66015e2c15bf7de419c89fea72b93da310e832ed2bb5aabe32815a300b356a76

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 4KB
Sample261102-d5a2vaex2z
SHA256 66015e2c15bf7de419c89fea72b93da310e832ed2bb5aabe32815a300b356a76
MD5 8aadf64a4029b4881d8f186eba321e71
SHA1 0b83076b4fe3e4cc549282b103e917febfff10c2
SHA512 bc8b7f3d05e2b42a4e9418ac8654f698b0fa0a920a7a3285c0a0ab69a5c21a7014f7fb863d9efdc9f7f89542dc755da41612f8807a8bd688c371ebbe0e2da802
SSDEEP 96:eJtf7fVQfOfhccU/Cka0Ps426KTQ8wiIfZzlWg:WtfDTfhc3/u0Ps426KTQAIfZz0g
TLSH
T17C914056DAE311427513D4A41FB35B0A675AD003C00FC97D3BDE7298CF8A6D8A8E3B88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	4100	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
3344	loader.exe
2216	loader.exe
1676	loader.exe
3324	loader.exe
3820	loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 10 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3344	loader.exe
3344	loader.exe
2216	loader.exe
1676	loader.exe
3324	loader.exe
2216	loader.exe
1676	loader.exe
3324	loader.exe
3820	loader.exe
3820	loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{68136EB4-DB56-4330-B3EE-B53F95A74E1D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4628	4724	msedge.exe	89
PID 4724 wrote to memory of 2112	4724	msedge.exe	91
PID 4724 wrote to memory of 4100	4724	msedge.exe	90
PID 4724 wrote to memory of 2112	4724	msedge.exe	91
PID 4724 wrote to memory of 2112	4724	msedge.exe	91
PID 4724 wrote to memory of 5928	4724	msedge.exe	92
PID 4724 wrote to memory of 5928	4724	msedge.exe	92
PID 4724 wrote to memory of 5612	4724	msedge.exe	93
PID 4724 wrote to memory of 1812	4724	msedge.exe	94
PID 4724 wrote to memory of 5612	4724	msedge.exe	93
PID 4724 wrote to memory of 5612	4724	msedge.exe	93
PID 4724 wrote to memory of 1812	4724	msedge.exe	94
PID 4724 wrote to memory of 1812	4724	msedge.exe	94
PID 4724 wrote to memory of 3484	4724	msedge.exe	96
PID 4724 wrote to memory of 3484	4724	msedge.exe	96
PID 4724 wrote to memory of 3484	4724	msedge.exe	96
PID 4724 wrote to memory of 992	4724	msedge.exe	97
PID 4724 wrote to memory of 992	4724	msedge.exe	97
PID 4724 wrote to memory of 992	4724	msedge.exe	97
PID 4724 wrote to memory of 4576	4724	msedge.exe	99
PID 4724 wrote to memory of 4576	4724	msedge.exe	99
PID 4724 wrote to memory of 4576	4724	msedge.exe	99
PID 4724 wrote to memory of 1496	4724	msedge.exe	100
PID 4724 wrote to memory of 5992	4724	msedge.exe	101
PID 4724 wrote to memory of 1496	4724	msedge.exe	100
PID 4724 wrote to memory of 5992	4724	msedge.exe	101
PID 4724 wrote to memory of 1972	4724	msedge.exe	103
PID 4724 wrote to memory of 1836	4724	msedge.exe	106
PID 4724 wrote to memory of 1836	4724	msedge.exe	106
PID 4724 wrote to memory of 3492	4724	msedge.exe	107
PID 4724 wrote to memory of 3492	4724	msedge.exe	107
PID 4724 wrote to memory of 3492	4724	msedge.exe	107
PID 4724 wrote to memory of 2688	4724	msedge.exe	109
PID 4724 wrote to memory of 2688	4724	msedge.exe	109
PID 4724 wrote to memory of 2124	4724	msedge.exe	110
PID 4724 wrote to memory of 2124	4724	msedge.exe	110
PID 4724 wrote to memory of 2124	4724	msedge.exe	110
PID 4724 wrote to memory of 2360	4724	msedge.exe	111
PID 4724 wrote to memory of 2852	4724	msedge.exe	112
PID 4724 wrote to memory of 4308	4724	msedge.exe	113
PID 4724 wrote to memory of 4120	4724	msedge.exe	114
PID 4724 wrote to memory of 2972	4724	msedge.exe	115
PID 4724 wrote to memory of 2852	4724	msedge.exe	112
PID 4724 wrote to memory of 2852	4724	msedge.exe	112
PID 4724 wrote to memory of 4904	4724	msedge.exe	116
PID 4724 wrote to memory of 4904	4724	msedge.exe	116
PID 4724 wrote to memory of 4904	4724	msedge.exe	116
PID 4724 wrote to memory of 1592	4724	msedge.exe	117
PID 4724 wrote to memory of 1652	4724	msedge.exe	118
PID 4724 wrote to memory of 5780	4724	msedge.exe	119
PID 4724 wrote to memory of 1652	4724	msedge.exe	118
PID 4724 wrote to memory of 5780	4724	msedge.exe	119
PID 4724 wrote to memory of 3344	4724	msedge.exe	120
PID 4724 wrote to memory of 2216	4724	msedge.exe	121
PID 4724 wrote to memory of 1676	4724	msedge.exe	122
PID 4724 wrote to memory of 3324	4724	msedge.exe	123
PID 4724 wrote to memory of 3820	4724	msedge.exe	124
PID 4724 wrote to memory of 4492	4724	msedge.exe	125
PID 4724 wrote to memory of 4492	4724	msedge.exe	125
PID 4724 wrote to memory of 4672	4724	msedge.exe	127
PID 4724 wrote to memory of 4672	4724	msedge.exe	127
PID 4724 wrote to memory of 3756	4724	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff876b5c188,0x7ff876b5c194,0x7ff876b5c1a0
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,3574215370079717561,9767971381049337688,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,12783719085763701141,639630053888264281,262144 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,5730312182793008844,6285938995083529293,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17035549354687609023,16967617509501714657,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4752959042281771154,15973963356509149649,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,458510481772510037,17117018545426531645,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,13612456738018694491,15383843521523438443,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,3597409161122460847,16841638792914806946,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,10860230424243217850,13569699772635286850,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,392666471153971730,4793703841148305975,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1939802835201261921,5914170016659313469,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1939802835201261921,5914170016659313469,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,16959458371388863447,14090512345274793684,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6656,i,17626718669719997413,6351665841085642804,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,10917046355434933907,15600371434813530168,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4956,i,7535370292766317117,5744516955289073983,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,16720778633038724871,1252447967769976479,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7008,i,493419699580384221,13189721287076396374,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,15252706636529318781,1269409581627050336,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,1213737529802211728,1566384822244345146,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=164 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8907210717128688748,12087112860363379309,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3104,i,11319383816882514236,745834391423502171,2097152 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,7221425724885318792,7016880172864419063,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,2966044452964781382,5679676980746479649,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,9690219125822709535,12214506548170392770,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
  2⤵
  PID:5780
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3344
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2216
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1676
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3324
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,18096417557040285110,4646238723795443575,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,7875602397607326675,8242301150113756748,524288 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3748,i,387045627488514796,8633709377770044715,262144 --field-trial-handle=2528,i,16471729293631385266,4804530988979985028,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44a380a2-e4ed-40d7-9cba-b3178abcc387.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44a380a2-e4ed-40d7-9cba-b3178abcc387.tmp
Size 33KB
SHA256 12f046e44c024528f207ef2c9ec35ddd9ca597cd24dd218c62a6e07cf9da10e0
MD5 8a656bcfd5ab1b3b99aa3d4f8a928fdb
SHA1 25be1c9b649b64abf2ee385953109a81ec8bd03c
SHA512 2d07711000c0663096899611421c608a619d93941240fd6908387a5bf7c5187c3270d0f0ce4a8dbccdf88d748bc1d2e83d2281a999f170bfee8df56f09e5b57d
SSDEEP 768:Vf3Hhn0ybNbgwOeRFZD1fTos7RjFE75EALt:Vf3B0hY1fT/RRkDZ
TLSH
T1B5F2AF39F8D49D6B5DF2E244E2493A42BFF49163C9D9068488DD5F1E00C7AEE234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

3764efc1-a025-41cb-a111-63dfaf3437f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3764efc1-a025-41cb-a111-63dfaf3437f6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

518bd170-acc9-4357-afb5-c8cd3a9c58bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\518bd170-acc9-4357-afb5-c8cd3a9c58bc.tmp
Size 11KB
SHA256 ae7c013090cc667b1309890a4088cb8569e175040d0842608f0e1ac728acf5e5
MD5 493b33a5289c044ff145f7c3eca9b9bc
SHA1 828357b37cafec890cd44dfe0eaabe438583000e
SHA512 545d59a3f3cc5d9c24bf05381658744963bc5abce64d20bf4450ba3f4a3307321d8858879bc41d79421001a81c7aecafd34af6b9d9f26cb1a6ac79ee2b801583
SSDEEP 192:sxRH0RAbg/fRsuK7xOIzoA8p4o/g6+WNIYDotEG2IgmfJ:sxRUIg/fRsu6Mt/5Ikmh
TLSH
T13C32A715AE28A93F9CC7E31DBB55BF53D2FD5032A1911E58A6FC862C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

816f6f88-bc96-4077-90d8-fb90aef7d25c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\816f6f88-bc96-4077-90d8-fb90aef7d25c.tmp
Size 11KB
SHA256 eaba6839d3709f71ffc25711f960811eb656d78d7e51abd5a27575f34bebdef0
MD5 8f502f2c1ca58e4578cb8654a4fd66e0
SHA1 65fe9d747b72a4fc126cb990b1fa390b423ae537
SHA512 6f1858043fe479b2c7119db445a94ccc46134ea0e93c7f2e43fb3fd9c0385382476ce8ca83d03b76d80b3f6a2b54d4105fc445bf652385100ca9792a74a1ce39
SSDEEP 192:sxR20RAbg/fRsu0K7xOIzoA8p4o/g6+WNIYDotEG2IgDyfJ:sxRPIg/fRsz6Mt/5IkGh
TLSH
T15C32A715AE28A93F9CCBE31DBB55BF53D3FD5032A0911E58A6FC862C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9ec6fcb27b3e745a3eeae8b4d490823d7e8b7ff35de289cbf010ea09b1e56307
MD5 8a6a316459873700e2fb748259a8ac32
SHA1 8004f29380de098bb6c239042d36d4980b9759bb
SHA512 ce3a701011756edaa0f5a2e015bde8ec58bdc3d5612e7cc8468c7ff50266dd549f9e1a002ea8258b16badc1dbe65ee06a8f894dda27a650730a187f07d730597
TLSH
T106E026A546C9D22EA22A684F11EA870D9280373BD7C0B91E6B04C48C7103040F3866E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f3f24eb0410ab0b11443903087e1e14e2cbe1047db8fd582ef4fe46c5198788a
MD5 75486d936071fbf0975b23d5087b8043
SHA1 15e980f2401a3b2483ecb26e8012c39f908fbf20
SHA512 7729453c0cbf2b2ffbf4be5a9ae00613954914c9d0164feb82fbba2dccb3c181f9af123f3262849b8ff57c532f7697f2f12a1901e3e4279f6fe67b87a665fd2e
TLSH
T1C351848191A573A5C3E7C47189D861C737B481BDCBCF0E8F19C4FDB9974E71292080A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0f762e5cc6242acb5a006e41c5663af8acd1046886867fac404f80c9362ddcdd
MD5 58aa251c6171cdd78a6a5f96fb7ad904
SHA1 3bd328ed35bc776886a46611abf8f313589f3cbb
SHA512 334a323b82209f449b3fd0b407b163dc20181194b88ff4088a7dda63729e8edbc31534a9f90c983900be3fffe9e5f51b612dbf700d68a76c5959aac89876391e
TLSH
T19751838591A163A5C3E7C4728ADD61C737B481BDCBCF0E8F19C4FDB9974E71292080AA
MD5 SHA1 SHA512 TLSH

Submit Download

2280250c-9636-45d9-bc17-3f49566a1dbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2280250c-9636-45d9-bc17-3f49566a1dbf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

313e9bb1-5c90-4c8d-be2a-aa513a00e1d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\313e9bb1-5c90-4c8d-be2a-aa513a00e1d2.tmp
Size 2KB
SHA256 325656f1907cb35dc52609484720b19c5be4d68b16d235d66c90281ac26b6006
MD5 2eafa8f05c9ca020a800733160461f4e
SHA1 e4b65fe13214b3e05185ebc6aad583801094b34a
SHA512 afc88dc06470ed9e75f2999a8c32af59bd3ff3f196e7ca394a2720bc109ee370a4d95b80bde58cd7b5100403a296ec43577cbe821e34f3aa432fc534373e70fb
TLSH
T1A541DFF787F4866EDA1196F0AA14AF1FCE1D0915832C3C5A89D0AE2B93F3031E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

73ff91d2-5419-4adb-be38-7da4ff7563db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73ff91d2-5419-4adb-be38-7da4ff7563db.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fdcbf113-b7ad-4068-9317-269a8f191a67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fdcbf113-b7ad-4068-9317-269a8f191a67.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d9fb175e-7b14-4f20-883c-59ec39a2110e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9fb175e-7b14-4f20-883c-59ec39a2110e.tmp
Size 23KB
SHA256 e32bcb1a5ee5d9082aa2626285742ca0299692832a810b56dc1a381d3f18845b
MD5 db2a5cc1298d07e01c15660eb2109d17
SHA1 baa2dfbf73c81002b8fd1558b117af0930d56185
SHA512 9c23704d4303f4fa77f2a9019bd237ed9a8b9e6fd48f5a2fe5cc301aa687fea73a8d8fe2701a4c7541fe1e2d54784859c6af0754a8c2a3cedeede1926de47b9e
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9froTyK:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vv
TLSH
T153B2DA2B640CC77E4F804AADAC1A6F977E5802C796988D4047FE995C03C77EBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc6d37ca-5925-43da-8f63-3496e95b8e13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc6d37ca-5925-43da-8f63-3496e95b8e13.tmp
Size 12KB
SHA256 294c0d19b286883f6b36fe6802d579d27c049e7cf65bd06330ae81fbc995e70d
MD5 dd88e174681321c934073f212a6b88fd
SHA1 50265ab691bd2f6e020a760ddfecca62468f87b8
SHA512 3b8605218efd4e83a3bfa2a2d6f6942e7186150b423a7421e10deac70c724372d50ab561916cb34792b2510b63b815a3a63f01df0c0d31a9fcbf8d6874d2b4f6
SSDEEP 192:sxRsRAOg/fRsunK7xRIzoA8p4ru/g6+WNgJe/YD36bEG2IgDcOJ:sxRsRg/fRs86ZP/5x/ehQa
TLSH
T11242A715AD28A93FACCBE21DBA55BF17D7FD5032A1901E44A6FC872C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee37325d-8471-4ef6-9779-2e76910a290e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee37325d-8471-4ef6-9779-2e76910a290e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1113332-e501-4500-91e7-c133ea55b62a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1113332-e501-4500-91e7-c133ea55b62a.tmp
Size 33KB
SHA256 2b84722a1acea26c994ea225243cd782e4791278f875ef0c3f50f1241e64a8e9
MD5 b502112ec0aa7ed019cda0adcd5e723e
SHA1 1e5599c66852fc5ea606a7c96483e1ca33e5fdcf
SHA512 701c28941a88e7887e0c671952943054fab6d8f37d4d14a50c4fcaf594ebe6dce16aa62695c523f64b8ae2427034ecdf6a5ffa07687ecd4f6ce9813b89479f4b
SSDEEP 768:Gf3ah20ybNbgwOeRFZD1fTos7RjFE75EALt:Gf3YthY1fT/RRkDZ
TLSH
T12BF2AF39F8D49D6B5DF2E244F2493A42BFF49163C9D9068489DD5F1E00C7AEE234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b74a8a84-c7bd-48a0-b180-2f4ebd1d2c20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b74a8a84-c7bd-48a0-b180-2f4ebd1d2c20.tmp
Size 33KB
SHA256 57d258ea62a41efdd76f70af9e3e3f4dcfffc8e34f39e8006e51566a01e0fe8b
MD5 b0fe8767eb722041907e48506d3358ab
SHA1 0992053444ced5690d29502b01d125c06d30db38
SHA512 e171aa5f7d142010aa1e7d5115ee147673b121fb375fef8f439153f8ea89e76b6888ab5715eb66faccb905150a53b91868c3dfba32d46dddb5beb31a06bc7be6
SSDEEP 768:Gy3ahx0ybNbgwOeRFZD1fTos7RjFE75EALt:Gy3YmhY1fT/RRkDZ
TLSH
T177F2AF39F8D49D6B5DF2E244F2493A02BFF49163C9D9068489DD5F1E00C7AEE234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2aae0fb-ea14-4026-8459-8bdf5f0e12a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2aae0fb-ea14-4026-8459-8bdf5f0e12a9.tmp
Size 38KB
SHA256 38c10f5531d63f37b56ed09e73d37da7104562f7db113d6d8f3f2664d756a264
MD5 8f97a98fab62dd9ebfcb42bfbb5f01a5
SHA1 852160b36391e5161f69d52d56c610e1e5bcdf1e
SHA512 2069f38895519c71b3cc05b8be4a1978b7c6a45cf757b63f122589d6d72da239f192d0b007ff441d272146968b0fa9b419db28638d0161269a349ecd5a63d839
SSDEEP 768:4/UxvxjgC+r3Hhe0ybNbg5OeRFZD1fTos7RjFR7:FZj3+r3B1eY1fT/RRR7
TLSH
T19103BF39B8986C279CF2F244B24A3B47BFF4456389C91A9849EC1F1F0597BAD1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6249de5-c151-49d7-a3bd-9d326f39ac7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6249de5-c151-49d7-a3bd-9d326f39ac7c.tmp
Size 38KB
SHA256 e985dbee6b048f6c029d89b73f3f05eee91d4c9e13bfc7f1c0c3609545a0225c
MD5 55c19a4175f9ab987be035935cff3f14
SHA1 3f29759f8e6a93d424f39711ea4ce2af4bde6169
SHA512 75f469f404a6961e86e7c2ad020355cbf9debbeb9739724f44cbf609a25dda364e9fd641515e2d0bb9a698b2a87ae5029681f5b5d1d7b45e5676f8636bd44ba1
SSDEEP 768:e/UxvxjgC+k3cE6ybNbgXOeRFZD1fTos7RCF/+Pu:TZj3+k3cNwY1fT/RSKu
TLSH
T12E03BF39F8D86C379CF2E244B24A774BBFF455A389C91A9409ED2F1E058B7AD130741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd7bd211-1d03-401d-a964-9b302b6cfc4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd7bd211-1d03-401d-a964-9b302b6cfc4d.tmp
Size 37KB
SHA256 d3eda93b1efdde6c86d443f26a9a8f0da75150e245e501b06cf9c3615ff4ed1c
MD5 665406aecb9b70f4af427dfa86f1eaec
SHA1 121412a97b1e897e640987bd6a93acd56b677fdd
SHA512 79ed35f3d358e5215c32a1139938a5d83f1331a587d22cfe00cd05e852e057ec72fdb6ee8da8eeeb1f089c6f83627d60ccd7b7b2da9de837b497c003a7c74329
SSDEEP 768:z/UxvxjgC+k3vZoybNbOOeRFZD1fTos7Rzq/+Pu:GZj3+k3veqY1fT/R+Ku
TLSH
T18A03BF39F8D46C378CF6E244B20A764BBFF455B395C91A9809EC2F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee10fb59-c62d-48fe-85c3-72e034016c46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee10fb59-c62d-48fe-85c3-72e034016c46.tmp
Size 36KB
SHA256 cd23cf4bc4406ca4b52133386468c5b450ae3454e36b611052f56d6aa14fcbf7
MD5 7d45e64ff17145980c4a4acb78769472
SHA1 ee4267f5981aca4d166f1eef85f2b1f6ad06437d
SHA512 4f593b50150d3e3e67940955d4e733067fc167788371bb2ece8b33017dbe4c63393ef363dd84b3b4064e11acf36154c723524d79e09cfec05bae6743125f059d
SSDEEP 768:iFdh3xwgchX0ybNbgvOeRFZD1fTos7RjFE75EALt:yh3yEYY1fT/RRkDZ
TLSH
T1D7F2AF36ECC49D7B9DF2E744F2093A02BFF481A3C99956949ADC5E1E00876DD2387C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1bc51d8-919c-4b32-91ab-cbf4d9c3a714.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1bc51d8-919c-4b32-91ab-cbf4d9c3a714.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f188971f-8b01-4938-a0ed-6c35af4249ca.tmp

Path C:\Users\Admin\Downloads\f188971f-8b01-4938-a0ed-6c35af4249ca.tmp
Size 14KB
SHA256 e21f0e9df94881955ad57ffa36e7fb2e655e32eed6949f55d53482e60d708cad
MD5 e8d39d9a45c17ac29a627742617bb42e
SHA1 cea025ded599eecce3b6a93a8d0970ebdb250217
SHA512 bb36b0f15b7e714ce3ab128e1417e4379318c063d523f9cfd7fabf2f8ea66c3a4c5c0009631726f789f4f92e64627652d2ca5f1a8232b9c041fa835f1627189c
SSDEEP 192:ei8NM+0UR57MOshNG06bYDQE9hW6sUoG8rOUiiq7bv5fQk7cuUwz4NJBPtp8HYqW:c30URtHWf6JUl8ihiC9fd7YLxL84qW
TLSH
T1D9629EA878D242BDD82D8830DA431EFAF0B1786F5DF687137F9981036A7195BD9D1CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader (1).exe.crdownload

Path C:\Users\Admin\Downloads\loader (1).exe.crdownload
Size 18.6MB
SHA256 839e180381f0492fbd868eb7fb0bf7a7619b2c83ef0bcb5c3d776444236f512c
MD5 329b11bebcb3e20a00a2976fb0136894
SHA1 471a0af10cc19ce5b7ccea09b44f151c9bbbdbc4
SHA512 60537d6410687bfffdc4725dfc948150036da54ad2d1b5cf10458a7f540115920ba1d446a94caa76fb5a199729e3821e37330930b798cb908759502cb22f0caa
SSDEEP 393216:S6vSXgvSNYQe/r3QGYWYt6bUXXEBKoYv7:7giSNZ0sGA6b+0BAz
TLSH
T16E1701F5548D01A9CB578630D2683AFDE0BB784DCC75682A7BCB087119B9D42C8F692F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe.crdownload

Path C:\Users\Admin\Downloads\loader.exe.crdownload
Size 18.6MB
SHA256 839e180381f0492fbd868eb7fb0bf7a7619b2c83ef0bcb5c3d776444236f512c
MD5 329b11bebcb3e20a00a2976fb0136894
SHA1 471a0af10cc19ce5b7ccea09b44f151c9bbbdbc4
SHA512 60537d6410687bfffdc4725dfc948150036da54ad2d1b5cf10458a7f540115920ba1d446a94caa76fb5a199729e3821e37330930b798cb908759502cb22f0caa
SSDEEP 393216:S6vSXgvSNYQe/r3QGYWYt6bUXXEBKoYv7:7giSNZ0sGA6b+0BAz
TLSH
T16E1701F5548D01A9CB578630D2683AFDE0BB784DCC75682A7BCB087119B9D42C8F692F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download