satana | b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c

Analysis

user interaction
yes
max time kernel
72s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
06/11/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unpacked.exe
Size 72KB
Sample261106-ehhzlsgw4v
SHA256 b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
MD5 108756f41d114eb93e136ba2feb838d0
SHA1 8c6b51923ee7da2f4642c7717db95fbb77d96164
SHA512 d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
SSDEEP 768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
TLSH
T124738D29ED458132EB7001F61DFA9F69AC1EA6B84F275CE362CDA8C12D290D3F970143
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery satana persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!satana!.txt

Ransom Note

You had bad luck.There was crypting of all your files in a FS bootkit virus <!SATANA!> To decrypt you need send on this E-mail: [email protected] your private code: A935C94A6A5A69B06EF0DBD7E4A091F2 and pay on a Bitcoin Wallet: XsrR2he2Z8un5ysGWnJ1wveZRPRS96XEoX total 0,5 btc After that during 1 - 2 days the software will be sent to you - decryptor - and the necessary instructions. All changes in hardware configurations of your computer can make the decryption of your files absolutely impossible! Decryption of your files is possible only on your PC! Recovery is possible during 7 days, after which the program - decryptor - can not ask for the necessary signature from a public certificate server. Please contact via e-mail, which you can find as yet in the form of a text document in a folder with encrypted files, as well as in the name of all encrypted files.If you do not appreciate your files we recommend you format all your disks and reinstall the system. Read carefully this warning as it is no longer able to see at startup of the computer. We remind once again- it is all serious! Do not touch the configuration of your computer! E-mail: [email protected] - this is our mail CODE: A935C94A6A5A69B06EF0DBD7E4A091F2 this is code; you must send BTC: XsrR2he2Z8un5ysGWnJ1wveZRPRS96XEoX here need to pay 0,5 bitcoins How to pay on the Bitcoin wallet you can easily find on the Internet. Enter your unlock code, obtained by E-mail here and press "ENTER" to continue the normal download on your computer. Good luck! May God help you! <!SATANA!>

Emails

[email protected]

Signatures

Family: Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
ransomware satana

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5272	pame.exe

Executes dropped EXE 1 IoCs

pid	Process
5272	pame.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\cifwef = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt"	unpacked.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	pame.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4888_684038218\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_380808544\_locales\uk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pame.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pame.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	unpacked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	unpacked.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unpacked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pame.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{6304C4B5-5682-4376-9567-797275A9A88E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5272	pame.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 5272	4196	unpacked.exe	89
PID 4888 wrote to memory of 5632	4888	msedge.exe	96
PID 4888 wrote to memory of 604	4888	msedge.exe	97
PID 4888 wrote to memory of 2836	4888	msedge.exe	98
PID 4888 wrote to memory of 2836	4888	msedge.exe	98
PID 4888 wrote to memory of 2836	4888	msedge.exe	98
PID 4888 wrote to memory of 4692	4888	msedge.exe	99
PID 4888 wrote to memory of 4692	4888	msedge.exe	99
PID 4888 wrote to memory of 5756	4888	msedge.exe	101
PID 4888 wrote to memory of 5756	4888	msedge.exe	101
PID 4888 wrote to memory of 5756	4888	msedge.exe	101
PID 4888 wrote to memory of 1008	4888	msedge.exe	102
PID 4888 wrote to memory of 1008	4888	msedge.exe	102
PID 4888 wrote to memory of 1008	4888	msedge.exe	102
PID 4888 wrote to memory of 2432	4888	msedge.exe	104
PID 4888 wrote to memory of 3452	4888	msedge.exe	103
PID 4888 wrote to memory of 2432	4888	msedge.exe	104
PID 4888 wrote to memory of 2432	4888	msedge.exe	104
PID 4888 wrote to memory of 3452	4888	msedge.exe	103
PID 4888 wrote to memory of 3452	4888	msedge.exe	103
PID 4888 wrote to memory of 2124	4888	msedge.exe	105
PID 4888 wrote to memory of 2124	4888	msedge.exe	105
PID 4888 wrote to memory of 6140	4888	msedge.exe	107
PID 4888 wrote to memory of 4512	4888	msedge.exe	108
PID 4888 wrote to memory of 6140	4888	msedge.exe	107
PID 4888 wrote to memory of 4512	4888	msedge.exe	108
PID 4888 wrote to memory of 5444	4888	msedge.exe	109
PID 4888 wrote to memory of 5444	4888	msedge.exe	109
PID 4888 wrote to memory of 1176	4888	msedge.exe	110
PID 4888 wrote to memory of 1176	4888	msedge.exe	110
PID 4888 wrote to memory of 1176	4888	msedge.exe	110
PID 4888 wrote to memory of 2512	4888	msedge.exe	112
PID 4888 wrote to memory of 3064	4888	msedge.exe	113
PID 4888 wrote to memory of 2512	4888	msedge.exe	112
PID 4888 wrote to memory of 2512	4888	msedge.exe	112
PID 4888 wrote to memory of 1164	4888	msedge.exe	114
PID 4888 wrote to memory of 1164	4888	msedge.exe	114
PID 4888 wrote to memory of 1164	4888	msedge.exe	114
PID 4888 wrote to memory of 4316	4888	msedge.exe	115
PID 4888 wrote to memory of 4316	4888	msedge.exe	115
PID 4888 wrote to memory of 4140	4888	msedge.exe	119
PID 4888 wrote to memory of 4140	4888	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\unpacked.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\pame.exe
  "C:\Users\Admin\AppData\Local\Temp\pame.exe" {12028028-ae84-11f1-912c-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\unpacked.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5272

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\!satana!.txt
1⤵
PID:4116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:3472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7fff1761c188,0x7fff1761c194,0x7fff1761c1a0
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,9721267852030429811,6046372748657581171,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:11
  2⤵
  - System Time Discovery
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,6956751059725604567,6238031008144257902,262144 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16198095918778595714,13266251695751042502,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,12493445538101936004,10205447400653523021,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9851406625092849063,12649006566845527792,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,10358052552740642170,8115696689601028996,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12593805485525338897,3596925872694263990,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,14595124473572055514,7508819951034824338,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17881360009030661787,8185640036546281634,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,11826282332680972454,7463467917799169828,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,10352489153633022984,14909641241751224256,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6048,i,15588719734205747099,18367021673563732539,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1768119055234236498,15704393668924627741,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5048,i,1579676461143674328,10990905486180559088,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1768119055234236498,15704393668924627741,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6852,i,21481686247209401,2150568265199878316,2097152 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,5048220118488020485,13512166490184176358,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,13043063704068992090,8858249333745770430,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,8290563717305754837,6597530309895075448,524288 --field-trial-handle=2816,i,9683526228888075169,9487906828130851699,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49a03381-8c3e-4214-b095-0e4e32a4516d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49a03381-8c3e-4214-b095-0e4e32a4516d.tmp
Size 38KB
SHA256 2fd90adb1fe73ed65c72f7676a55b062a1a8eac618232cb882b547331006f1fa
MD5 02853499bb23556e39b368f65f4b0d94
SHA1 6232d38dd7d4b95c8890618ce1c11191265ab3f0
SHA512 154dd6a662281eb6f384352b16eb30b739f182f82d588c4489dd3cc13dd6e94ebf1080fc5e740b1f45fd92928f1261120b56f6d147d7e93ac743ce12eb9a2bdf
SSDEEP 768:vh/UxvxjgC+5j3qVJL8CieOZejFnUPO4Qp7cPAiSm2eo4w4cciGrTFIbAgZbCM3s:v0Zj3+5j3qnL1cejFwQpYoimeoR4ccFT
TLSH
T14E03BF7498A9BE739CF2A741365E6386FFF011A398C22E94CAE95F0D01477AD170BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56994bbe-2eac-4e89-be2f-e822fa55d0d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56994bbe-2eac-4e89-be2f-e822fa55d0d7.tmp
Size 37KB
SHA256 2e2b9fcd99b7f697907338b16447993aaacce07d437736b64e6d124f5ad5e5a4
MD5 e8b388459e8c9749e809f99179520ec2
SHA1 74b102579eda8b078fdb8a460f864592b9c3577a
SHA512 a77e931d73a55a6be307fb44f508054c32e2f420c9157cd8a60fd0c2c4b1add2778710fd4e02d917263389d7d600d48140b7f4edd8006042a901896bc096dd33
SSDEEP 768:vw/UxvxjgC+5j3uVLc8KieOZ0jFnUPO4Qp7cPAiSm2eo4w4cciGrTF5HAgZbCM3s:vdZj3+5j3udcVc0jFwQpYoimeoR4ccFa
TLSH
T14203BF75A8A47A779CF397853A1D6346FFF041A395C12A98CAE91F0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88761bd0-5935-4568-bffc-ebbde7f07292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88761bd0-5935-4568-bffc-ebbde7f07292.tmp
Size 39KB
SHA256 4859842c18a9c094d9ffe382b49d48cdd546308b177c015cd84215a65d4089f4
MD5 0b96a178f4423131cfb2f44b53a83816
SHA1 8c3e101268bcbef09d268ed9a7104ed621c91f02
SHA512 6b1d43171a210a8c63848312e0b1fe6156c402e8197fa119dc1d186399e87b0a33e9244e6c609866c46c6eed7ac17b426c064edfdd2d7016c342d7d272785b3c
SSDEEP 768:3E/UxvxjgC+b3oNy4ieOZe6nUPO4Qp7cPAiSm2eo4w4cciGrTFlbNIMH:3xZj3+b3O9ce6wQpYoimeoR4ccFFh6MH
TLSH
T1CD03CF74A8A9BD239CF7A744365E6786FFF015A358C11E98CAD94F0D02473AD071BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

279a3b51-e0d5-4c9f-ad90-6edcc1e1ba14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\279a3b51-e0d5-4c9f-ad90-6edcc1e1ba14.tmp
Size 27KB
SHA256 bab71adcb888b9611494ffc227e2b3fd4ffa635182fc6cbef385f4fdc647517f
MD5 d2c1087cb5e3b363a05e2ce68e035262
SHA1 c2eb424a4fcebc661e86e87717f921e9dda67d9b
SHA512 f24bea4194d8990a9549709ab7a85aab9900d9af0221bc9fad500fcfa0d7354393b36163a287c38b9e1bbbdfb6e7c3043f6a2c858915b5d2abbb1b80b4bd8588
SSDEEP 768:DFak244yG7pLIL1s5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OV597gAroM60:DFak244ym21s5Wg1Bf9tu1jaexgLM60
TLSH
T17AC2DB7B744CCB7E4F804A9D9C197E9B6DA802CB9698CD8047FE941C03C6BEE52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37b107e7-4144-4421-87ae-13d54e91012f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37b107e7-4144-4421-87ae-13d54e91012f.tmp
Size 15KB
SHA256 0f646c62e213396f553bd1b0126df9b91d1b9ce957ca9c9f12d24970437a13b7
MD5 e67e00575446c66479f26ea0cae7a3fb
SHA1 22455bbe0f4936228e442eb49bdce8937b2f7f18
SHA512 bab1fbff0a8160456204f1ca2f9203d446e8431505e134493e6cb19165a271e584d4fa9b08861221cc79ece6b3c2ba2e2c9c7377b097f339e326a869434d1d3c
SSDEEP 192:sxR4mCp/fexVs/pYO9uRuY+N2oA8pJoF/g6+WN/KS00sz/zJFVIlR5VEzdXtiTnb:sxR4Bp/fevs/pPu+Da/5I7/DVJ9iTi3k
TLSH
T13A62DA56A924A97B5CDBC619BA25BF13D3F8113298911F4CEAFDC91C04FB6ED2103807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4321f1ae-ebbd-45bc-8a2d-6026854d5950.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4321f1ae-ebbd-45bc-8a2d-6026854d5950.tmp
Size 15KB
SHA256 c8cd2e44e91d1bfab8c89f3e01afb1f01685ac0e3df52fa257399cb28d39d5e8
MD5 948885145e752bd5e5c98f4dbdb9c6d3
SHA1 8631057305f6793045e3501de9b0aafa3d67ed2f
SHA512 29b7593ad4eaa0577cdc1708eb70468fc9cb5611dc30c5c6c6d1bd143f95fa694166bd5457ce2e6259f7416548f05bc98e6fec6e893006c77edc4bdb245bee54
SSDEEP 384:sxRMBp/fevshpmd+DC/5I/XDV79iTi3Yk:s4Bp/fe+i/5eDh9iT1k
TLSH
T10A72EA56A924A97B5CDBD719BA25BF17D3F8003294911F8CE6FDCA1C00FA6ED210380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e39482-467c-4cf7-b2d5-e2d6f7be2014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97e39482-467c-4cf7-b2d5-e2d6f7be2014.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 24KB
SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
MD5 85cec2f36640165630285fcfde07831a
SHA1 680a959b7128688ec8201e5af72ab129474f7b4d
SHA512 74167696ce9516f43be0bc2a75524910e3193ae47ff75ffc339c33eb68594c09873099966a22701ec66978b5e7cfc372e257065387c0619860acfaab0da53170
SSDEEP 768:n/FWnQ1G+lImP9UJSz5TeKFMI6Nc+n820:qQ13IuSJSzFeKtU820
TLSH
T1F0B2E1346D581B27F1D251B57AE48EE8E1A31A05B4521E653F8E02002EC13EFE2E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 102KB
SHA256 b3872b22bbd31a251930d167d0a58d2e7caa8f81e6d9dcd636b01ac4f2ac8982
MD5 226c9c614d3cb21262ce545da7f7fdd5
SHA1 b9d89307d468aa84d23a67b94549e02a657c379c
SHA512 e6dc257f0a0ac0c9c33836729d79300bd6290edb6cef9864240aa6c7aa468e48b2be1aac0dfb466b21df5515689f125cd06516a50966292d3ea03226de771cba
SSDEEP 3072:67SvKCy+OUdKhsh2Yx/A5g/cEaqUBgCkRd:SSvKoO8KhepiEyZ6Rd
TLSH
T12AA31298BD47B9EE2402744D30211265B207D92F1DBC05F24EF790D61AA9956EAFFC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 253KB
SHA256 8fc14843e944aaf597aa320606ee360a375b3138097219767c72d891f5275d23
MD5 fe674fc250452db098b07d9745c4a48c
SHA1 97acd191930092d513b823d38bf6a96eaf1376ed
SHA512 d03c9270a64009f94101bb3814b66c28b55938bd222ba984ae1b62177736fa45ba67c71243f260fd5c5bc24d3ef05f7016f1666aa72cbdadef5c63d5e0e2224d
SSDEEP 6144:TIc5zekHPq/TMaaX3Jqed5WyXpD3A5npBTBSjC9GI:Tfdq/TuHB7d3A5pBTB8kGI
TLSH
T17F44227F0E4A52307D5646703237D5C3A32F9EAE56C17894C69C6BE8E863F91CA0DA08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 16KB
SHA256 b4e56c7dc88878968d4583f86276c0fc4414b65e7ddb06f04e9cce66d008d33a
MD5 42efaa5a1430874abb5bacb64d377871
SHA1 899ce66de8ab7934835bd88593a0ff9a5905bfeb
SHA512 086a94192163b3bd3864be68859b934dbb05223491a88a322222e317144bcf2f7f215dfb8f8498227a2b53526c709655cf1f0553a7227aeca70cf2a039fca009
SSDEEP 384:N5bQTsXQI5KUAJerquGkiaK0JiKFYEUm54DJ9P3Zgl8:rbLXQXU8erYkiEJiKCrmCPpi8
TLSH
T19972D1FB1F35CE24BD338125601BBEBCB058398B944AA49B7BC20195E7532126E97771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 36KB
SHA256 12fa5b74ed20692b987561a0f7238d9a427c93587ae8bed2027d0feb31111e97
MD5 69099d20c0dc15dbacf6441db4afb876
SHA1 085a9a1474327c35d39231f610da0d78453b4c17
SHA512 6f475d8446f872db4ee900acdd04091ffbb1cdfaff8b7c15dcae45834a7406f180a5f35372346f523acb19cd3a6d89fd0bbb6012b300f92bcab0f1f06343d780
SSDEEP 768:OBG3b7dgaXBz9JtiI/SAzH5vPHCQVOzxpFAMEOOlX8Ju7v4zfO90EItlc:5aYzRSAzlPHqFW35WkiGLI0
TLSH
T110F2F1416F685C0A9357BD198B3E9AA2FE4D0094CAFF11326F609378FDF80452826C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 40KB
SHA256 0e816113b559bd68f44aec6132a96c272232d85dd7f6f8894fd031912bebbdfa
MD5 c9c05738ba8134a9f981133da69d5998
SHA1 d5e87d399d56e15d993da456360e15d9a6c061a1
SHA512 936d2d2099e941877518731d5d646ba6b3137f8e3707aa25f6c31e32cf67e38d95b9e9931802b4c0ea8bed504b97b7a2a962f100ba8c4376a4afb40784f2c0a6
SSDEEP 768:ohhnd+fnNS27k+/YYvTkAF5w6b3Y+ip90OC8CChFYmgl1FXHUiBX:whnAfNS2Y+d5F5bIlvpvF9o1F3bx
TLSH
T1E61302231E07E09D6344B9F0672C0618E1C25A8A41E4BBFCDFA097AF6B260677C5756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 347KB
SHA256 55a802124f008d2b631ff8977054930aad825cb251d3b036549216bb526f8489
MD5 0281f1670b831263670bd79eca878588
SHA1 55d9c22e17db5ebc7de11ed7b1d9d3fc6f8bedd7
SHA512 693515b304e0c487c7fa1b9c4e66b205c12423bbd09dcda9dace08f55bb774c32d0d13e731901414773e66a1dec0167a4be93bd80eba5c03669f8bec83217f35
SSDEEP 6144:lydQII9pOs9yUxtm8wdzKNt6tpTqH9qQSemZEQySrLOgSaKOywu5:cI92Uxad+XHlSemwOOg3u5
TLSH
T1477423E4793A842280F8D4E72E3927933050623578FF8BA156D8631ED2AD30D5796F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

421361a7-4373-4634-ba37-d5f844387232.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\421361a7-4373-4634-ba37-d5f844387232.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

28eb5035-ac37-4bbd-a5a5-6753f964904a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\28eb5035-ac37-4bbd-a5a5-6753f964904a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

71038b5a-c089-4ff5-8c5f-8fc8c76e2214.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\71038b5a-c089-4ff5-8c5f-8fc8c76e2214.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d6652055-25cc-4e98-babe-b96a2482355c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6652055-25cc-4e98-babe-b96a2482355c.tmp
Size 210B
SHA256 1787177b28d9d17621e0fcf5bd006ec5ef698b51742e9c1401a0171a2309e003
MD5 a3da239a8fd5275493d3b73c00abab63
SHA1 a6161f017502d5dac99aa2e615b5eda3f71ded91
SHA512 12778580a248313e6237b63a36e17d5bf3318b5c2a6b9359c80d69ddb0f95c496dd55d4056094824b017e1c7cafa37feeee7ee2f67d58f27d067b0a3f645bfdf
TLSH
T1A5D0235365017175925975645035BC4ED76110285C13E5D8149095487975D6D050F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 f5471993ac78008009981743be56e620303d25cd478375e71fecf31c659b5c31
MD5 d0d13a54e6e9e78adf3474dd84ca468f
SHA1 da60f857114fff93e766b789c7d843d17c01504a
SHA512 2bbf1257ffd4a11ab08dbd005df96d2cdf013124978af15eb694a21f161746e487f2a4ab5d3656d86d64787d5ab531f6854c8ba17bff9ea2f1ee9f906049f750
TLSH
T16FF027FA2EF72920EE2B53E6A47000950451BC2DC904BE8FA066B68760B26556519C72
MD5 SHA1 SHA512 TLSH

Submit Download

a76a0eb9-56fd-4b19-96b2-f28cb98104e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a76a0eb9-56fd-4b19-96b2-f28cb98104e4.tmp
Size 34KB
SHA256 e7df73fd92b52c3c5f2691c67ddc88f8c774c0b4d02d452eb1118f5ec2a288a2
MD5 8a4d66d0513282c8540abff9ed4f6a0c
SHA1 c794a06a72849f19cfc3235ff924f0982aaf5860
SHA512 b1be2dc1ca9e64785e7e07a9e453721844ea6b9399f06d72c6d43bfa0d41ad1f67d8b60cebdab0b459d0d2734af6529896cf5d35ef53fac3f2f47fb870555f44
SSDEEP 768:3JX3oNO4ieOZeRInUPO4Qp7cPAiSm2eo4w4cciGrTFlbNaaFBtbLp:3JX3O5ceOwQpYoimeoR4ccFFhNNd
TLSH
T120F2BE70A8A5AE634CF3974176297782FFF09293D8C51E84DADA9B0C01433AE275BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff54fd53-d7a7-481b-8420-85e8567e6370.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ff54fd53-d7a7-481b-8420-85e8567e6370.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

!satana!.txt

Path C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Size 1KB
SHA256 5ccf110074e50c1148aa49e16f4c6be1dac3db6d393b3797f670d93fdade280d
MD5 3dab92f8fbdf8ebdded272d6b4399419
SHA1 eb2ef9a180889bc148e6629977b1df5daf3fa398
SHA512 63dc8aaa0786ef5df19aea213af39a3e4d0b5b009a763fe024105eeeaa87befc88dd5568788c620e453e4c5cb48687b68b89853c735b6ddaec2a1c590506ef54
TLSH
T1E031585F79980620471213A37BFDD693BB2E1054C52306613C6FC128337BAB54AB35ED
MD5 SHA1 SHA512 TLSH

Submit Download

61ae6e65-5501-48c0-95e0-0780ba294bd2.tmp

Path C:\Users\Admin\AppData\Local\Temp\61ae6e65-5501-48c0-95e0-0780ba294bd2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

848ef291-010f-4124-aa36-ee74c179b83d.tmp

Path C:\Users\Admin\AppData\Local\Temp\848ef291-010f-4124-aa36-ee74c179b83d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pame.exe

Path C:\Users\Admin\AppData\Local\Temp\pame.exe
Size 72KB
SHA256 b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
MD5 108756f41d114eb93e136ba2feb838d0
SHA1 8c6b51923ee7da2f4642c7717db95fbb77d96164
SHA512 d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
SSDEEP 768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
TLSH
T124738D29ED458132EB7001F61DFA9F69AC1EA6B84F275CE362CDA8C12D290D3F970143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1913003617\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1936926452\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads