426371935589eb0318b52629e7b42d48b35f01e8a376f04d1a0385b108ec57eb

Analysis

user interaction
yes
max time kernel
298s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 44.8MB
Sample261029-2dxzastthy
SHA256 426371935589eb0318b52629e7b42d48b35f01e8a376f04d1a0385b108ec57eb
MD5 2b920914424e4d9be9daf7310d6209bb
SHA1 313f71972b3cfc1c1afce719114f439479f80f3c
SHA512 4195e30118c0756e6498e9af6d3cdce3973546a1cb74a8ad414ebd6e027a8641c6b3be95fcb94ecdeacef81d7a783d18cc76f4064874ca88289e72ea5cca8b36
SSDEEP 786432:dR+2mYnG0ia6CI82VRm5qjCnqbGgurJ1izFDX4TiEPJ0mqw4Ww/dvES0YYfwaDBj:d4256CqE1nqbcrJ45DIRJ0m54d/dcS0x
TLSH
T1D9A723CBD5E693E4C8C30784158712CB65C0A99EC5AAD63D3BCF6C037410EBB55CAAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4636	launcher.exe
4636	launcher.exe
5116	launcher.exe
5116	launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1984	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{1E49A5E1-EA49-48D6-8642-2DCDF655A456}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	launcher.exe
4636	launcher.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe
5116	launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	taskmgr.exe
Token: SeSystemProfilePrivilege	3948	taskmgr.exe
Token: SeCreateGlobalPrivilege	3948	taskmgr.exe
Token: 33	3948	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3948	taskmgr.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3916	msedge.exe
3916	msedge.exe
3948	taskmgr.exe
3948	taskmgr.exe
3916	msedge.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3916	msedge.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe
3948	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	launcher.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1984	4636	launcher.exe	87
PID 1252 wrote to memory of 3916	1252	msedge.exe	108
PID 3916 wrote to memory of 4156	3916	msedge.exe	109
PID 3916 wrote to memory of 3268	3916	msedge.exe	110
PID 3916 wrote to memory of 4360	3916	msedge.exe	111
PID 3916 wrote to memory of 3268	3916	msedge.exe	110
PID 3916 wrote to memory of 3268	3916	msedge.exe	110
PID 3916 wrote to memory of 4064	3916	msedge.exe	112
PID 3916 wrote to memory of 4064	3916	msedge.exe	112
PID 3916 wrote to memory of 3004	3916	msedge.exe	113
PID 3916 wrote to memory of 3004	3916	msedge.exe	113
PID 3916 wrote to memory of 3004	3916	msedge.exe	113
PID 3916 wrote to memory of 4720	3916	msedge.exe	114
PID 3916 wrote to memory of 4720	3916	msedge.exe	114
PID 3916 wrote to memory of 4720	3916	msedge.exe	114
PID 3916 wrote to memory of 3420	3916	msedge.exe	116
PID 3916 wrote to memory of 3420	3916	msedge.exe	116
PID 3916 wrote to memory of 3420	3916	msedge.exe	116
PID 3916 wrote to memory of 3360	3916	msedge.exe	117
PID 3916 wrote to memory of 3360	3916	msedge.exe	117
PID 3916 wrote to memory of 3360	3916	msedge.exe	117
PID 3916 wrote to memory of 4524	3916	msedge.exe	121
PID 3916 wrote to memory of 4524	3916	msedge.exe	121
PID 3916 wrote to memory of 2212	3916	msedge.exe	122
PID 3916 wrote to memory of 2212	3916	msedge.exe	122
PID 3916 wrote to memory of 3668	3916	msedge.exe	124
PID 3916 wrote to memory of 1444	3916	msedge.exe	125
PID 3916 wrote to memory of 3668	3916	msedge.exe	124
PID 3916 wrote to memory of 1444	3916	msedge.exe	125
PID 3916 wrote to memory of 224	3916	msedge.exe	128
PID 3916 wrote to memory of 5220	3916	msedge.exe	129
PID 3916 wrote to memory of 5220	3916	msedge.exe	129
PID 3916 wrote to memory of 5220	3916	msedge.exe	129
PID 3916 wrote to memory of 5540	3916	msedge.exe	130
PID 3916 wrote to memory of 5540	3916	msedge.exe	130
PID 3916 wrote to memory of 5556	3916	msedge.exe	131
PID 3916 wrote to memory of 5556	3916	msedge.exe	131
PID 3916 wrote to memory of 5720	3916	msedge.exe	132
PID 3916 wrote to memory of 5720	3916	msedge.exe	132
PID 3916 wrote to memory of 5728	3916	msedge.exe	133
PID 3916 wrote to memory of 5728	3916	msedge.exe	133
PID 3916 wrote to memory of 5208	3916	msedge.exe	134
PID 3916 wrote to memory of 5208	3916	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:1984

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://www.bing.com/search?q=launcher.exe
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff91f2bc188,0x7ff91f2bc194,0x7ff91f2bc1a0
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,11717897352870269650,9813447896263812887,262144 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,10063677075840856809,5938015297051556180,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,6392402452573158579,9429404740860486065,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,12542116138783350503,1899683120269452626,2097152 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5130238326942311421,996003749115583379,2097152 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,334373004993311311,14758391920533322492,2097152 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,8863923807878870442,8130286125102604273,2097152 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,3662010280284677371,3579129087548941815,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6490745083696948011,4310966949247863871,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8237441663178000948,17431561005063972764,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5623486275045772569,7811071296790819035,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1557408552816465666,14409546032325045681,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1557408552816465666,14409546032325045681,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6220,i,10046696372685258142,9360554986674425009,2097152 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,3081644934100993617,17166661106800882723,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,13112331645108966385,11331773518705555232,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,15391678459915545478,13980270934827642248,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,1981514562901252621,16716763441394534048,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10702290050444476313,8027100916744529475,524288 --field-trial-handle=2272,i,11662685901765889952,10682487123232737612,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
    3⤵
    PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5696

C:\Users\Admin\Desktop\launcher.exe
"C:\Users\Admin\Desktop\launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6c136e80-9637-4dbf-92e2-83ea0cd6ee99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6c136e80-9637-4dbf-92e2-83ea0cd6ee99.tmp
Size 23KB
SHA256 729e5490d24c11c4fecbd747f5917a9b26c91d61417422e5b922f04954f4f596
MD5 f19271676019857c638f1413e190a9d7
SHA1 6d5815a1a4c5fc7375bc3b0bbc5c71861b866b59
SHA512 a134297c1242afbba064e8dc4c63ead70e3612da9309f2839a12e1e85a5b8f39e73e81e109cb3b43d281fdbc0395430d33f23f16da9bcc70aedd88704df92b0d
SSDEEP 384:nyQkUSv0sNRewABB6zUOjTV8/dwC3wJrAGfVStEg7sM9Z4vaTZcOobIIlR:q0v8vnYAhAyS+M9Z4vaTZcOobL/
TLSH
T16BB25C71E8A42DF785B2E9C1D04AF103AFA4513BC9991A4CD5F9BA3C308F6F82352C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6896424a5a3b381b45d285b4cf70ce7e98f33f311d36d19d8d3b3ce510d1fb4f
MD5 0f416c8861efd339d5180f12f5c81c0a
SHA1 34c85e241e2f5f4626ed5826171c2f0f05e68ec8
SHA512 cbf250ad342a0353aed2853b94687d52ccac9cef58d857a8e044f825113708d40d3087d248724d9c0cac9d60ad41fefdc7a127351677073192f4123030ebcfb1
TLSH
T1BAD0807479163DEDC1DE70B5113499C04394DF238101151916530D181D743933851DD8
MD5 SHA1 SHA512 TLSH

Submit Download

1e9e8239-c6cd-467c-9a5b-d528d385e005.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e9e8239-c6cd-467c-9a5b-d528d385e005.tmp
Size 13KB
SHA256 96a4b0ef678fcc0ed5f378856c26cdb017f346c8910ea9e459a0b2409fd01cb0
MD5 7accacce9343dd8eaa5783a636a10eb8
SHA1 d66e9c625af970daee8e74998d3cdf802c7301a7
SHA512 d177f2a50f11ccbf223478fe885c4c013179e4123759e2b62364365836171771c3f626545a3d2924558e1835974f9f6bff554134030e69cc4ebefbb47e557ae7
SSDEEP 192:sxZRRrZlcBzI9b/fssaWpVSzcWdpTr2HW6+WNCf5+/YRvRVTMIgye+R/K:sxZRTlmzI9b/fssaWvSo2WHbL/msCc
TLSH
T12852C7526924D9778CCAD619BE35BF13D7F9142399911E4CAAFCC91C01EB6EE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

879c909d-9718-4725-a1d1-4e971c694093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\879c909d-9718-4725-a1d1-4e971c694093.tmp
Size 32KB
SHA256 d0190b8d674a817aabb5b7ad6ec68b96d8dc0483d322d79706f701278f4cf49b
MD5 5b5449d6033f8446e353f7c42c8c1bbf
SHA1 75a4387d168f17b8bc8ccffc9e910a396f1ac0e8
SHA512 46a956060d94b832eb30c498b9a567a1354302b274760c9d59ac5bc12fb45197e636777a81628b4ac23c95fe78e83738b7f8561dc5c2d4f9d7dc630941e7cf23
SSDEEP 768:1xK9u0P7pLuLjwYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvX0HLlh7k3Kro8:1xK9u0JEjwYWvcQWsu1ja2X0HL7Q3hxO
TLSH
T121E20B3F780CCB7E4FC00A9DDC5A7F9B6DA8029B96988D5047FE941C02C66EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d5bd3d2-03b7-478d-820a-a64aab115ab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d5bd3d2-03b7-478d-820a-a64aab115ab5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 45KB
SHA256 e8673783a155bb04180378c200fffc8910f6f062c8bf07d56f02f8bbbd697319
MD5 a7106e6beb39ce4e98233a5b3c1772c8
SHA1 689082c31b53555feafeff4145cc438b0d70e7a7
SHA512 8ad167a66e583628cad724c054e8a3a1a507a48352fa55225cfab6aef32185dcbfb7672340442ce7e9ddb92b12e398693a7e7e73dfcb96abfa2e0607bc7be95d
SSDEEP 768:SLK4xOdpIA1Szu+48kvAG2kLhCQpGCETEiDq2XDzjpl+qEKLj:SLK4dVu+DqARyCQsCq9q2zR3
TLSH
T1E223F1408E48EA9FD8D264CE83D7D8D9A4CDD4801612E73A634638C2B4B21BDFD568B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 a0bdb2899e4b7aec10316605765c8fc2f8431697f20c35c877bbb5bbc157dafe
MD5 bcc52acc07243ce2fefe4a7dd7e837d0
SHA1 bd2105df69ec72d9cb0f61394731ff93ea83b94a
SHA512 52c5476a1890ce78ce4a71fbba0575de5106001adab781b206ea1686dc59c9f1e389c7be12bc04427f92a1c2561a22184bea1e92ff132fa1c5cd126e1279dfda
SSDEEP 48:1tU7g50osV4OvNTzdo8FKtDXu65nhCCkMToJBRQh2pnSXN6REIsocn3ddNwsm:Tluoo4CzKleUwC9Gfpnu8OIENdeX
TLSH
T114A172800065F696FFE439316FEE1E8A36BE4463F743DC8216AFE43664CA784B1D4808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cee7f365e331d5fdc2a5ed2634fb0b1410f37262a29e74d1ac5fc161a612f835
MD5 5895535732b54ea7cd3e98b480da286f
SHA1 0b355d8618c29fabef7dc0faf7e109e3bea14b44
SHA512 cfab78fd378052cb3b5613f6c514288855dad97c8a2d0379def5ade57a716f252c82b1805cdbbfa32754c39323dc50f93740edc4e1923cbef12b8f6c89bea613
TLSH
T1CC61738440610BE6FFA47935B5EA134F323E45A3D783AD8617ACE47768CB794B204C5C
MD5 SHA1 SHA512 TLSH

Submit Download

a0169afa-923e-4906-8528-76b55d2919d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a0169afa-923e-4906-8528-76b55d2919d3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4818266f-545a-4895-89d8-7e87a4c2d199.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4818266f-545a-4895-89d8-7e87a4c2d199.tmp
Size 2KB
SHA256 79e9498f43da08fa6dbcad63dcbb6f9f6b6a7f3b5e72b4a0774c826065b21c71
MD5 1fe45a86bcca7f38cca9435807bcf306
SHA1 41fc0aeb68ed199b166f9ff5455a21f485f61a3c
SHA512 edb0395233f38c4e5dd3e4998c6e593fb39b3d692d6e0bfdf59b8fa6e025589dfe11b218c6858cc7dacec4d7c635d902ae546b8a15c11aaf66bb5926aee066c1
TLSH
T1D951BDF7C3E8867DC90156F0AA186F1BCE5D0955832C3D5AC4E4AE1BA3F28B0E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

703efabc-07cf-4f99-9ba3-1117278ede5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\703efabc-07cf-4f99-9ba3-1117278ede5c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1fe90f6-075b-4f39-afed-d9c3c9752d1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1fe90f6-075b-4f39-afed-d9c3c9752d1f.tmp
Size 8KB
SHA256 abb0c7612f1794cedce278b1849c34de7236f9dc58d3bd04b459e34a6d135d1b
MD5 8c2c868f275cf54aa28d6f7805f02f0e
SHA1 aea09d754b9ea6f40984dae1c83ba9efcbd1e474
SHA512 06c1dee69d85e0cf7294e392cf1e58b2f2fbc0590ead392fd41fe8c2553baa59fe084c72bf095907f46c54f18aa439d1b35da3b8864bf524123c1284d006f45f
SSDEEP 192:tONs6yyQmiUyYo0OCTVgj0+FdVmCggFJSJr+3UvqRU6:tONs6Fg0OCTV8/dwC3wJrXyU6
TLSH
T1ED12F936A8686C7B5DA3A545F48731139FE45167DE8A3F90E5EC1E0C01EBAAC130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c22ca1c8-4f37-482b-85af-dfcdf4b53d5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c22ca1c8-4f37-482b-85af-dfcdf4b53d5a.tmp
Size 8KB
SHA256 5594846af30fa3deaca1cc1e66b75d4c5d6890517202e14b8ed678e957998ddf
MD5 d01ec9abbdaab79f3b6781218e127934
SHA1 31df2d9b8d428ec55f6cbbde274783a56012f7f1
SHA512 69426d8ab3f9f28ad1102477c04e40a3f75367bf9f0858059d5e1a9ea360ca9a857bc3e2b20a80c6dbebaa5156972e4ddd6277ab3f9c0e6e95c8526a771e099e
SSDEEP 192:SONe6ygpQmiUyDotOCTVgj0+FdVmOzP5HU6:SONe6lHVtOCTV8/dwABU6
TLSH
T1E602E835AC783CBB9EF2AE45F48736179FE4116BDA962B90D5E80E1C01D766C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

213a2bc1-701a-47c0-aa49-434ecf64049c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\213a2bc1-701a-47c0-aa49-434ecf64049c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 556add6f170453005b7db19dcc9fb4ccfdefbb7a2d29d0a38abc7264c3d0ac13
MD5 dc967d3f1d634fcc0ba8bb65af0fb1ea
SHA1 711bf2053e8e32b5e81db4601fc4605c3d2b1fea
SHA512 f93df2d00df2a7be9e1cd0b49f3808045867cd671e3b48696e51690bb37758ce603c4df986f87859c81e486fbd70cf78efc9ffe840b8dac5a482d4d61b2d100f
TLSH
T10C411A58B6F90148B3B76F5AABF6786E48BA7D332F46D55E10110E4E0627B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

4926e8c3-3d7d-4471-9144-894376cabde8.tmp

Path C:\Users\Admin\AppData\Local\Temp\4926e8c3-3d7d-4471-9144-894376cabde8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3916_106686195\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

ff485c43-106b-4830-a164-688832abdc54.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3916_106686195\ff485c43-106b-4830-a164-688832abdc54.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040085a9-4c3d-4a89-8ff3-49811ad18747.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3916_1714574908\040085a9-4c3d-4a89-8ff3-49811ad18747.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3916_1714574908\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3948-26-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-21-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-25-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-23-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-27-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-15-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-17-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-16-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-24-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/3948-22-0x000002B549290000-0x000002B549291000-memory.dmp

Download

memory/4636-14-0x0000000140000000-0x0000000145131000-memory.dmp

Download

memory/4636-0-0x0000000140028000-0x000000014246A000-memory.dmp

Download

memory/4636-13-0x0000000140028000-0x000000014246A000-memory.dmp

Download

memory/4636-12-0x0000000140000000-0x0000000145131000-memory.dmp

Download

memory/4636-4-0x00007FF93E120000-0x00007FF93E122000-memory.dmp

Download

memory/4636-5-0x00007FF93D600000-0x00007FF93D602000-memory.dmp

Download

memory/4636-6-0x00007FF93D610000-0x00007FF93D612000-memory.dmp

Download

memory/4636-7-0x00007FF93BD40000-0x00007FF93BD42000-memory.dmp

Download

memory/4636-8-0x00007FF93BD50000-0x00007FF93BD52000-memory.dmp

Download

memory/4636-1-0x00007FF93E0F0000-0x00007FF93E0F2000-memory.dmp

Download

memory/4636-2-0x00007FF93E100000-0x00007FF93E102000-memory.dmp

Download

memory/4636-3-0x00007FF93E110000-0x00007FF93E112000-memory.dmp

Download

memory/5116-721-0x0000000140000000-0x0000000145131000-memory.dmp

Download