metasploit | 9f3e0a082d374772dba3b6b795666b811ce92e986acba354d4de97263e56fca9

Resubmissions

31/10/2026, 01:11

261031-bj8d4sty6r10

31/10/2026, 01:09

261031-bhsl9sty6m10

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
31/10/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7-zip.exe
Size 3.9MB
Sample261031-bj8d4sty6r
SHA256 9f3e0a082d374772dba3b6b795666b811ce92e986acba354d4de97263e56fca9
MD5 a6679049c64df58494264cdeefdf3205
SHA1 951770ff41c968b4a421cf0fc9de0fdcd57c7b62
SHA512 d039ad8eef0f2ee0fd66479f724695c7d73c194a79babe2fc0e1b6af10b5645eb1b5d875b788722e79c47097c8c6f949061f0f7f977723fe8e765dc720302f46
SSDEEP 98304:Cg+q4dfB9WAdkYhtxg0zlo6JX9oNthcfCGUE0cdTV8:CXNJ9WAGYhbb5XX9C/GUERTi
TLSH
T19816334C9408C0EBE9111E755BAECFE323E9BC005951880F739A7B36A7B5E45EE14F92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

159.223.160.74:11111

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7-zip.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1036	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{42C175D2-0BBB-4AC2-AA28-3EAAFA754BA5}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2660	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	mspaint.exe
4060	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4060	mspaint.exe
4060	mspaint.exe
4060	mspaint.exe
4060	mspaint.exe
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE
2660	EXCEL.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2744	1828	msedge.exe	105
PID 2744 wrote to memory of 5068	2744	msedge.exe	106
PID 2744 wrote to memory of 1036	2744	msedge.exe	107
PID 2744 wrote to memory of 1124	2744	msedge.exe	108
PID 2744 wrote to memory of 1124	2744	msedge.exe	108
PID 2744 wrote to memory of 1124	2744	msedge.exe	108
PID 2744 wrote to memory of 1540	2744	msedge.exe	110
PID 2744 wrote to memory of 1540	2744	msedge.exe	110
PID 2744 wrote to memory of 1508	2744	msedge.exe	111
PID 2744 wrote to memory of 1508	2744	msedge.exe	111
PID 2744 wrote to memory of 1508	2744	msedge.exe	111
PID 2744 wrote to memory of 3248	2744	msedge.exe	112
PID 2744 wrote to memory of 3248	2744	msedge.exe	112
PID 2744 wrote to memory of 3248	2744	msedge.exe	112
PID 2744 wrote to memory of 5080	2744	msedge.exe	113
PID 2744 wrote to memory of 5080	2744	msedge.exe	113
PID 2744 wrote to memory of 5080	2744	msedge.exe	113
PID 2744 wrote to memory of 3800	2744	msedge.exe	114
PID 2744 wrote to memory of 3800	2744	msedge.exe	114
PID 2744 wrote to memory of 3800	2744	msedge.exe	114
PID 2744 wrote to memory of 592	2744	msedge.exe	115
PID 2744 wrote to memory of 592	2744	msedge.exe	115
PID 2744 wrote to memory of 592	2744	msedge.exe	115
PID 2744 wrote to memory of 2080	2744	msedge.exe	119
PID 2744 wrote to memory of 2080	2744	msedge.exe	119
PID 2744 wrote to memory of 4656	2744	msedge.exe	121
PID 2744 wrote to memory of 4656	2744	msedge.exe	121
PID 2744 wrote to memory of 2312	2744	msedge.exe	122
PID 2744 wrote to memory of 2616	2744	msedge.exe	123
PID 2744 wrote to memory of 2312	2744	msedge.exe	122
PID 2744 wrote to memory of 2616	2744	msedge.exe	123
PID 2744 wrote to memory of 2076	2744	msedge.exe	125
PID 2744 wrote to memory of 868	2744	msedge.exe	126
PID 2744 wrote to memory of 868	2744	msedge.exe	126
PID 2744 wrote to memory of 1644	2744	msedge.exe	130
PID 2744 wrote to memory of 1392	2744	msedge.exe	128
PID 2744 wrote to memory of 1644	2744	msedge.exe	130
PID 2744 wrote to memory of 1392	2744	msedge.exe	128
PID 2744 wrote to memory of 4648	2744	msedge.exe	133
PID 2744 wrote to memory of 4648	2744	msedge.exe	133
PID 2744 wrote to memory of 1644	2744	msedge.exe	130
PID 2744 wrote to memory of 1644	2744	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\7-zip.exe
"C:\Users\Admin\AppData\Local\Temp\7-zip.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3940

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\AssertConnect.ico"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\SubmitStart.mhtml
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Downloads\SubmitStart.mhtml
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffc4413c188,0x7ffc4413c194,0x7ffc4413c1a0
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10530647654100833209,16235984068659711807,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,16651660508225599379,1366747817240752424,262144 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,2591903235890614826,18299089680436412308,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4458364435825979639,6347526392397886845,2097152 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,6396702959658163981,11890750308885893663,2097152 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,702575285858656037,14252554970068098324,2097152 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6844338603778831863,13970040307993206727,2097152 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,14365801443096208217,4120682516861538751,2097152 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,17871192664101752059,873847367760679243,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17790250723698199180,15295876250622824131,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,16689024818710984250,1942831997615384743,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15272409992828652083,12615096701107904144,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1563310746665363497,15000535550813923915,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1563310746665363497,15000535550813923915,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,947245096643258039,17264937040419630777,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13834664262804693779,17763094272571022726,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16696908498451148637,16656675946108994928,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,9389857459678468731,13666530279331542929,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,17458166965028773793,13344308138782166799,524288 --field-trial-handle=2308,i,4422052214230041281,6854820018722552102,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:512

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\SearchSkip.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

14ce5f14-26be-42ca-91d6-b523e5deaf27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14ce5f14-26be-42ca-91d6-b523e5deaf27.tmp
Size 8KB
SHA256 a6de079391216026bdd0fd4e6eca197cdc17a2bfe8192f674d8343e63cfc16d1
MD5 1accc650ab26655357d79fdf6eb35dc8
SHA1 f2b905685064a52c583b68dfd2decb2046f6bff1
SHA512 757ea938dc336f4621ec677715a3f50c761a77cc22a3fe78ddff1223b015478347fe08e34130e51c10e289c0ad7bc04533fa9e989c2b6d800d1a8ee2b2880663
SSDEEP 192:SON+6ygpQmiUy8itOCTVgwg5OnlKzPOiAU6:SON+6lHYtOCTV5g5OlU4U6
TLSH
T17602C834BC683CBB8EA3AE49F98B27179F98106BD9552F84D6E81E1C01D765C2307D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65d1b964-1984-47cf-884d-6051faaabdb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65d1b964-1984-47cf-884d-6051faaabdb2.tmp
Size 8KB
SHA256 42c3e6331c0e5ef6f960d76fa65b4ad67f118e36ac3018e0f301232fae5dacd7
MD5 3e3af8f31011865b9a29133529cf0b4f
SHA1 b99386e6b720941bd369e60e00c4a7afdf66cba5
SHA512 83175ee9630fa1f834f15542ada811002618ba637fafc96973ccec41d5d1a0051d01bc0f9d7e48cb1b56ba182b5982cb61e89728c0a220521e5ec4b8833c4a03
SSDEEP 192:FONh6yqQmiUylinOCTVgwg5OnlDAjCFJSuQ3Uvq/U6:FONh6VDnOCTV5g5OlDAj+wulMU6
TLSH
T1A5121B35B8686CB79DE2A544F48736039FA8516BDA463F80D1DC1F1C02EB65C230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16664a79-a10b-4465-94dd-ebb8f5040e1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\16664a79-a10b-4465-94dd-ebb8f5040e1a.tmp
Size 105KB
SHA256 fd5ba6f88e522e1f8e0cb3dbf4cf64f64c10742a5b2aa1c2e0f7b84449039d4c
MD5 58b2e5faf89b3d70b354268b3c98e06b
SHA1 95dd78a1bac7ba60e6dbfa4715e760a2257171b3
SHA512 13e81e13df66264b5967807945b42d065c64c1b95affb910c5b634d1c9b5c295003795f3ef67ca19c1cb542a5e93503c201a02f64278a59e26db384a19da02bb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7M:fwUQC5VwBIiElEd2K57P7M
TLSH
T134B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cdd19724cc30cedcf307f18b62fe6654f1aaa6310d806e96bce0c63327183a7d
MD5 e419badd923a4dc06c7697255766fdaf
SHA1 b0641e9104504234b50d7bb12724c52f82660f42
SHA512 1723ec90e634c2598b08911bed42b353ec45b8b4328d4310792e3a9022d54bc98ff0a0f1a48d4a368e0a91976a6c1943ec57b0110eeccb21488624db606dd6fc
TLSH
T1ABD080B43557391DD3DE70F5342996C05395CE139555051545531F091B1437225515D4
MD5 SHA1 SHA512 TLSH

Submit Download

1080ef3c-eacf-4b22-b9d5-4dbbf334717f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1080ef3c-eacf-4b22-b9d5-4dbbf334717f.tmp
Size 10KB
SHA256 997d4ffdaa54704d9ee81fba6be33192ed605b62aee5c02cc39efc472ea53f4b
MD5 bd565a40fef32d93b5fc8a33eca0e10a
SHA1 8450998521caa62d0c434e3b3102c7990aebfbd3
SHA512 f8d8d2044e9c49ffd03fb482fb860f6e0c0826a5e869ca77b84b07a9b391c31d27f6fa446b3037c429d97d3416204def9ebd3705922d83edf96783acfa50be61
SSDEEP 192:sxZd7qZLL/fUsWWpVc+qpsIupdQHW6+WNGYRvTq0raIgyJ:sxZZq//fUsWWvcpKOHbGm5OO
TLSH
T1B232B816AE28A87B8CCBD21DFB15BF13D6F95022A5D11E48EAFC851C05E66DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d56a219-18d7-49e6-8bf1-679690a2dcb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d56a219-18d7-49e6-8bf1-679690a2dcb9.tmp
Size 32KB
SHA256 541f00739c7c6d2b3ec6002067ef264df1ac2f4a62036fbddab3281fcd2683b3
MD5 2f2c4016e2318f5f9c70565bf624664a
SHA1 32e4754aa4e61eedb973b9bbe96b2b247478fdaf
SHA512 ffd3944de64b811b218014ed157759f03b5ab4c77fbc1aa84fc383f7a4814df64b38e01544415a326c8941d1894616da9cbafbdc788805c17aa545c981f61fd5
SSDEEP 768:MAK9uGY7pLILFwYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVd/0HLlh7k3broY:MAK9uGE2FwYWvcQWsu1jac/0HL7Q3o09
TLSH
T1C5E2FA7F780CCA7E4FC00A9DDC1A7F9F6DA8029B9698895047FE941C02C66EE52160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f518e12-ddd3-455a-910c-c8712a6bcd3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f518e12-ddd3-455a-910c-c8712a6bcd3e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 59ea4016f5bd4ef153e9634973ea61556f12d3935153dc3808882b5e3783f7c8
MD5 4f7ab1cb6444f235ca8a10453c99e6d9
SHA1 24a7d97a43c6c10064ce22f40970cba52a55452f
SHA512 f3374c93c9d30b4d9150fe8b86355469cec6d429a60db6392110635cbc8d58af9257f6682fbdb57642ae0df0c26c72dd7a634eac8a0c3696fa482b1f5efe6100
TLSH
T149512D88966140ECFB599C7C41E81273F77789B455C32EA73595CCBB7BDE3A04114C50
MD5 SHA1 SHA512 TLSH

Submit Download

62329cd4-a025-4576-b2f2-1d468f0f946e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\62329cd4-a025-4576-b2f2-1d468f0f946e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

05a36076-e56a-4b4e-ab0f-512894cd7352.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05a36076-e56a-4b4e-ab0f-512894cd7352.tmp
Size 1KB
SHA256 e971981bace9568d282acb4fb7daababc660b343acad0f7c02465b76a75c8e79
MD5 949249c1b0cdc4d58b607dc2558d29c9
SHA1 eec6b78b253a610f54afa23da2635140410d6f60
SHA512 01b3b25ebcf16364ba5c83a93259385db0cc94a6d2dc65189e7789cd2e3df7fce2ce0b5ddea830502b2fc6b205fb497bc572de3465825cab3fcb075f9f9c960b
TLSH
T1EB3180F7C3E8866E890151F4B7187F2BCE2D0954431C3D9AC5E49F5B93E2471D14155E
MD5 SHA1 SHA512 TLSH

Submit Download

14aa2df5-9243-460d-9d22-824dcbf55e4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\14aa2df5-9243-460d-9d22-824dcbf55e4b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

377847e4-60c2-4017-b92d-1e2eaa2dd2f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\377847e4-60c2-4017-b92d-1e2eaa2dd2f2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c85d5d15b02796aadef5f62051656c06a3d126bf618080a5aab1f61a9672d9a9
MD5 c070f1f1037b567b61a78443820d634d
SHA1 375f0e258ab5efff9dd4c34aa6f0ffc5f1dd7c6a
SHA512 486ad703ea1d9373cf7ea897ec024cc161d64d2a5c47000907dfef1e5a0597ba88955009f887e2043e14c27306c79cbc093f2ccac430eb6b945985bbabe25e9c
SSDEEP 96:K0mdvyK4kGJxUXjxnHxSDCscbxKk4cRxophabw+YK7a2CWEKjSj:3hnILnY
TLSH
T1CCD10F2031FE021038BD751985B4A71A928135737618EA3B7FBC55A18E6BE09ACFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc335c59-1428-4a64-a6dd-a15779265f80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc335c59-1428-4a64-a6dd-a15779265f80.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d869f468-0abb-4c63-8016-b3c2174471cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d869f468-0abb-4c63-8016-b3c2174471cb.tmp
Size 10KB
SHA256 dd1b463a4d893b7b8923a03fb1bddb50ad4cbc90cdc85c01f899ca82a3cb14a3
MD5 4eafd625738e9b6dfc322a8b4facbae6
SHA1 8544b0ecfa622a054015a6313b357cb48edb4f21
SHA512 2671c353dc806e278a5a462418ea15bfddfbfb0b1da1ee73b3b7270e61a62b0431aac7a7371235679c4cb5e2bbe42ad1d8526ed2d982de94ab6aa2199c53a116
SSDEEP 192:sxZd7LZLL/fUsO+qpsIupdQHW6+WNGYRPnqPIIg4J:sxZZd//fUsOpKOHbGmVc
TLSH
T13E22C916AE38A87B8CCBD219FA15BB53E6F95032A1D41E48FAFC851C05E66DD130781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5dcaec0-6d8d-4201-8b7b-aba5b48a639e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5dcaec0-6d8d-4201-8b7b-aba5b48a639e.tmp
Size 18KB
SHA256 6583aacfb64189d0c83f6359ddd222eb00eec8b7f52ba91aba37c5e182925c40
MD5 471493f5cdc455522d4e58adb8d917e3
SHA1 dc89efe402a1e14b09fd41f06c6ab37f6f63e0d0
SHA512 2db1cc6ed9cea26eca25b12fa3bf5037b7129054ce64f5dd24fa05e8bc48d6f9a9c8786fbc711f214131a89e23fbced52b2ce768a2a69142831a9470efbd5bd5
SSDEEP 384:nAQkUSvBsNI/w8Xk3QVOjTV5g5OlDAj+wucMic4RNplvlf:oB3InLAOujtucMicCBlf
TLSH
T1EE827C3528682D779DE6D151F88B3643CFB885A7D5C52F90D2ED6F1C02DB298230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e73c9f79-b506-422a-8289-f2f1dedb7a54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e73c9f79-b506-422a-8289-f2f1dedb7a54.tmp
Size 22KB
SHA256 43b2e83fb3effe4aa6db2e5f428a4381c7e019da8f65fd1c439fdd0490d3e352
MD5 b43e56adc06dbe6d7988e8431efad1cb
SHA1 290912684c4564d3232890bcaa426bf5d4f162f5
SHA512 bc2cdeb6654092da4c9153eb235e1022a7f706ab73a1f7eb09bf7d94a87253567d8014d0ecb4148f59707f3fb0da62e6910214744044cbf6fc3cf85e20e82871
SSDEEP 384:nJQkUSv/sNI/w8XkmVVOjTV5g5OlDAj+wu+/xA8til7oe9gdic4RNplvlf:r/nInLAOujtu+W8Le9gdicCBlf
TLSH
T1FCA25B7498682DF789A5E5C1E44AE207AFA8057BC0891A9CD6FDBA3C308F5F81313C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e45b4df-a62d-4230-ac2c-0e5e98eea693.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e45b4df-a62d-4230-ac2c-0e5e98eea693.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3b91d2d2ed5c894807eb362ef5a4e919eefd4fa941ac045ef14c47e3d9f8afa9
MD5 c8eaa7c7e9333ef32d4f1563358e024e
SHA1 82ab2237f107f5588f673fa823a6226ebc29ee5c
SHA512 f48bab5f1e104933a299ed4e477d7a02c1b0792f29793e5a10cdcdab3c418801a6791b1541e6a8ab91185c751bdbc77fde63a731421e474e40adb4d7c906ff7a
TLSH
T15141EB587BFA1148B3B36E569FF6B86D487BB8772B16945E00110D4F0637A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ee5926154e8e7ce99967fe68be28e069f36ddc4fac44e38eef90b0b2a2a5333d
MD5 d81546428887a2f7b27b9f07f3cfef95
SHA1 608611e5fa77d2011ddacc8248b442a6931ba405
SHA512 d8a2aa315f3f2ac4cc0e5fb70af9634f9a7090751b79f9a02dbe9c5aa11fbc0a100518bc901657b20bc3a290dca1b456db15388b961a68b6e3ddc001306a6983
TLSH
T110513A587AFA1148B3776F169BF6B96F483F7D372E0A945D10110E4E0622A40D9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

beb9a0e6-d862-4b00-8867-13939f6af579.tmp

Path C:\Users\Admin\AppData\Local\Temp\beb9a0e6-d862-4b00-8867-13939f6af579.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3ae299b-7756-4fa9-98b9-fe052c7f4ed6.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3ae299b-7756-4fa9-98b9-fe052c7f4ed6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_236509279\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9b895d7-a8a4-47e4-b3b5-6863ffb2df08.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_236509279\f9b895d7-a8a4-47e4-b3b5-6863ffb2df08.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_689605211\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

~$SearchSkip.xlsm

Path C:\Users\Admin\Downloads\~$SearchSkip.xlsm
Size 165B
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
MD5 SHA1 SHA512

Submit Download

memory/2660-436-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-440-0x00007FFC20FD0000-0x00007FFC20FE0000-memory.dmp

Download

memory/2660-439-0x00007FFC20FD0000-0x00007FFC20FE0000-memory.dmp

Download

memory/2660-438-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-437-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-435-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-434-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-602-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-603-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-601-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2660-604-0x00007FFC237D0000-0x00007FFC237E0000-memory.dmp

Download

memory/2928-0-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/2928-1-0x0000000000640000-0x0000000000641000-memory.dmp

Download