neptunerat | 4b361c4f5b2dae48be44036c2d484244a678c0fa58bc0d3bd38bf2a9564ded72

Resubmissions

15/04/2026, 18:51

260415-xhssxsgx3j10

15/04/2026, 18:46

260415-xepbbsa19110

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/04/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 49KB
Sample260415-xepbbsa191
SHA256 4b361c4f5b2dae48be44036c2d484244a678c0fa58bc0d3bd38bf2a9564ded72
MD5 bd03a030a528f182108e33bd5d5bed22
SHA1 d538beac945e1a503910f942f6a21347836678b7
SHA512 af4ce39c8e07334a9cff9d8e7ca33d27d1446e24329e33fa611f5d2461204f31093e5d2faf63680c2d1a27fffbcc91177e591e03cab987d6b6be6f6e52222e4e
SSDEEP 1536:Vufri9GVTZdHWEeUfNTPQU1O1109yUcbdnE9vbOdl:Vufru4ddHWEeUfNTPQU1O1109/cbd+bi
TLSH
T19D33E69DA3D84131E4BF56B21D67124893B0BEA34467D79F7CC401CA2B26B958B42EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neptunerat ransomware trojan

Malware Config

Extracted

Family

neptunerat

4oyai0loeu.localto.net:8822

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/3804-0-0x0000000000730000-0x0000000000742000-memory.dmp	family_neptunerat
behavioral2/memory/3804-3-0x000000001B5D0000-0x000000001B5E0000-memory.dmp	family_neptunerat

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
36	raw.githubusercontent.com
60	raw.githubusercontent.com
61	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ENC.img"	MasonClient.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207525553533963"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{448A89E8-56B0-4527-B6CD-02F1C92060FC}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	MasonClient.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2636	3804	MasonClient.exe	92
PID 2636 wrote to memory of 2356	2636	msedge.exe	93
PID 2636 wrote to memory of 400	2636	msedge.exe	98
PID 2636 wrote to memory of 1480	2636	msedge.exe	97
PID 2636 wrote to memory of 4576	2636	msedge.exe	99
PID 2636 wrote to memory of 1064	2636	msedge.exe	100
PID 2636 wrote to memory of 400	2636	msedge.exe	98
PID 2636 wrote to memory of 400	2636	msedge.exe	98
PID 2636 wrote to memory of 4792	2636	msedge.exe	101
PID 2636 wrote to memory of 4576	2636	msedge.exe	99
PID 2636 wrote to memory of 1180	2636	msedge.exe	102
PID 2636 wrote to memory of 3528	2636	msedge.exe	103
PID 2636 wrote to memory of 1064	2636	msedge.exe	100
PID 2636 wrote to memory of 1064	2636	msedge.exe	100
PID 2636 wrote to memory of 4792	2636	msedge.exe	101
PID 2636 wrote to memory of 4792	2636	msedge.exe	101
PID 2636 wrote to memory of 1180	2636	msedge.exe	102
PID 2636 wrote to memory of 1180	2636	msedge.exe	102
PID 2636 wrote to memory of 3528	2636	msedge.exe	103
PID 2636 wrote to memory of 3528	2636	msedge.exe	103
PID 2636 wrote to memory of 4984	2636	msedge.exe	105
PID 2636 wrote to memory of 4984	2636	msedge.exe	105
PID 2636 wrote to memory of 3604	2636	msedge.exe	106
PID 2636 wrote to memory of 3604	2636	msedge.exe	106
PID 2636 wrote to memory of 1640	2636	msedge.exe	107
PID 2636 wrote to memory of 2400	2636	msedge.exe	108
PID 2636 wrote to memory of 1640	2636	msedge.exe	107
PID 2636 wrote to memory of 2400	2636	msedge.exe	108
PID 2636 wrote to memory of 2480	2636	msedge.exe	110
PID 2636 wrote to memory of 564	2636	msedge.exe	111
PID 2636 wrote to memory of 564	2636	msedge.exe	111
PID 2636 wrote to memory of 5048	2636	msedge.exe	112
PID 2636 wrote to memory of 5048	2636	msedge.exe	112
PID 2636 wrote to memory of 1968	2636	msedge.exe	113
PID 2636 wrote to memory of 1968	2636	msedge.exe	113
PID 2636 wrote to memory of 340	2636	msedge.exe	114
PID 2636 wrote to memory of 340	2636	msedge.exe	114
PID 2636 wrote to memory of 3096	2636	msedge.exe	115
PID 2636 wrote to memory of 3096	2636	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff85690c188,0x7ff85690c194,0x7ff85690c1a0
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,12714359500872313031,16834197708204331792,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,14370445229942874181,16196421491059200666,262144 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:2
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,16875857362192449129,8330572780487567492,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3112,i,5048830555051042839,3344284576156212274,2097152 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3116,i,6836187165429781493,13686766900967781921,2097152 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3280,i,11646415111946873720,11321736642080684033,2097152 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3296,i,16826615790971241658,14558382322313913839,2097152 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,14797826183337094887,13885036602977806197,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,3144650039388546578,4413852623956450371,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,6841259213074719375,12989086030943981221,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,14592965545622487884,11113290656537197703,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,4710949265636184665,1324382426555522433,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,4710949265636184665,1324382426555522433,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,13391682700683914902,11109778525336029143,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5742549255443937191,17844298801321210785,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,11939211492807613296,14646985818224307173,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,2419266032833576560,7973590830806853952,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,8948557598248550289,4262031997100811422,524288 --field-trial-handle=3792,i,12501251775949123675,2311320099273801838,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5ec46fa431794c7d59f9fc0057e1e3e3b1af4e12dff7d68bc94d155efc6ffec
MD5 5c96a0e845475aad3c0a3e922859ed30
SHA1 ea2be21b4e96a8a5ec42464f68d775342fb34bbf
SHA512 725cd4d35913c01a0e1c8a8b8f0ea365645f9ce7b622b047d3bafdbbcecd02dfe38c58f9ea0f30642ac6afcdb3dd6bc636132cf52b13f84a3535ead27209fac2
TLSH
T1D2D0929E52A68C22CEBAA6B0114A2F892296D51A410AD38AD43228181D9328669C6296
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9b4b644a6d0e658838d87f47f679cce5368e7cec46064a4bf3d8d2cb1bb1c32
MD5 62ac481b0a7e76afd75b774dce51082d
SHA1 8e75d15d042e2f4592f0e1cfbe7c6026d6c1fd2f
SHA512 d0f20529220d52336501d06acdc623fd7e8bf5e9f66e083561a68ef1e77e8bc534b1bf060ec9cba3c8d55410fc489087b1852cfedcff4c473c5b044950986f84
TLSH
T1F0D0929E92A68C22CEBAA6B0114A2F892296D51A410AD38AD43228182D9324669C6296
MD5 SHA1 SHA512 TLSH

Submit Download

6f5806cb-fb1a-4e23-9c1b-9597ad14aaa8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f5806cb-fb1a-4e23-9c1b-9597ad14aaa8.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ff5d48ba38d17e8eae5c6c0b29524ea275f9748b88479320898e140385814462
MD5 e2edf721e5121eb07477e128e922582d
SHA1 dec25621c837d5a32623dfeeb5d464e407225f90
SHA512 1932fa19f59ac61f33362aa6b6381c9906cf13b2fff2193d5f48f7e00d61078ae1add398078684ea3d83ea82485cd5959a5a1114b383f790c9fe12ce90dc02b1
SSDEEP 24:Kg2xOoMIRKqho1iSrsuyXCVSRUJI3K9hK1KSKt6BmlkVIHKhhq1mSczvyXgTonp:KIPIRKcocMyROI3KbK8dWIHKHqQPypp
TLSH
T191913193313BC3903E7D299981D5E51A039634A33029A83B7BB954A63F67F118DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1d95b958615c9685b7b4deb835ddb93735a14614daf7c54909474b8dd1e2a78
MD5 53624406858b1645a653e81cf00ee8c5
SHA1 dd0c08f7d44d6fd3351a98567ca096305840eaf3
SHA512 45495efc5cb0dbaad459f9bf1fb3f016e42dbaf305ea295e857d99f300b7b851ea8a831cde0014ebf100327dbcf9c41729425cf9ea17778923feba8916c1dc9e
SSDEEP 192:NON96sPQmiUyqW+oJ4I2LqCjzoA6BXlSJrVc0yqlmU6:NON96aG+oJ4I2WOH6BXUJrjgU6
TLSH
T18B121835A838EC2B5DE3B545B48B3763AEE4613799856F44E6E84F0C00DB68C274F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f872775cf280d66d0afa718a02e9ec0e2c19043f88b1f765ddc1fe8fe0ffecf
MD5 37059dd470ef472b2eeb3f5cd5e8e639
SHA1 4f80aed86caa063bc786f2ca3a16eaadcb6b91ff
SHA512 e8a88dfa4d308705d3f24fc1e9d5d881346c988a25c2c00738db4b63be96fa8bf60508e94fed2c7181e16607bacc15aea346d9953de7570d75531a08c8f202fe
SSDEEP 192:9ONh6s2QmiUycWBoJ4I2LqCjzoAy4v6YHU6:9ONh6JyBoJ4I2WOHRRHU6
TLSH
T10602FA35A838BC7B4EF3AD49B4473B276FE4512BA6952F44D6E84B0C00DB65C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ffc8655cb507d62bb2321f6db279f8e2c81f8b9f2d3e1802e80ec206a38d651
MD5 a47db11a8207490771c143977d88ac94
SHA1 6924dc20a0be60049bd70838988025d3a9a3be86
SHA512 33b4fad4393930dcb69155000ff1b66d3893bd15f42ff60e05d14c02ab3e4eb3ee432af13ab1d2321e59e440c0199b2e4c64d306e534dfe86f2eaed860ab2da8
TLSH
T16E415898B6ED1118B3B77E5AABF7A86D497B79372E06D45D00110E4F0A62E40CC7173B
MD5 SHA1 SHA512 TLSH

Submit Download

8837be40-4206-4826-9740-42ac9b03c27e.tmp

Path C:\Users\Admin\AppData\Local\Temp\8837be40-4206-4826-9740-42ac9b03c27e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2636_1427334112\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2636_1534388484\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 724B
SHA256 fd0bc4f04864dbd7d89c8eb185663bce7f16ad4800fa89f4a0adb640ae5f5f73
MD5 320517c54f4245df10a53f23e15ef629
SHA1 b7991388b4b1aee9f10fcd16bab3d7a7a5e4013a
SHA512 ff00989e081603a9c902aea81ac9b3ca3a72b4db2c87a337b9be3ef79d1bad0a0c81776978c417b3ea3ccc0ac39e1bd7a07f5da2fdc5875612e2c7f27014d6f0
TLSH
T13A01F4E0AB624DA47633096AB509B721DF30279370943E6D368ED3139FF0416894B2CC
MD5 SHA1 SHA512 TLSH

Submit Download

NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 34df3c1838f4ffd7be5042749a68f588f51bdc076ffa0a36f94be6e44a443b1d
MD5 f96e862f962f514b3c654e672a0e7a53
SHA1 00767e36f63d009db5129a46445cf385447a9c4a
SHA512 77ada87e2f8b91b96ac18d3815f087cdc3ae04de572daeeeab48f72b2e8058814b8ec619994b545a55064f516c347bc7abc6f63f254432bce15669c9194213df
MD5 SHA1 SHA512

Submit Download

memory/3804-0-0x0000000000730000-0x0000000000742000-memory.dmp

Download

memory/3804-16-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Download

memory/3804-3-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download

memory/3804-2-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

Download

memory/3804-1-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads