a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37

Analysis

user interaction
yes
max time kernel
10s
max time network
72s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced.exe
Size 294KB
Sample261024-czrxqsfs71
SHA256 a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37
MD5 7e7a8d677ba2465e703a9367fe5847ec
SHA1 e5bec7567061dfb25e2888b84fca9376128a6cf3
SHA512 4b4fe1ffb0680b0fefdb01bd6fc167ea29c6ed11fbc6b8bfb2a6ee2bc642fff32ba1f9f3a8a3d5e6da70a5c7c2f96d77210b9b2b0e351e50b808fa9c7160ed13
SSDEEP 3072:vIQaVQ4eHr1mBs0IoyUlyiYBK4mAbJB3fSN1/3A2+qGl1g7NzUWVMk9PaxrtUEVk:vUesq0IXU3G4O2jGl1gZthDCuHtFdAc
TLSH
T1D654A41FEAA650E1D4BAC0389193713FFCB170A68331A7D79B815A471B61BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Colors	fastflag_injector_gui_enhanced.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	fastflag_injector_gui_enhanced.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3492	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	fastflag_injector_gui_enhanced.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3492	4056	fastflag_injector_gui_enhanced.exe	88
PID 3492 wrote to memory of 5704	3492	msedge.exe	89
PID 3492 wrote to memory of 3840	3492	msedge.exe	90
PID 3492 wrote to memory of 2880	3492	msedge.exe	91
PID 3492 wrote to memory of 3840	3492	msedge.exe	90
PID 3492 wrote to memory of 3840	3492	msedge.exe	90
PID 3492 wrote to memory of 5076	3492	msedge.exe	92
PID 3492 wrote to memory of 5076	3492	msedge.exe	92
PID 3492 wrote to memory of 3560	3492	msedge.exe	93
PID 3492 wrote to memory of 3560	3492	msedge.exe	93
PID 3492 wrote to memory of 3560	3492	msedge.exe	93
PID 3492 wrote to memory of 1724	3492	msedge.exe	94
PID 3492 wrote to memory of 1724	3492	msedge.exe	94
PID 3492 wrote to memory of 1724	3492	msedge.exe	94
PID 3492 wrote to memory of 456	3492	msedge.exe	95
PID 3492 wrote to memory of 456	3492	msedge.exe	95
PID 3492 wrote to memory of 456	3492	msedge.exe	95
PID 3492 wrote to memory of 2904	3492	msedge.exe	96
PID 3492 wrote to memory of 2904	3492	msedge.exe	96
PID 3492 wrote to memory of 2904	3492	msedge.exe	96
PID 3492 wrote to memory of 4904	3492	msedge.exe	99
PID 3492 wrote to memory of 4904	3492	msedge.exe	99
PID 3492 wrote to memory of 5620	3492	msedge.exe	100
PID 3492 wrote to memory of 2656	3492	msedge.exe	101
PID 3492 wrote to memory of 5620	3492	msedge.exe	100
PID 3492 wrote to memory of 2656	3492	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/davedown
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x37c,0x7fff325dc188,0x7fff325dc194,0x7fff325dc1a0
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8248058846251674341,8886803585282028848,262144 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,493983794639488582,15578254952702254306,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,1032893073638376178,12800350772374150878,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8310128582907852435,8354148247586237385,2097152 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,16319548005879969812,6899837470718157777,2097152 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,17890252955100405175,6288990891121069886,2097152 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,5310784290959028776,4144902178532490228,2097152 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,1287453503556995635,8941642378733879178,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2484270489995332921,17873077289851894253,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,11405369290213551187,13088274669547650091,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11143090836452542366,11094340682147366862,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11143090836452542366,11094340682147366862,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,8921990904253578581,7284543976073011432,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,3841407487396091370,1488598654335895476,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,3213434966247077402,16505606896722213695,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,8696909954391962205,13145945330034576175,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13761709204450709396,5549115585503654534,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:14
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9166337279798696967,12190571543847747886,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,16190558343929656125,13276312457996224765,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12688075260194288806,8475236910254594082,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,9655229113982170936,391595522181275009,524288 --field-trial-handle=2360,i,12393670791747024381,8181617837811336339,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ea90e56-e5ca-4a5f-9704-f00897c6f26b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ea90e56-e5ca-4a5f-9704-f00897c6f26b.tmp
Size 39KB
SHA256 8d20b3f7a264c58fa6bdaaf961922325b79310f07ed6cb68f054400251670e3b
MD5 513eb58b1f5680f72f3218b2794bd39d
SHA1 9068f147e8517e2e47d5132eabb39df979af22fc
SHA512 1ba5588f1aad9611018be004eede3f5fcc84dfc39af301537939596a2fc1022ee20643f2d3e730ffdfd0d7c5ba3be264a584a709b30913aa7b75b30fd72e5a94
SSDEEP 768:aFHIs3VwgIlyrie1d8HvHDmGA5b65Q92RQMPb5+NLOoLJ:GIs3E/BAF65dQS+NSoV
TLSH
T1EB039D76DC91DE77ADF697C1B746B246AEE44163C8CC89D4EAC96E0800C72CE034BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59efa620-cbf1-4662-a4fa-c24cc9f9bab9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59efa620-cbf1-4662-a4fa-c24cc9f9bab9.tmp
Size 39KB
SHA256 ab8320562f6c6e3798f1a72a1f5c6ecbdae06ba762a15a9fdcd53922fa6a4f58
MD5 aafaf8227d1ef4544164d0923117a897
SHA1 13b96e5630a34f239e5d7506ca67d3406dde132a
SHA512 02338bb18ef834626f7dbd5c89eab3e9c77e4e287eea0df251ad4618ceda16bb567f6e3c172ea7c2ac7de2548ae28dc1211617e2e500566ae7317f9990993313
SSDEEP 768:U/UxvxjgC+B33Gyngm1d1tDmGA5b65Q92RQMPbtFj0O:BZj3+B32W3AF65dQuFQO
TLSH
T12603C036ECA1AEB7DCF55280374BA35AAFF84473C1C955A049FD6E1D06C768D430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d1a75a2-a078-4cb3-aaf8-715b30a2b267.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d1a75a2-a078-4cb3-aaf8-715b30a2b267.tmp
Size 40KB
SHA256 aa87e7a5d200b381a1e737698f41db1d91931ebe4f78ca300b0ea4eb920d83a6
MD5 12044a1837ca506629cf324f4b77251e
SHA1 c20ae98761877f140af7d3135ab46403dd3575b1
SHA512 a976437b2d0f7462fccb1c1ac6b183f923b05b3a58484358bf58fe0ff0b16e5ce56df126ecc0a9ca4807bd956eb72bd133983022e5c772cbb06454e033188913
SSDEEP 768:Z/UxvxjgC+ks3ylAUgm1d8HvpDmGA5b65Q92RQMPb5+NJ42t:MZj3+ks3yObAF65dQS+NJlt
TLSH
T1A803C031ECA5ED739CB9A1813747B396BFF8047384C959A459E9AF0D058378E430B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dd7e76a-c9e1-4832-a1fe-29ca96b25b07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7dd7e76a-c9e1-4832-a1fe-29ca96b25b07.tmp
Size 35KB
SHA256 3813c0b43931a581efc03d0d216117dd9d9b0f8bcbc7fbe6cf90c975ff0e34d8
MD5 bfa88e7673f0a98ba8df68850daca5b8
SHA1 29d825e90c93b4e882b21afe79fc083fa9405907
SHA512 49bc1bcf36d49696a2916cdefeae96154170907b6ede18cd7f3b8f2626d570500f3a256cd1d690406ebde3552ebd1e88b72598eace913f68a4d1d3bbd0cc203b
SSDEEP 768:3Is32lAUgm1d8HvVDmGA5b65Q92RQMPb5+NLOoLJ:3Is32OfAF65dQS+NSoV
TLSH
T1ADF2BF71ECA1EE738DB9A1817246B3867FB44127C8C88A94E9D66F1C05C76CE134B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

14ad893d-87a9-4b16-93f5-df8f04f45ecf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14ad893d-87a9-4b16-93f5-df8f04f45ecf.tmp
Size 12KB
SHA256 8da4944e73a2c8f56218864077164166b98d2c1e1f9deb6fcdab8715cd535fff
MD5 550f23685682dc1fa5192da444f7569c
SHA1 9d11fa454d716b7d905bd26d3fc774c56237c9d8
SHA512 88bacc990ba8bba50d02e84ecd9a4e40f27a04355a9ad6d15d96e2db8300df6c44516c27067b17968229c8b87b204b84161a6d22fa7406d807078a23d219a208
SSDEEP 192:sxR0REC2/fsvsNyYhZzoA8pys/g6+WNInl/z52lRcqGhsIgDVCJ:sxR012/fsvsNbkX/5a/53w4
TLSH
T166428715AD68A93B8CCBD219FB657F63D6FD5033A0941E48A6FC8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35704634-0dca-443d-b3cb-31523b9548a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35704634-0dca-443d-b3cb-31523b9548a2.tmp
Size 12KB
SHA256 a4582def5d1f7841ccaa870fdd37462c72ed3281f9d2569c1766fc104e519249
MD5 d7b10edf7ef7954d0e27b69fbd80e655
SHA1 9561d985e32d0fbd1ccc36a5cafae1c000bedfec
SHA512 bb2ed99f8afef9582c71f1ae3672c3ae25d1b91d4232c90fe7386e97b6b81c299c2e53357e066ae156b73b97c896056eafb35bc52298a164a2b0690f8d26aa86
SSDEEP 192:sxR0REC2/fsvsN7ZPdzoA8pys/g6+WNInl/z52lRcqGhsIgDvCJ:sxR012/fsvsN1PQX/5a/53wS
TLSH
T18A42A815AD68A93B8CCBD219FB657F63D6F95033A0D41E48B6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a9ea88-3cfa-4b6d-a405-dd62a2b68a27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56a9ea88-3cfa-4b6d-a405-dd62a2b68a27.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60b60621-9381-47db-a2be-4799afb48a6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60b60621-9381-47db-a2be-4799afb48a6e.tmp
Size 11KB
SHA256 48b956178b58a4c31254df6f5cd34fd57a57b4064b677c434d40d32a5822649d
MD5 7dbc5ae2c69f51b50e182dafdd1d7815
SHA1 1bf4e8e37cdfded019c0427e01bcfeab8dc0c664
SHA512 4c0674c89dbf3460d2b91957c2f3c3c0e203fff9692db832f73ca8288ccfb17db52bc3236c3a748e0d90bea122f1b6559138919b325ab84c6f129d79fd3ee803
SSDEEP 192:sxR7REC2/fsvsYyYhZzoA8pys/g6+WNInl/z52DcqGhsIgVuJ:sxR712/fsvsYbkX/5a/53wE
TLSH
T117429616AD68A93B4CCBD21DFB65BF63D6F95033A0941E48A6FC891C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e9dc4c88e823717b2894b09761fbc79830c043d7d7524b77e427e58f31559616
MD5 b3bf0ee88ce177fc9c1cd897fe80bb07
SHA1 e64b24ee5f5134ce306df886079e0f8c96177301
SHA512 6df8e1c15720ecd4d6c63a6b836d9291bfca5cd373d432019a1afa5440957e821c13b0e700759f728a61dba7bb21eaea06845269fb8d3d3bc64808b915b23c7b
TLSH
T15BE0268444D8C22EA209798701AC430CC3C0373F92E4EA0E1714C9D8708D894F2CB6D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9c99a0c734192195d2d2786923193c7d3dd75a99296b7e0a3fc7af5b8ed17e22
MD5 58a367762e11954a8dc2def434498486
SHA1 24e05311f1298ad05cb6b01072de64380a363746
SHA512 02a8e9cc132cc3c5ee88834e099cfa0606f2dfe094276ba0993d4bd6eb164ea2d16e55f9a0fcdb7a502fe0a5bd56b66af0c6b62e0a6d70b07dcff2c01d04533d
TLSH
T10B6174828194E381CB9D4373A5D5A5C7B6749BBC978F1E33A8E0E7749B1E312B19C844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 552cb4e058469e35d785d9d22f479fc6339477df0df76636be78d46fd6371283
MD5 06a025fd7b9d6e877b6aff8a3ef6c481
SHA1 f45a976a5f8d9fc2ece6932ae73ed6d19f867775
SHA512 fa7857c0b36c4fc27b9107495fb4deedc8356133f090170d80ec62f9153569b49ae72a38d79f36b11f4d1a21125896abe6f90dc64a509ca314d1f858665665ad
TLSH
T1EA5198824284E391CB5C4373A5D565C77B709BFC978F1E33A8E0EB649B1E302B25C844
MD5 SHA1 SHA512 TLSH

Submit Download

6271fb11-d2a9-4f79-9eb1-8050faf9771a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6271fb11-d2a9-4f79-9eb1-8050faf9771a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3a5759cc-f72a-4421-9d7f-aabda07e767a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a5759cc-f72a-4421-9d7f-aabda07e767a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7c60a6df-990f-4457-9d0e-1023d96d97ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c60a6df-990f-4457-9d0e-1023d96d97ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a9952f69-5e14-41e9-9f6e-84f1a8bccca7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9952f69-5e14-41e9-9f6e-84f1a8bccca7.tmp
Size 12KB
SHA256 00ceb0cf23b5af78254811e25e7d8d460189c0977d40d9a375068aa8df826320
MD5 004b3cd831020251e9a46254ccabad59
SHA1 6530b895a04d186e3ee2bd3e32de689d7a70f5bb
SHA512 54bc9c6df2b1fdecf88118168c166509be248f4a40640a4ae0f0644dfe0b8de344db421fd76f8309e903604d8d346d64e6b7144846c4381f5e9a68cb68dbfb77
SSDEEP 192:sxR0REC2/fsvs2yYhZzoA8pys/g6+WNInl/z52lcqGhsIgDVuJ:sxR012/fsvs2bkX/5a/B3wg
TLSH
T171428616AD68A93B4CCBD219FB65BF63D6FD5033A0941E48A6FC891C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7112d23-77d3-4120-b483-014dc489486c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7112d23-77d3-4120-b483-014dc489486c.tmp
Size 27KB
SHA256 5ba5f9910756d2c9250522aa305f41572b87772d4142f6003c4302362d861df5
MD5 f7f76275ef342e9b9a26fcf386a9214a
SHA1 eb38bcdd9f81428e73fab529681968fd27a0a834
SHA512 5650d479edcce0be0dfb7dd84b993a0b9ec6370cc663ad2bdb01b2358c1c3898eecbf84d240c632eb6c176f27716c0a1f13bdea722439ee307b36e8c07c5f9c0
SSDEEP 768:L7aa4W7pLuLb6DWgptfrD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwdNMlroHV:L7aa42Eb6DWgptfrDu1jaPrMe1
TLSH
T1E6C2DB7B740CCB7F4F900ADDA8197E9F6D6802CB9698CD4047FE945C02C6BEA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f4e94c0e-9a77-47ea-855a-de851d6eb1c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f4e94c0e-9a77-47ea-855a-de851d6eb1c8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab492328-fb6b-4c49-8647-6ba7f19788ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab492328-fb6b-4c49-8647-6ba7f19788ff.tmp
Size 40KB
SHA256 88162beba147a4767c2f175d10e26795311fbd3147685d183c697412578ff229
MD5 44360a2ad78fd895dc09db31fb9bfa8d
SHA1 e722a2ee03cfbe42440536b9be2caf3086ebb1f9
SHA512 7109e70841c5c85d0e9c71d083e7c02b33ffe50db7bca3ce8b6e68095c49c5b4b55eb33bf8225314434e2a0b10ad9f6324d16ec5b275aa782bb03010196978b0
SSDEEP 768:h/UxvxjgC+ks37lAUgm1d8HvVDmGA5b65Q92RQMPb5+NJ42t:0Zj3+ks37OfAF65dQS+NJlt
TLSH
T1DD03C031ECA5ED739CB9A1813757B396BFF8047384C9499459E99F0C0583B8E430B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b46b0471-ae0c-4c1a-9c1b-08759efb3b25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b46b0471-ae0c-4c1a-9c1b-08759efb3b25.tmp
Size 39KB
SHA256 b5d10acc40669bd5951146722e36b578c0eb2893bbbd811f5715ea6314fb1541
MD5 ca1bcea5c069dae02e69eca97a1787c8
SHA1 e04a55c9c44fcc5b4075f5de998fd99aae015090
SHA512 a87926bebd9c39dadfbd1cd856d048c9619eef28875d33fd400f74b8e86fcc21249fb82693c1693246960cb9a2028f64fc84838826e0304843ee7134b1ba4597
SSDEEP 768:f/UxvxjgC+B34cagm1d8HvFDmGA5b65Q92RQMPq5+NFj0O:yZj3+B3PPAF65dQJ+NFQO
TLSH
T1D703C035ECA5EE739DF9A180364BB396AFF80473C4C949A059F56E1D0583B8D470B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16d5ac8b-18c2-4f93-84fd-1c2b9fe72338.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\16d5ac8b-18c2-4f93-84fd-1c2b9fe72338.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e321300c-026d-495e-9817-27f7a324570a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e321300c-026d-495e-9817-27f7a324570a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fed96d37-ce9c-45d1-b8ca-92b8537c9775.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fed96d37-ce9c-45d1-b8ca-92b8537c9775.tmp
Size 40KB
SHA256 854679801c1f814454447c07b1d58215ce146701a91b921ccfa1a79ea8ef6e4b
MD5 1a21df885f08795228fb6ab3dd902aa4
SHA1 718945af927d302983e75124818c17eec25e0782
SHA512 86deec3f71d1399a6149df7cd6fbe0447f17cfa0850e3daf0ddd28f17e1e992e510595c6d18fdf66ac241f089ef114e0ecf6436664f3126cea735ff476a7d858
SSDEEP 768:F/UxvxjgC+ks3ylAUgm1d8HvVDmGA5b65Q92RQMPb5+NJ42t:oZj3+ks3yOfAF65dQS+NJlt
TLSH
T14103C031ECA5ED739CB9A1813357B396BFF8047384C9499459E9AF0C0583B8E430B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f39ff43b-02cb-4dda-adb0-1f57bdbbba48.tmp

Path C:\Users\Admin\AppData\Local\Temp\f39ff43b-02cb-4dda-adb0-1f57bdbbba48.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff42b553-ea36-4522-8e36-fa88d99e33eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\ff42b553-ea36-4522-8e36-fa88d99e33eb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3492_1075571713\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3492_701219231\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads