA1 a5c0b8df8e8d9d761171ccb42c8437dd3ca9fcab
SHA512 82fd3fe20515b171734d04b887f64890b55eaa981a2d1194ce598b0871df65a98c10275ce8ea1c6d9394145b1d13403c1e4107af2a5e5e3c3b333cac9c6ac9ac
SSDEEP 768:U/pC8x7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbyhpZACroJVS:U/pC8nEbLmWg8KfrLu1jag8pZAZrS
TLSH
T1A0C2CA6B740CCB7F4F904ADDA8197E9B6D6802CB9A98CD8047FE941C02C77EE91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 19KB
SHA256 568bfc060ecbab917ffdd7fa362b35a51df9b358fa9ba4d803b8a6c98ab42afe
MD5 33e0c9f431cca16e6c5642e0ec3d1145
SHA1 f86e5816443ad3820078c066774e94137426ef00
SHA512 ece12f1599998d44efc82f45bf29f25c38f94832d6c2ab1cfbd1e0411049722a07d7c6e900c8d4e6c3a9a606c7f2f1ce3fbd2e3f3bb298d1064276a9b69e654f
SSDEEP 384:wQe6lrhMl0kSXPUHTA2Qig4EJCBsFfSXCk7w:/e6phM68zLQigXJSXCk7w
TLSH
T11092D3817E82081BC353B9352DF51F1EBB34982F4187CE855B72BEBA6AF1BD40A34146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 22de7c355609d1184f76ad94634102b898d7ec41866a5f23f35acca16d3563c8
MD5 b190082016d9bba6c38ea25badc9eee6
SHA1 610698ab221bc1fcc438a93d7730907cdb57f88a
SHA512 2b14b4967aac365f41cef9055a9240c8fc8c898ea1288b044338e373b38938389e5dd2f93b76ce9082d10f30660a2adf40ffec1f144f79733fd988460aa7f22f
TLSH
T10A51D8C342C25C7EC77AE83A41E8211B3E3094B416CB6FD91C57EBFD7B29B199560091
MD5 SHA1 SHA512 TLSH

Submit Download

cb5fafcc-a2ce-435f-aae0-5069a0ca8b9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cb5fafcc-a2ce-435f-aae0-5069a0ca8b9f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2358eca5-9eef-439c-a520-a06db5a1ac03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2358eca5-9eef-439c-a520-a06db5a1ac03.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

255f375d-a12f-4306-baf6-b02a9265fef5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\255f375d-a12f-4306-baf6-b02a9265fef5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e125197b65107bae11baaabe217ea90435a55209663a5f18b0b8f80f861b3b6b
MD5 3809ec3ef8e356b63d74e5240519abb0
SHA1 a6c8958aecf488aa0ade123d316c6e1d1d2a6e29
SHA512 5b2ff7d8263458f1eb82ade04c43fadbd846b14db0bf9069118ae34842dfab54b636506b931b06922463f7ae895569206c148c762b475fd7bd3f076d07c2cae8
TLSH
T10E51AEF783B4867DDB1191F0AA046E1BCE6D0522436C78A685E0AE2793F3471E1C1A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 76ab0c071d549506ed8ef3e31c1671ca8915572fc1cb466a6794c9b02fec8bd6
MD5 0405a85e85d9180693978cc6b148dc5e
SHA1 8df18212b256be5102359f1c09af1c1662d39707
SHA512 7078c89ff44f890b37b4e1fc2c8d0d2a629e9b06a2b6f418e68a590c2f7bfda634891017c266bc9cbcee64910debb07ca508b47c0a5d8773e283d503bcc3a8f6
TLSH
T1D2216BDC6E264F1178FE272A415EC437525235733026A4BE76F981690ABBF006EB8DC9
MD5 SHA1 SHA512 TLSH

Submit Download

b75e4982-f4e5-4944-8ec6-24c883547fe9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b75e4982-f4e5-4944-8ec6-24c883547fe9.tmp
Size 12KB
SHA256 af919fd510b57095d6679cbcbc5668be3e1656565edc6c8d3574c2eb96bcfdec
MD5 c3988faaf8bfaecc0cdc8070dd39243c
SHA1 e89ff2c5d007ee1058c52d9c789507e1bfc15824
SHA512 a9d10c55c6e774c660e51f0c35215fc5e4187e899a60e0775ac96067fbb5c4df00c63a69b75cc0934a79d883f919e7d35b88434b8350c4dab55364b5b8914379
SSDEEP 192:sxRorCL/fUsJ0HRp3zoA8ppAt/g6+WNJfw/YE+ZfGcsIgD+gJ:sxRoeL/fUsJ0OG/5W/Jz
TLSH
T16242C816AD24A93B8CCBD21DBA557F53D6F95032A0D16E84EAFC8A1C04E76DD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baa5d0a0-2d81-448c-b955-76bbcc926f46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\baa5d0a0-2d81-448c-b955-76bbcc926f46.tmp
Size 13KB
SHA256 4252be972536e84e45915c49d0b4c7e14010076ec9b04615ba2500f4c6559f0e
MD5 e0d28a66ae82d7aa25c5d702dca43b87
SHA1 763d959c5dca152155923158fc256722bf7e031b
SHA512 93533b4cba98477bc138fb450cc34a0c8f5a426f7ee629a63fc0679a335a616464efba6d21c39b65cb52382a1784f6f0506cb3aea575d7bdd0c8fb443616889c
SSDEEP 192:sxRorCL/fUss04ZYE3zoA8pbAt/g6+WNJfw/YEpdHfGcsIgDkxJ:sxRoeL/fUss0GCI/5W/MQ
TLSH
T18252C816AD68A93B8CCBE61DBA557F53D6F95032A0805E84EAFC892C04E76DD630740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca7b03ac-df97-400c-b504-383312a69acb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca7b03ac-df97-400c-b504-383312a69acb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a06202c-a1c9-4a84-9d85-a19af66a9d16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3a06202c-a1c9-4a84-9d85-a19af66a9d16.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a21de28f-4f14-4b19-bbed-f9c4553e310f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a21de28f-4f14-4b19-bbed-f9c4553e310f.tmp
Size 38KB
SHA256 2e083eb49928c16e832b350b7ec9c2a0c0f794bcf3ac93b3105778d397b1a817
MD5 a504823f5ad86373deb97392b6b03925
SHA1 5d13804d8e010c06d84a44969c2ee036478bdc60
SHA512 fbe45a7d03b28c2eb3673382284598e2f5bdc5bfb8032aff28e09558f833b3ae5282cc92eaa0e1c2666bfdb6666d6f9ccb8d10f2f9e52377f86b87d6c1904461
SSDEEP 768:u/UxvxjgC+/3kWYc7fZrK11t3p5XSwQs88uBkiT2Rs1y:jZj3+/3k2tr2pILNBAs1y
TLSH
T13D03C139BCD55C639CB7A341364B2797AFF02153D4C40E98C9DEA60E028779E274B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a81d1c5b-54a6-469a-879c-901cda9fa799.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a81d1c5b-54a6-469a-879c-901cda9fa799.tmp
Size 37KB
SHA256 eb0c1ed1c885b07431e7c36f3307b296eba017128ffa59c874420895f9796c95
MD5 e2b4862bbeb9ddd38cec8249d4bcaee4
SHA1 9fede6d429f22683f9a6ecebb860ca2be125df98
SHA512 1df650abda450ac0ee4948342d1bb9005815381dcf56654b3d9e0a79090f66c5a1460106cc0c620c65a26d35b325be328ea79219bb2a3d42101114d01ea35b8e
SSDEEP 768:+FHc3PwgUEsAerK11tIp5XSwQs88uBkiT2RGJCbETA:yc3aHr2WILNBAICbD
TLSH
T134038D36E8D0C967ACF797C2BB463B569EE06163C4C84AD4DADE9D0D00872DE170BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc66e855-d64d-45fa-adc3-27d9328614eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc66e855-d64d-45fa-adc3-27d9328614eb.tmp
Size 38KB
SHA256 2aafa734bc676cd2d81bcab207fadc026f7066dc729eb55f80a3369dbf06cc19
MD5 133bb3ea077d93daa4ed7b836a7b4d28
SHA1 34faa7107b7187659050fd0bcdc5df52817a3ccf
SHA512 cb5193d083bd02ba4fa352729d98fb7a2e61986d7ff581aa570faded497252b4d7524de591c50e6395998cbd0d4097d59c36eeb41d27cc3a00473c77f0f84acd
SSDEEP 768:v/UxvxjgC+W3xMCc7fZrK11t1p5XSwQs88uBkiTzR/P84g:CZj3+W3xKtr2rILNBHHg
TLSH
T16503C139F8945C63ACB79351365B279B6FF021A3C4C40B9489EE691E028779D270B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d60ed90-5143-426d-afbd-bf0f25f4088e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2d60ed90-5143-426d-afbd-bf0f25f4088e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c5a9806f-c08f-4cfe-ac5c-6c52f1cabd41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c5a9806f-c08f-4cfe-ac5c-6c52f1cabd41.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d31aebc5-6a3a-4498-b2d6-cc5e0fecaaa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d31aebc5-6a3a-4498-b2d6-cc5e0fecaaa7.tmp
Size 38KB
SHA256 5f0fb078e5567a67305782b9cff1c48c204ba52ea41c37dd84f6721be37895e1
MD5 ec6294f2e92bd5066b3e068cb9086bfb
SHA1 7cccdfb2ff4d9a581588a27b904fbe898e042ff7
SHA512 989c9d4718179d926228bf4ccbb5d0bb18480a8eb1252acf8ea5702cd7f60406878e3602d12dea207cdfe68dfb506364f980aadb0d0c357817ff4ce8e1df9b14
SSDEEP 768:J/UxvxjgC+/35WYc7fZrK11t3p5XSwQs88uBkiT2Rs1y:8Zj3+/352tr2pILNBAs1y
TLSH
T15103C039BCD55C639CB7E341364B2797AFF02153D4C40A98C9EEA60E028779E274B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4df921c9-332d-4ecc-a193-4139f240dcf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4df921c9-332d-4ecc-a193-4139f240dcf0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1b4360ed-6586-4faf-ad0b-de331752309d.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b4360ed-6586-4faf-ad0b-de331752309d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2f0ca2c2-be8e-4312-ba8e-ff3635b71700.tmp

Path C:\Users\Admin\AppData\Local\Temp\2f0ca2c2-be8e-4312-ba8e-ff3635b71700.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiticoneDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\874b4f8e-d6f6-485e-b8c9-cf61c513174e\SiticoneDotNetRT64.dll
Size 75KB
SHA256 adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
MD5 42b2c266e49a3acd346b91e3b0e638c0
SHA1 2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA512 770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
SSDEEP 1536:mXvHWEbJMwk3HwGTc/1dbJ5xUSns9Ymi5j:ovHsTTI1xUSns9YmEj
TLSH
T1DE73D747E7B651D9D4B6C0389292223FF97178A8833897DB5764891B0B61FE4EE3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6076_1672648980\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_217275486\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_291522686\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-77-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-45-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-105-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-101-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-99-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-97-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-107-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-109-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-111-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-95-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-93-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-91-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-89-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-87-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-85-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-83-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-81-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-79-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-113-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-75-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-73-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-71-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-69-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-68-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-63-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-61-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-115-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-117-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-59-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-57-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-55-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-53-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-51-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-49-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-47-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-103-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-43-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-41-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-39-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-37-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-35-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-34-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-32-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-29-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-27-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-25-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-23-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-22-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-21-0x00007FFD2EE40000-0x00007FFD2EF6F000-memory.dmp

Download

memory/256-66-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-1549-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp

Download

memory/256-119-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-121-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-127-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-125-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-129-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-131-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-133-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-137-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-139-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-141-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-143-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-145-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-135-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-123-0x00000209B3090000-0x00000209B3257000-memory.dmp

Download

memory/256-6-0x00000209B3090000-0x00000209B325C000-memory.dmp

Download

memory/256-5-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp

Download

memory/256-4-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp

Download

memory/256-3-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp

Download

memory/256-2-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp

Download

memory/256-1-0x00000209986C0000-0x0000020998872000-memory.dmp

Download

memory/256-0-0x00007FFD1F6CF000-0x00007FFD1F6D0000-memory.dmp

Download