hxxps://mega[.]nz/file/PiYFFJSA#hrYaO-Ao2gfT_oQJfKq5MmilbWw4wiwwjds89UBA_eE

Analysis

user interaction
yes
max time kernel
23s
max time network
36s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/11/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/PiYFFJSA#hrYaO-Ao2gfT_oQJfKq5MmilbWw4wiwwjds89UBA_eE
Sample261114-repdfaew2j

Score

8^/10

defense_evasion discovery execution exploit persistence ransomware

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
6096	takeown.exe
5824	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
1920	linou free.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6096	takeown.exe
5824	icacls.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5588	cmd.exe
6092	cmd.exe
5744	cmd.exe
5404	cmd.exe
5740	cmd.exe
5812	cmd.exe
5360	cmd.exe
5840	cmd.exe
2480	cmd.exe
5400	cmd.exe
5512	cmd.exe
1072	cmd.exe
5496	cmd.exe
5664	cmd.exe
6016	cmd.exe
5432	cmd.exe
5548	cmd.exe
5408	cmd.exe
5452	cmd.exe
6136	cmd.exe
2540	cmd.exe
3892	cmd.exe
1864	cmd.exe
5492	cmd.exe
5528	cmd.exe
5752	cmd.exe
3640	cmd.exe
5324	cmd.exe
5364	cmd.exe
5884	cmd.exe
5928	cmd.exe
5628	cmd.exe
5692	cmd.exe
5508	cmd.exe
5552	cmd.exe
5708	cmd.exe
5796	cmd.exe
5972	cmd.exe
5468	cmd.exe
5776	cmd.exe
5248	cmd.exe
5320	cmd.exe
6140	cmd.exe
5544	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5812	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1672	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
5468	taskkill.exe
3676	taskkill.exe
5192	taskkill.exe
5584	taskkill.exe
5312	taskkill.exe
5420	taskkill.exe
5768	taskkill.exe
5516	taskkill.exe
5560	taskkill.exe
5604	taskkill.exe
5856	taskkill.exe
5944	taskkill.exe
5988	taskkill.exe
404	taskkill.exe
5612	taskkill.exe
1656	taskkill.exe
3544	taskkill.exe
5412	taskkill.exe
5456	taskkill.exe
5760	taskkill.exe
5240	taskkill.exe
5704	taskkill.exe
5376	taskkill.exe
5680	taskkill.exe
5000	taskkill.exe
5680	taskkill.exe
5720	taskkill.exe
5192	taskkill.exe
5372	taskkill.exe
5644	taskkill.exe
5580	taskkill.exe
5900	taskkill.exe
6064	taskkill.exe
6108	taskkill.exe
1212	taskkill.exe
5424	taskkill.exe
5724	taskkill.exe
5812	taskkill.exe
780	taskkill.exe
5368	taskkill.exe
5660	taskkill.exe
5736	taskkill.exe
3464	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3202520547-175870679-441661622-1000\{31AAFCB8-4DF9-40AC-AF1A-10CD4994B438}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	5424	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1920	linou free.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2948	3024	msedge.exe	83
PID 3024 wrote to memory of 1672	3024	msedge.exe	84
PID 3024 wrote to memory of 4980	3024	msedge.exe	85
PID 3024 wrote to memory of 4980	3024	msedge.exe	85
PID 3024 wrote to memory of 4980	3024	msedge.exe	85
PID 3024 wrote to memory of 1240	3024	msedge.exe	86
PID 3024 wrote to memory of 1240	3024	msedge.exe	86
PID 3024 wrote to memory of 3788	3024	msedge.exe	88
PID 3024 wrote to memory of 3788	3024	msedge.exe	88
PID 3024 wrote to memory of 3700	3024	msedge.exe	89
PID 3024 wrote to memory of 3788	3024	msedge.exe	88
PID 3024 wrote to memory of 3700	3024	msedge.exe	89
PID 3024 wrote to memory of 3700	3024	msedge.exe	89
PID 3024 wrote to memory of 2668	3024	msedge.exe	90
PID 3024 wrote to memory of 3796	3024	msedge.exe	91
PID 3024 wrote to memory of 2668	3024	msedge.exe	90
PID 3024 wrote to memory of 2668	3024	msedge.exe	90
PID 3024 wrote to memory of 3796	3024	msedge.exe	91
PID 3024 wrote to memory of 3796	3024	msedge.exe	91
PID 3024 wrote to memory of 1764	3024	msedge.exe	96
PID 3024 wrote to memory of 1484	3024	msedge.exe	97
PID 3024 wrote to memory of 1764	3024	msedge.exe	96
PID 3024 wrote to memory of 1484	3024	msedge.exe	97
PID 3024 wrote to memory of 1800	3024	msedge.exe	98
PID 3024 wrote to memory of 1800	3024	msedge.exe	98
PID 3024 wrote to memory of 896	3024	msedge.exe	102
PID 3024 wrote to memory of 4312	3024	msedge.exe	105
PID 3024 wrote to memory of 4312	3024	msedge.exe	105
PID 3024 wrote to memory of 5108	3024	msedge.exe	108
PID 3024 wrote to memory of 5108	3024	msedge.exe	108
PID 3024 wrote to memory of 4428	3024	msedge.exe	109
PID 3024 wrote to memory of 4428	3024	msedge.exe	109
PID 3024 wrote to memory of 4428	3024	msedge.exe	109
PID 3024 wrote to memory of 2552	3024	msedge.exe	110
PID 3024 wrote to memory of 1920	3024	msedge.exe	111
PID 1920 wrote to memory of 5360	1920	linou free.exe	115
PID 5360 wrote to memory of 5376	5360	cmd.exe	116
PID 1920 wrote to memory of 5408	1920	linou free.exe	117
PID 5408 wrote to memory of 5424	5408	cmd.exe	118
PID 1920 wrote to memory of 5452	1920	linou free.exe	119
PID 5452 wrote to memory of 5468	5452	cmd.exe	165
PID 1920 wrote to memory of 5496	1920	linou free.exe	121
PID 5496 wrote to memory of 5516	5496	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6052	attrib.exe
6020	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/PiYFFJSA#hrYaO-Ao2gfT_oQJfKq5MmilbWw4wiwwjds89UBA_eE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffdbf77c188,0x7ffdbf77c194,0x7ffdbf77c1a0
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,9047558508345276600,17181081257218536613,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,18133170828612730667,6954227483584614249,262144 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,6554613494431825814,10629456962047273541,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,4198797317845888934,10677960743610489934,2097152 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,1324031155418494673,9823564558623731832,2097152 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,18031103556587343974,14220088916793336170,2097152 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4341353062582544194,9177618391027051992,2097152 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17026071636992421865,6228121800109570837,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,16791136476716446302,4283164376459514594,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,11012771991150536431,7677469732013124566,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,12674325855902099007,12150974523937561390,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,12674325855902099007,12150974523937561390,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,6155337589372302566,6060279591138377166,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,4238042357113946337,2743848371283415613,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6676,i,10865215854003594363,15018782528939333524,2097152 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12594058054464789724,8897247624116340774,524288 --field-trial-handle=2304,i,10569789697533064944,12384196830415295745,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:2552
- C:\Users\Admin\Downloads\linou free.exe
  "C:\Users\Admin\Downloads\linou free.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im gameoverlayui.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RadeonSoftware.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AMDRSServ.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im amdow.exe /t
      4⤵
      Kills process with taskkill
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AMDRSSrcExt.exe /t
      4⤵
      Kills process with taskkill
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5588
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GamePanel.exe /t
      4⤵
      Kills process with taskkill
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im bcastdvr.exe /t
      4⤵
      Kills process with taskkill
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GameBarFTServer.exe /t
      4⤵
      Kills process with taskkill
      PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RTSS.exe /t
      4⤵
      Kills process with taskkill
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MSIAfterburner.exe /t
      4⤵
      Kills process with taskkill
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Medal.exe /t
      4⤵
      Kills process with taskkill
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MedalEncoder.exe /t
      4⤵
      Kills process with taskkill
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MServer.exe /t
      4⤵
      Kills process with taskkill
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im squirrel.exe /t
      4⤵
      Kills process with taskkill
      PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im elevate.exe /t
      4⤵
      Kills process with taskkill
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im crashpad_handler.exe /t
      4⤵
      Kills process with taskkill
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im inject-helper32.exe /t
      4⤵
      Kills process with taskkill
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im inject-helper64.exe /t
      4⤵
      Kills process with taskkill
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ffmpeg.exe /t
      4⤵
      Kills process with taskkill
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2540
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ffprobe.exe /t
      4⤵
      Kills process with taskkill
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mp4info.exe /t
      4⤵
      Kills process with taskkill
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ThumbnailGenerator.exe /t
      4⤵
      Kills process with taskkill
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ICYMICreator.exe /t
      4⤵
      Kills process with taskkill
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Overwolf.exe /t
      4⤵
      Kills process with taskkill
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfLauncher.exe /t
      4⤵
      Kills process with taskkill
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfBrowser.exe /t
      4⤵
      Kills process with taskkill
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfHelper.exe /t
      4⤵
      Kills process with taskkill
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfHelper64.exe /t
      4⤵
      Kills process with taskkill
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ow-obs.exe /t
      4⤵
      Kills process with taskkill
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ow-overlay.exe /t
      4⤵
      Kills process with taskkill
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfUpdater.exe /t
      4⤵
      Kills process with taskkill
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfCrashHandler.exe /t
      4⤵
      Kills process with taskkill
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfBenchmarking.exe /t
      4⤵
      Kills process with taskkill
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWCleanup.exe /t
      4⤵
      Kills process with taskkill
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWUninstaller.exe /t
      4⤵
      Kills process with taskkill
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OWUninstallMenu.exe /t
      4⤵
      Kills process with taskkill
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OverwolfLauncherProxy.exe /t
      4⤵
      Kills process with taskkill
      PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "NVIDIA App.exe" /t
      4⤵
      Kills process with taskkill
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "NVIDIA Overlay.exe" /t
      4⤵
      Kills process with taskkill
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im nvsphelper64.exe /t
      4⤵
      Kills process with taskkill
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im nvsphelper.exe /t
      4⤵
      Kills process with taskkill
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im nvcontainer.exe /t
      4⤵
      Kills process with taskkill
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FortniteClient-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      PID:3464
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCU\SOFTWARE\MyCheat" /f
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
    3⤵
    PID:5988
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
    3⤵
    PID:5932
- - C:\Windows\SYSTEM32\attrib.exe
    attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
    3⤵
    - Views/modifies file attributes
    PID:6052
- - C:\Windows\SYSTEM32\attrib.exe
    attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
    3⤵
    - Views/modifies file attributes
    PID:6020
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6096
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - Executes a command shell one-liner
    PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c228c8f-97e7-4a85-94ef-1eff9ed99e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c228c8f-97e7-4a85-94ef-1eff9ed99e4a.tmp
Size 18KB
SHA256 27435e2d5cb89a5b83f9e5754156740e937fcb9fed7815fd7b9eac0d7b8dc18e
MD5 f0c9a79ee131159b398dc234efee5faf
SHA1 1ade6e8d666fea8d279229f4c413d3acbfb45c7d
SHA512 5ef3ebff99f252fb41cd59e232b7aa089f0bf298211805567fb314cc702a8370618b01ad2a5704f9e75fa446354ad6a2f6b3b0b063f72345c6cc925a71c548aa
SSDEEP 384:kQkUSvVsNUAc2gGyLy5AF4Wgtk7hoz3+2WIH7vBEl4IIln:UVT7G1ijoLlWIH75El4LR
TLSH
T190827D7468B86C3B4DA3D651F14B36539FB4802BEBC82FA4E5DD6B1C01CB6D8230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e022704-f62b-4d3f-b654-1bbb400ba758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e022704-f62b-4d3f-b654-1bbb400ba758.tmp
Size 18KB
SHA256 ed8f1b05232d05ddd854f9e93ea56e28a91a44c8c973e425c4f93ab5f256aba4
MD5 9df861c360199a033a2a640ae485bd18
SHA1 ca815a542edd8dad2d0e429f3e1442a5b5d4c21d
SHA512 37e46bf59c1a91495c93ed82e66de780b65458fb882d20d30b4ddbbac3cbfefc2831b13d0af6e190f722195d390dbf9827ce1c04453edd29f1c4eb73866fa409
SSDEEP 384:RQkUSv0sNUkc2gGyLt5AF4Wgtk7hoz3+2WIH7vBEl4IIln:D0X7GqijoLlWIH75El4LR
TLSH
T1C4827D7468B85C3B4DA3D651F14B36539FB4802BEBD82FA4E5CD6B1C01CB6D8234B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f3060ec-0e24-4514-9443-c25d79c69749.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f3060ec-0e24-4514-9443-c25d79c69749.tmp
Size 8KB
SHA256 cd52040fc1516b3f33c75dd4fb99b761ddde02d0bfbb98160b3cd0224bf3dfd2
MD5 a1a849fbf32ff53a89032c43a6df4c5a
SHA1 14f35a0fff7f7c46c4919e6fe504e3d314a64ddb
SHA512 acad8651e0e6e7b28a5c215e2384bab4ba56890644c4aa8d90e6053d663ed42535c028c60236e1c4b200086d5d6f9a0ca282cf6320591a0a642528ff8a487d41
SSDEEP 192:3ONF6v6mtdQmiUyrtRe4WgrpZK1bynLdU6:3ONF6C8ERe4WgteWU6
TLSH
T1D302D838BCBC787B5EE79E05F4877B179FA4113BAA952F84DAD42A1C00D768C1313922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf03c6c7-cb9e-4738-8d1b-88eeddfe1be6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cf03c6c7-cb9e-4738-8d1b-88eeddfe1be6.tmp
Size 105KB
SHA256 62fab88cb5198530e2dfdb8339f170da8e3c8d0fff4167dc4bfcb08cc18fd750
MD5 06eaff39e7d820178762d31fbdadca1c
SHA1 4ed51eb65450f98c797ac2e1af69c955dc014f1b
SHA512 703e50475751e268f8f48b744f5f09e24bf5a9df4dbd989adac78e251f5ca548631a44b92ae65f955e635d39fa1b190cd88a18556d3638c2658e63aaedcbe8b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T18FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 de64f2d04fcf5130505abf8f452033663f6c6f34ad6043cda2754984ae410dc7
MD5 19b889df706bad8784d27cd37cdb015a
SHA1 158b81f559403bc7ae8d54199f2448874dd6cdff
SHA512 f0083b19f9cf0962840e70074f3d283f5e54647d8a694c758de3836209b5a0b5ba6a2609dd982fa7ec2ad9302ede78222bea21348b57341073054c425d0622b1
TLSH
T102D02BB0C3682230E462343401A1C2227089E5004E0636014083515508D47A200D1115
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3f9b9023c85448394a4a44d461e6a3d436b0f70c32bf9babd8e7b5678f0f654
MD5 51acaddbbd494a9d8a909984031014b8
SHA1 fdf23496539d1c6df41da257ce6b5c3dabde84cc
SHA512 9f5bb780d912f045ac2571dbec4060106b5edb320adc9499aa00f35021551fc293e69d8365b8fbc5ee5dbf7dbf57df59e8b9d818fc7126a4c90198c04147d803
TLSH
T167D08071673539BCD2FE713504D0D5514544DF534B441B0515079C1859F479228D1FDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6e7a1b2aff313d1346d95d5e3a8efc635bcb45e12b921b6caa44f7d2b0a6d934
MD5 1bb18b6794073806108c1d692527dd16
SHA1 66a573c5f1e596662c9a583c3c9450152c9d999c
SHA512 c4eee9b498d62cd05d36bc16bf3e650a6012dfaddf245e99541b645344a78328b98dae04caa3ff74b060e1097c15d2c1e3feec0e072caee0ef663adf1316b22b
TLSH
T1F0D02BB083A82630E862343401A0C2227089E5004E0637024083515508D57E200D1115
MD5 SHA1 SHA512 TLSH

Submit Download

15ab57a0-9727-4fef-98a0-cca8e1c78b71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15ab57a0-9727-4fef-98a0-cca8e1c78b71.tmp
Size 27KB
SHA256 749ebd75465ff3207072a2502d83a416c92ec4441d475d8e1da7484da02cc9f7
MD5 9814698e774fe97efb72e19acae4d87f
SHA1 fda0c2de449b8afc1e3ee2f17b607f837959eb37
SHA512 bbc49cb81fced387a24bbf51d59b2708475abe92f72a9a1d3945f9b68509ada58b5b7409eda6f4bf03c4c28d2428dd8b6cbce00d22080fe7916101a1265c2fa3
SSDEEP 768:gSOtS3IWvUgqc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3LlTtsbyromcD:gSOtS3IWvUgqcu1ja83LNWbpmcD
TLSH
T141C2E93B640CCB7E4FC01E9DDC6A6F973E9802C7A6589D4047F9994C02D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f03894b-0e33-436e-b779-9db9b025d568.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f03894b-0e33-436e-b779-9db9b025d568.tmp
Size 10KB
SHA256 805865e5feeb5c7521e2c0ac70b80a47ba0f558f6aef1fd3068690e361abf5a1
MD5 657ac1929c49660057ce01de28ea0f13
SHA1 ebd87cb8fa904f34c53e0486ec013d2569ebecdd
SHA512 380222cbc594868eaeaf487a78be2836e9fc8be6d33a6099c2ac31381c85c3a7ea97932147b47b664a1b9650f4f5d40149d4c92db9f91b18eb31a62cb14efdf8
SSDEEP 192:sxZkRlnM/fZsaAIdpLqHW6+WNQH0/Ytb4Q6yQIg5NJ:sxZkLM/fZsaBOHbj/Ue5
TLSH
T11E32B8566D34A97B8CC7D219BA59BF53E6F9403251900D5CAAFC861C05E7BDD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a2cce3dc3fd6d8c4deaad622f492cf8fe4501aa36d89c09f7e0f9167378c7c02
MD5 acd93b27dcf4638f7321eec8e24706d6
SHA1 b8a51cd701b88687c260face6ed53f74fc7e2b95
SHA512 6cfe02f6cca802a6eb17824054b1c9e3363e26bef57947f8cff800a18fa3bb68d7e09c14af7aac8b1643b5647469c1eab5e7256037e59d2fbad2974296ac2071
TLSH
T17661E7861D90C489FF79C3378DF0D08A3E2146C261D7EB2A0599F9FEE9C226481C5D8C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 14dbc0efdb109bd37c8d7efcebc5e87dbaa83a9e95afe9bb9229243ecfc3e68b
MD5 145b1bf4e5abb3bbe0ace50d423c7b85
SHA1 3d2e565972d1c62de41dc361bce2ace2346c0d06
SHA512 646d38dea1bb78aa2927f24b5cafd6263760df9f722d1fd23bb77cd20547f908745627eee75c16c1dbf88aaa554870979be4d006f4c460c71a4e797cd2c1c967
TLSH
T12461E8861D50C098FF79C3378DF0D08A3E2546C6A5D7EB6A0599F9FEE9C222581C5D8C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ae382ea3-3414-4008-8be3-43a32aa22507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ae382ea3-3414-4008-8be3-43a32aa22507.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 335B
SHA256 072ce57890b0d07b80f07eb7ed85f3af7dba9de02cb767b8c6bb5c8ecc769578
MD5 dd4f64ddf78218757e18be941af7988a
SHA1 6199ed61af26c78e886d75b5f24dde1cc4ea1567
SHA512 70a226eef886dfcb57d4c37b9ca0674a4c5dae66954d66d5eece20f8bc19e4fae18f2a1c6a2c799435a002b3dbd0df6155776f798790123419e196d8ab85459e
TLSH
T117E0262485CAC23FA25860F20924BBCEEAE3958FD7C63D4A1F80C864B483098E16E191
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

34aef41b-36e9-402b-8570-b025105a4384.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\34aef41b-36e9-402b-8570-b025105a4384.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

3656b773-1587-4449-9da6-b5179a85874e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3656b773-1587-4449-9da6-b5179a85874e.tmp
Size 1KB
SHA256 d8a4870ff55e20a9a9e3186d6fc9c28b6a54a4c25639d60d51cfa57a2eee9174
MD5 c3f75080577672fb43a26efe2bd01e5c
SHA1 aec956871911e3443f34ff1c4b41241c8f60d67e
SHA512 c2cdb6bb1c45c497afd07aec4f388418efbb11a5ad3193c0d5c664b5ac3eaf0a910ba670d6cd1cb47f11a2dd613631d92dd1c2e4ce4b50a7fb1d13dde0e8cce3
TLSH
T11731ABF783B185AEDE1156F0AA04AE2BCF5C0116439C3C5A8AE4AF17D7B3071E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

90c8ee8e-6345-47e9-b984-e3924c35b72a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90c8ee8e-6345-47e9-b984-e3924c35b72a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 abb37fbb92696387378bd9468e2bf9db675569cf7fbc78b668258ca778159625
MD5 7f526457fe1569b1834d899af360e781
SHA1 f96e4244bffcf9021db834ac44dcc18d03a0a776
SHA512 ec9e8de9e597e7ac0aad8523669ae5cf5733d23c3c439357904c643bdd9b7a8f704203ea9d76db365f5e68f65ea805e2a9e645a1d590bce9c132058049b6e6f9
TLSH
T1A5A00219095490A2C11056B4957B018622109C10160523A154A510649C94154466612D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 190c9e4b758180eec27951b739a38167b01a4115aee723ad05750ed4a85c3107
MD5 9d09f6d7df3df94beebb76012c581669
SHA1 dd0b61a74b90fda13fbab0a49615b4f47f30f6b1
SHA512 b9927de95a8251a17130d807bce3d62799f7a61d316744e3ccc62f594b3661ffdb2a13fefd08ac632a5cddde87d809cd82ad57791fbce6a6f5c46376488e2084
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 494b6c940fd0ad3c9a877d39be59a536d5d0569f75d649cbbb05fd07a5cd8819
MD5 69e75b0f5db19769220bccf36049aafe
SHA1 1c0289e96ff66cf5716315588e855801857f5413
SHA512 3d2f94daa31b8e835fd33d7ee3fc0807bd78711ecd86cba54bf224c35e66e65f3e012cc7d1a625dd562f46c58fb3d7895b47af69c59f9efd58c78a735f674c40
SSDEEP 24:KBnwT4rInKXhm1KSDm6EH7no45lk15oLPIOLkK/HhnFk1xD0SDaJrZD5yXapmtku:KkMInKRmUYcIrKpSUTyZeInKnqQfcI+
TLSH
T19991665031BB426078BF6D0C81B5A72A858176B37078E62B7F7C54A68F6BE541CFC5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c29ca427-001f-4523-a5a0-26c8cd5d8914.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c29ca427-001f-4523-a5a0-26c8cd5d8914.tmp
Size 10KB
SHA256 32a04dc562955e1c86d2a143989e37534ab0eb7bee1b7a521cb6d8d563a7b1b5
MD5 5c8a03a98c7a876e12104fcd6133ec93
SHA1 90685a978ca5b7fb3a20c8c13662d31f6feec152
SHA512 13ec261a237ad50e01bba943f508ffd683ce0667392cd1e5fcb83dc8cf8b5efbe63154b4b13ac8ed5eb7917f8d63b8a297fe6a118f1fb68ea47f186aa4454d40
SSDEEP 192:sxZkRlWM/fZswAIdpLqHW6+WNQH0/Ytb/Q6yQIgrJ:sxZkqM/fZswBOHbj/Xe9
TLSH
T1A222B7566D34A97B8CC7D209BA59BF53E6FA4032A1D05D5CAAFC861C08E7BDD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb0627a7-d4cc-43e4-98e0-e708a0f7a04e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb0627a7-d4cc-43e4-98e0-e708a0f7a04e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cff90d8b-4e3c-45c3-8578-b8dd7606cfb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cff90d8b-4e3c-45c3-8578-b8dd7606cfb4.tmp
Size 11KB
SHA256 9aa075d580d5d36ba2102886b8117640fb2357446e679a3a10fdb796fa55c153
MD5 2146c12713b9332187f4777c3b978556
SHA1 3d6d81ba79da4e39cf7335cf5f5eb591deed87ba
SHA512 990a98aed3506116145a1d4a62ab0df0e36bd083e3587f7093d616076dac1402875b66777c7ba62c38e5891f7f5cad64468e611f1845d749a8a01014886b39fc
SSDEEP 192:sxZkRUnM/fZsQWpVAAIdpLqHW6+WNs0H0/YRB4QD0QIgbNJ:sxZksM/fZsQWvABOHb8/Qb7
TLSH
T1DC32C6166D34A87B8CC7D21DBA59BF53E6F9402291D01D5CAAFC8A2C04E7BDD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d95f679b-517b-4235-befd-63908f313e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d95f679b-517b-4235-befd-63908f313e61.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace56e55-c475-4174-9b12-67d0fbc394c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ace56e55-c475-4174-9b12-67d0fbc394c9.tmp
Size 22KB
SHA256 caa57219a4467f5acb74f69559aed9a35ef53a66f4a873d3c7526e13b6c380f0
MD5 3284a614a2893459470351580059998d
SHA1 86fcf15b5830d91fc26f071f99952d7a349726e6
SHA512 284d3a6d7a947ea71ea0ab2da92334362afd7f7d83e7a5a9631f683a47409cff381906fde8b08ea89544b5e605300079108cccc897de67da82c9755de3057eb0
SSDEEP 384:YQkUSvVsN+Ac2gGyL48AF4Wgtk7hoz3+2yal1xczJ4XH7vBEl4IIln:QV17GqijoLlyGxcz6XH75El4LR
TLSH
T1B8A24A3CAC655C3F44AEBB04A14E3A275EA8513BD5F41AA8EBC95B0CC0B6688F343525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d55f6d95-69bd-4167-a695-91660d9efe81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d55f6d95-69bd-4167-a695-91660d9efe81.tmp
Size 8KB
SHA256 6578f814b804a236980e5a1deb36b358696bc0ada48deae353471fedb2db5e8d
MD5 e7f35a00db5e9d0ad7383f67c702b7d7
SHA1 8b8bd17640d0d261be43281085a98bc2a618acb7
SHA512 3975e5ad7bb59d0ae0bb9a3db08168953056407437c5febfde7837f77fe1bac327b04b6a5d33c13a584ababb2000b592f4f1c64c6e1dc5819b9e8b8c2a750585
SSDEEP 192:QONN6v6mndQmiUystge4WgrpZi7hodF3+2fposrqFMU6:QONN6CCJge4Wgtk7hoz3+2WIU6
TLSH
T1C1121838BCB8A83B5DD39951F48736139FA8413BEB896F94D6DC2B1C01DB69C530B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9e13aee9c8e3fb6afe85d5bf2bab3644d8650e22a8e13b8c88a0d53c7f593715
MD5 bbe1a4f8fe03f3802add139d1ed9d7a2
SHA1 3668d296aa73487b4ea8e6e03eeffd1b4177eb9a
SHA512 31a54903e3d59bcd48d9e1a1af31c4416da25cd0d9adbe36f0a935cfd4bb4c1ababd26f6db06069efdf076941be739aa5cf01d550ef1d07304b452a6c5ba9719
TLSH
T11941094CB6EA110CB3B26F46AFF7A96E847EBC772E16D49D10010E4F0622A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

31799be0-bff1-4bc6-96a6-d797b022ac9c.tmp

Path C:\Users\Admin\Downloads\31799be0-bff1-4bc6-96a6-d797b022ac9c.tmp
Size 535KB
SHA256 67ef1c57178cd87ecaa3c96ee514dfe802dcc6727da211d1fea59255d38879fb
MD5 2f54c9427ffc9a7305a62933f1ed00f7
SHA1 66a7dc97677d7ca838e687f83fff7f4b69b5e361
SHA512 e9058bd948f458da978ec674d5ab04fe38be51fd383bb1abe5b20021f7ba9a70f72e4abd67b12ef4e54df3ee79d08c811128432933ca92a43e06179b2fc37460
SSDEEP 6144:JfVjn0pplUL/8Dnrvj73658Zu1hzRetOmcNffWuSqhGK0xUcDYiIFbHbTSxi/2M:JfVDL+r77v4UkfqKAUqYbb1
TLSH
T13BC47C26A6E500FAE077E478C8834917FE6238554321EADF13D08A7A1F677E4A63F351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads