a637f32b64e1493b315db9139065105656c84518dca20ce3b18c89750ee40c82

Analysis

user interaction
yes
max time kernel
70s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AME Beta.exe
Size 146.6MB
Sample260429-xd97eaez4s
SHA256 a637f32b64e1493b315db9139065105656c84518dca20ce3b18c89750ee40c82
MD5 ab9275d25ea891908961cfe9a1292106
SHA1 a5b1e2537130d3fe43f0bd6503d9a7ac3f3bee37
SHA512 20cc7c0bfaaef67c2bc0d04165613d3b68ac4de5a35270a0e837fd6d9374cc29f268d41fdfa25ed227d9b213719c953cd83a352c3d93250d4cf3d9de21c29b64
SSDEEP 786432:zFAwW74lEprcqWNUbn3sRUIWH9Np9Uv2OPQql0OVGwfSafffXfLlT0FUOXqHGVWF:J84eiOsiP/3TNfwaafffXfLlAayWc
TLSH
T15178AD02B3F84665E1BFD63894B34A1AEA71B8564731D7CF2168426D1F37BD04E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2456	AME Beta.exe
2456	AME Beta.exe
5780	AME Beta.exe
5780	AME Beta.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	AME Beta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	AME Beta.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219620782438501"	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	AME Beta.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{3AAFD5F4-31DB-4C45-A2B0-6FB7BEA0B65B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AME Beta.exe
Key created	\Registry\User\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\NotificationData	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	AME Beta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apbx\DefaultIcon	AME Beta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apbx\DefaultIcon\ = "%PROGRAMDATA%\\AME\\Playbooks.ico"	AME Beta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AME Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	AME Beta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apbx	AME Beta.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	AME Beta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	AME Beta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	AME Beta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	AME Beta.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5780	AME Beta.exe
5780	AME Beta.exe
5780	AME Beta.exe
5780	AME Beta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	AME Beta.exe
Token: SeDebugPrivilege	5780	AME Beta.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2456	AME Beta.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 5780	2456	AME Beta.exe	79
PID 2456 wrote to memory of 2888	2456	AME Beta.exe	81
PID 2888 wrote to memory of 2052	2888	msedge.exe	82
PID 2888 wrote to memory of 5632	2888	msedge.exe	83
PID 2888 wrote to memory of 4156	2888	msedge.exe	85
PID 2888 wrote to memory of 5632	2888	msedge.exe	83
PID 2888 wrote to memory of 5632	2888	msedge.exe	83
PID 2888 wrote to memory of 1736	2888	msedge.exe	86
PID 2888 wrote to memory of 1736	2888	msedge.exe	86
PID 2888 wrote to memory of 2496	2888	msedge.exe	87
PID 2888 wrote to memory of 2496	2888	msedge.exe	87
PID 2888 wrote to memory of 2496	2888	msedge.exe	87
PID 2888 wrote to memory of 3916	2888	msedge.exe	88
PID 2888 wrote to memory of 3916	2888	msedge.exe	88
PID 2888 wrote to memory of 3916	2888	msedge.exe	88
PID 2888 wrote to memory of 2760	2888	msedge.exe	89
PID 2888 wrote to memory of 2760	2888	msedge.exe	89
PID 2888 wrote to memory of 2760	2888	msedge.exe	89
PID 2888 wrote to memory of 5132	2888	msedge.exe	90
PID 2888 wrote to memory of 1552	2888	msedge.exe	91
PID 2888 wrote to memory of 5132	2888	msedge.exe	90
PID 2888 wrote to memory of 1552	2888	msedge.exe	91
PID 2888 wrote to memory of 688	2888	msedge.exe	93
PID 2888 wrote to memory of 760	2888	msedge.exe	94
PID 760 wrote to memory of 4576	760	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AME Beta.exe
"C:\Users\Admin\AppData\Local\Temp\AME Beta.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\AME Beta.exe
  "C:\Users\Admin\AppData\Local\Temp\AME Beta.exe" "C:\Users\Admin\AppData\Local\Temp\AME" Interprocess Administrator --Mode TwoWay --Nodes Level=User:ProcessID=2456 --Host 2456
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ameliorated.io/#playbooks
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffea1dac188,0x7ffea1dac194,0x7ffea1dac1a0
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11115965994095598725,15392292159281727006,262144 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,461525977731952682,4359824276042586549,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,14494846327992956313,14847375697763968158,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,11005446810496550197,7560991252051064743,2097152 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12351059921518813533,10306646113722028063,2097152 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4816,i,811850217400834273,1526414436338766447,2097152 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,3173556593311470824,5457068083722739281,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,13172049454932775401,6617165641672144737,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6069006934133383057,21060724498575930,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6069006934133383057,21060724498575930,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8348503783523226367,5196230838414066416,524288 --field-trial-handle=2248,i,16756932778033620765,8073449363096108858,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1100
      4⤵
      PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
MD5 aaac91ebbf67dbbc392d45b8ba21b7af
SHA1 c12b368a2d9e5d86e38c050c8c991930b00b017a
SHA512 d7492a4c51ec39a37fa7e0e893db326eb2afa4a19ccab42d34d8b2aa7279aedca2f5868970e4513c37d26caa55dce67a9dccd146446e47298a0c41e59869c2b9
TLSH
T145D08050DEF05960D8046571242CF7D45F59D9A1DD47DA2125E5EF799DC20C648C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 83d96ca54c352383ae1d77ea57d609e7c13f79e64467c885352eeebd7278aeb3
MD5 20b12819224f15e53866f73fa852c080
SHA1 de47d79b84ea5ac4c559090b3d5582b5fe0b786b
SHA512 8cc9af5a086ca11b9baacf7f78029398584c232ec6d0c86c986931b1eb3e79bb4795746917c2a649445fd31eb99a1cd715dba6251f319be2da899a6393ec6377
TLSH
T17CE02BA9CC75D82B08F8276964240345FB6413572642988B3A3C520C8F74E37568689C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 20aa7ec86ba26dc901f406bccdcf02a76cae141df58caf861254fb31dc358304
MD5 0d3abfb6fffc18cb6bc775d690bbb93a
SHA1 b80f4518262eb3dba7073cab420bc17d2684b1e6
SHA512 ee7443dbd9fd00aae466c25c8df0d03656e1013a2acb08b08c6a0787ffe64005b3b31ce77e0bf510c48f327505bc7e7ebc5d71ff60484a9c5842aadc73c467a5
SSDEEP 192:sxZSRviyMqZ/K1Ml8McG/fWsIdbDGD5lKiczodpm4/W6+WNMmM/Y0tlgdn/Igj2k:sxZSH0G/fWsIdO5lKi/r/bi/5E/jT
TLSH
T13172E7056A38997BCCCBD209BA45BF53D7F9156392905E449AFCDA0C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 07daef0cdd68607a6f7e48ea82bb3a555436dd5d7747304f3cc5ca7b8ef3b195
MD5 29101f4eb35392207650cad1d932c867
SHA1 1a5ea9e10db10cc6c02639c1846ca709d9bf7c33
SHA512 7c425d7b6f3cc0661ed648c18d52b2e7cc7de1aaa9ebc96016157d20f9b85012c23ec2b218a43f2e2662899e4ecd91f044a587cf2ab585b0431dc6892e142b72
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3qWWlLlu:2DhVP8b320JE/mKWRmmeQReu1jaKqWWG
TLSH
T1C4030C3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5cbc7eea20593bc70f554be7957c71b2efb0f263c37228c313f4e2b7ad859d71
MD5 1b6b954956a606684d1ee7eec46fd002
SHA1 0c7719bbd613335f2982d8e04f8e8754d486ff07
SHA512 510ccbde9af0ed649a7fdad5fd698ab488f8a16a235486c3d726796ab55c1e2457c6632741920fc13f6aff77ba4c81bf78add614cd1cf9d83817c3202e4b9876
SSDEEP 192:qD1rjvYZ5V8fO9ddTXkrno9BK3s7H5VZKd2L/j93xi/fGxH1SOTUom88fQB8gC8q:qRr7YzViOzdTkbo3jpRAxsgaSp
TLSH
T134B26E11713B13903ABE358A8155B8AF52C271633015E43B3BB904AA4F6BE24DDFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 39c24dae1fde1dc1f2ebde3d57be7b8797d1a7738d933fc505e9ffa69def9c38
MD5 5dc9ca6c54d78006009c7ae6178de708
SHA1 5b6a4d18599b1353dd0b477816efcae069ef4f87
SHA512 ccd2fc58c7d0b2e5e83bed844af58ccaed773a0b02864cf9c294ea6e8fc4b30dd46a320d9cb015ef43fbbe966f7d2a8a0c388af9f9f5f188a08a30d0e3e68fdb
SSDEEP 384:nJiFavqMg38N28TUNTUlIxBO2+4Or4LJHMSOrfpY5qJEyHN0Ru3Ra4W3rN1k+5vs:gFayv3ZwgO2ZHMHYM9tf3Ra18
TLSH
T10EC23A35E898CABBACE68FCAA7497B07EFE01157D58C4AD4DAD81D0E00D759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a07811c036ce6b3968ec3308696dc4a93977b60b3a1899d2243a8941bb640817
MD5 416b5daa2be18b22485a73b5479a3963
SHA1 ec36ecddbbc6082be96e5fa2c6aa31338d454a90
SHA512 09305718a0dbdc3b63248596905568e5795ad72230e83139fff581e0e025e3387f9ca25e2db9bfb7bb6cf090e71b3c2a8c42b3174bd387c91dbd9edbbda55674
SSDEEP 384:n4iFavqMg38NH8TUNTUlIxBO2+4Or4LSnNOrfpY5qJEy7X1Urai23Ra4W3rN1k+a:DFayv3QwgO2ZwkYM9zct23Ra18
TLSH
T175C25B35E898CDA7ACE68FC9A7497B43EEF011A7C88C4AD4DAD45D0E00C759E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dcbd4e95804867e97855a0a0b6c5b23ac5861b1015c1af72d2406af5b049cf83
MD5 0db667c2a560896be5b3b4c69b2440f0
SHA1 3adba03afb41f85684780f1d63aa32c691fcea11
SHA512 2996483e500ad8c98caeaea90e898c3193b8567d433dda202e0d5b2b57249861f82bd1b82426a724e8caffee45f107a0a6e21001841a069564fa50deda5afeb2
SSDEEP 384:nGiFrcXqnR38N78TUNTUlIRRO2+4Or4L4jAOrfpY5qJEy7X1Ur0i2kZw7rN1k+5b:tFzR3AwgC2ZW5YM9zcT2kZGz
TLSH
T1F6C25B35E894CD6BACEA4FC9A34E7B43EEF01163C98C5AD4EAC45D5C009769D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\Microsoft.Bcl.AsyncInterfaces.dll
Size 27KB
SHA256 2f859de3cde380de611b47ef240dfe41c28a0b5f9482fe1574e4db09e6bcff1a
MD5 4365a1a5686726e239368dff2971bcff
SHA1 09fc38797f63652a99a2c13a8a56204c8510d3b8
SHA512 1a9e013a9dc2861c1cef36f3e7b88d87f0fd487b549d279c6b9f94e05d76eb9c84c61cea6dc6aca99dfd1c79949b33e74cc649fbbc84015f066a7358d4633874
SSDEEP 768:4uwIOTx3Z22LwJ/FURsKeDjj9i/9zjieo:4lL93lwNF0sKMxyzOD
TLSH
T191D24B16E36C4323DEBA2FB5D964D5822E79E38A2C32D63E114CF6551C97788A73123C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.TaskScheduler.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\Microsoft.Win32.TaskScheduler.dll
Size 325KB
SHA256 5e64f2b0912f3fd60d62c4907229033ef22a349791843c0a0e748b3260e3fcae
MD5 692499d2aff48e4ac7cbe522e4d751d3
SHA1 2f9dbc8480a9020c201265d89b74afb2a52bc95f
SHA512 2037be19bff47efda5334369531621e0e91058889e6d111ab0e69d4bf100766747c3dcc4cf058370b61045ad0b031410ce5fdd14e5b06b92212d7f191fbc30f9
SSDEEP 3072:AJA5RylsHmD5+nGklYTkliWHOdjb9LH4+SiM57Yw4Af9ekaGDaTAFnb6aKCaV8wM:JHmDnklYTkoWHOg+De9ekXaUb6wg
TLSH
T16E644B1127FC862AEAFF4B79E0B4021187B9F446E46AD71D9990A5ED1C23380D963773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\Newtonsoft.Json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpSevenZip.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\SharpSevenZip.dll
Size 1.8MB
SHA256 f64720860f271e5b789666d4a52dc3bdb18f2a20909d5d4d50eb90ea59dc355c
MD5 700715e409fd03a05b29f084a3998ac9
SHA1 e754d4d1c97d52e099b499de2e098be1776d29af
SHA512 db7d342e832cdedb9451f0c647b9d0bfc8390eed147bcb9c37cd15aa5b8c3be2abd93c85d06cc7c066580bf12600fa0f56f86661bf29d81a239c5b6fb60ce132
SSDEEP 49152:QDJjiq8hl4bWXSVKG9M0LRhVc0fuinUr9p8LF4Hni6:QViHhKbWiVbMqhVvu8o9p8LFQi
TLSH
T1FC859D1277E480FAD1A78131CE916BE6D3F2F5650A25870B27944B9E2F37790ED1A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Buffers.dll
Size 23KB
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.IO.Pipelines.dll
Size 83KB
SHA256 ad4b4c1f4f05971d904c7baa60c67b58581d3ae4e6631aeca8cda0dd63322247
MD5 a004f2db190ccc05f6b3ab98a60e25f8
SHA1 e32f7641eef8235d29e89f944ca8501c60100f84
SHA512 d8b185de5bdf6306974ca31e73407c52578bcf2eba5c307586639d19066797fbc3c3d760964eba37460fcb9486d2407e3545959579c9161aae39851ca0b966b7
SSDEEP 1536:tWboDXHJKfXdGs+I9u8iLMlfz+cRJYG4bgN0xIRgevBjM+r2ipF2TpGyLz9:kc3gfUV0iLMNVrYG4bgN0xIRgevBjM+g
TLSH
T1B2836C6493BC0B1BDB8F19BDB17452130FB2DA167A47E75AA58DF9D928833C046213B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Text.Encodings.Web.dll
Size 85KB
SHA256 4b1ad200125c2bcc927dd2a217c2e4fd8eed6d9d48d1d9ba0c9955b9dfef5921
MD5 c81f34fc7677ed94e6bfb7e1a170ed22
SHA1 156ddac904c996b3f0d1a78a0dbfcccc0b4030b5
SHA512 b93b05ae4430b4e588cd13544146159580d968a6bebea0327a18f68785ad071c1128c69a8007b2f70a84fed154bb2cf2e3686bd4bea741a3cb9249a38a960eaf
SSDEEP 1536:+YQU6qF6FmUroWpn5qTQlyydbrkSGfICopK67vdM+Soczy:+YcqwTrfgQlTBrafloLN6O
TLSH
T118837D11EF9C862AFF5E013A5CE090659B74EF961133EBC73859792916733C8620DAE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Text.Json.dll
Size 760KB
SHA256 41620a98a701ed465d19ecb235f933f23d3e9e0de2beda2d96e8ccedcd5b81f1
MD5 cbb778b3bffec8375b388e5acf8e2984
SHA1 20a070c7bf735b804328166ae1ef138e89dc60f0
SHA512 5eb1b7f44acab72b303d0a6133a24520040f28183acbbd88a9a0cf9f31b54142ab4befbf7d43e1096f51c9ac69520c5a7a2ec79f8e2b225b7f155965806f99f8
SSDEEP 6144:dUijbPJXV/2IdelcQTy6fKdHfibTxbsjaq/dliUL5ZFFD5wVRexQx6aUYMFlsjwi:dVbxFO7lcQTJKd/805/dlQVR9x6tlUd
TLSH
T130F45B2077E8D72BD6DF4B71B03089148BB1F61967AAE78F618846ED1C92780AC453F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YamlDotNet.dll

Path C:\Users\Admin\AppData\Local\Temp\AME\YamlDotNet.dll
Size 285KB
SHA256 9172f0758ed76963e0ede3b5ca9a1fb5b82f64c7e7a92cb3a6de39efa933a668
MD5 e863246bf85a680aad4e779747db29ed
SHA1 466e0e73b898bd42f93edce8b7445b70ed073f3b
SHA512 fe01bfcd4ff25da13218a2710ba4c8798c53d7bdebb80d079d225ab1d7997317be35d86a09ebd2ea6133b5d1920fd29db1d1f465425d9c7a54d1da52271cab3d
SSDEEP 6144:K/wI8JWGC+OaVWzQEQzwf/U+POni6ocIaVaB8Z1K1Y9W2jtYr:K/wI8JW71aszQEQzw9POni6ocIaVEUW9
TLSH
T1EE543910A7E80B17DAAF13B9A9311D5A4BF5EC07A1F9FBDE0944E4FA1C127909A01377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2456-106-0x00000218FDCC0000-0x00000218FDD18000-memory.dmp

Download

memory/2456-164-0x00000218FE320000-0x00000218FE396000-memory.dmp

Download

memory/2456-1-0x00000218FDC50000-0x00000218FDC60000-memory.dmp

Download

memory/2456-129-0x00000218FE000000-0x00000218FE038000-memory.dmp

Download

memory/2456-122-0x00000218FDBA0000-0x00000218FDBA8000-memory.dmp

Download

memory/2456-117-0x00000218FE130000-0x00000218FE254000-memory.dmp

Download

memory/2456-121-0x00000218FDC60000-0x00000218FDC80000-memory.dmp

Download

memory/2456-77-0x0000021887940000-0x0000021888940000-memory.dmp

Download

memory/2456-140-0x00000218FE260000-0x00000218FE314000-memory.dmp

Download

memory/2456-145-0x00000218FDE00000-0x00000218FDE22000-memory.dmp

Download

memory/2456-147-0x00000218FDC50000-0x00000218FDC60000-memory.dmp

Download

memory/2456-148-0x00000218E37E0000-0x00000218E37EC000-memory.dmp

Download

memory/2456-149-0x0000021883E00000-0x0000021883E12000-memory.dmp

Download

memory/2456-150-0x00000218FDC50000-0x00000218FDC60000-memory.dmp

Download

memory/2456-81-0x00000218FDBE0000-0x00000218FDC2E000-memory.dmp

Download

memory/2456-83-0x00000218FDE30000-0x00000218FDFFA000-memory.dmp

Download

memory/2456-162-0x00000218FDCA0000-0x00000218FDCB8000-memory.dmp

Download

memory/2456-131-0x00000218FDBB0000-0x00000218FDBBE000-memory.dmp

Download

memory/2456-111-0x00000218FDC30000-0x00000218FDC4E000-memory.dmp

Download

memory/2456-0-0x00000218DA150000-0x00000218DB150000-memory.dmp

Download

memory/2456-104-0x00000218FDBC0000-0x00000218FDBD8000-memory.dmp

Download

memory/2456-86-0x00000218E3860000-0x00000218E387A000-memory.dmp

Download

memory/2456-89-0x00000218FDC50000-0x00000218FDC60000-memory.dmp

Download

memory/2456-91-0x00000218E3840000-0x00000218E384A000-memory.dmp

Download

memory/2456-93-0x00000218FDA60000-0x00000218FDA88000-memory.dmp

Download

memory/2456-95-0x00000218E39A0000-0x00000218E39A8000-memory.dmp

Download

memory/2456-100-0x00000218E5260000-0x00000218E5268000-memory.dmp

Download

memory/2456-102-0x00000218FDB90000-0x00000218FDB9A000-memory.dmp

Download

memory/2456-97-0x00000218E5270000-0x00000218E528A000-memory.dmp

Download

memory/2456-99-0x00000218E5250000-0x00000218E525A000-memory.dmp

Download

memory/2456-374-0x0000021884120000-0x000002188420C000-memory.dmp

Download

memory/2456-88-0x00000218FDD30000-0x00000218FDDF2000-memory.dmp

Download

memory/5780-152-0x00000195434F0000-0x0000019543500000-memory.dmp

Download

memory/5780-151-0x0000019541C90000-0x0000019541C9C000-memory.dmp

Download

memory/5780-112-0x00000195434F0000-0x0000019543500000-memory.dmp

Download

memory/5780-124-0x000001955BFE0000-0x000001955C000000-memory.dmp

Download