aa2baf83dfaca8908dcc742a96e3d83a1d64b655ac4f8ff6c72af13aeaef3bec

Analysis

user interaction
yes
max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Nova Executor.exe
Size 7.0MB
Sample260630-e2ndfaez7q
SHA256 aa2baf83dfaca8908dcc742a96e3d83a1d64b655ac4f8ff6c72af13aeaef3bec
MD5 f9ec813aff548d81ee4beae0bf29336a
SHA1 265730106eca423aa310d32b60205e0b703a12bb
SHA512 28859f5e956ce6bd914f4f927751523524cd51668db7ff4255f2a9e0ea62f57e3ba1f5b0957cb59f2076342ea93a81451a10010e5ec5ac33f66b8fb7cdfbbe48
SSDEEP 196608:FOM1W903eV4Q2tpDjIIAcwD0RPQavk9SIL:FOiW+eGQi9jo0ET
TLSH
T161763390E2D85AE9D8B3C43E8AD64146E732B8610B7CC6DB47B4A2523F373C5897E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe
2384	Nova Executor.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Nova Executor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "25"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1724	shutdown.exe
Token: SeRemoteShutdownPrivilege	1724	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4632	LogonUI.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2384	3148	Nova Executor.exe	85
PID 2384 wrote to memory of 4360	2384	Nova Executor.exe	86
PID 4360 wrote to memory of 4236	4360	msedge.exe	87
PID 4360 wrote to memory of 2644	4360	msedge.exe	88
PID 4360 wrote to memory of 2012	4360	msedge.exe	89
PID 4360 wrote to memory of 2012	4360	msedge.exe	89
PID 4360 wrote to memory of 2012	4360	msedge.exe	89
PID 4360 wrote to memory of 3184	4360	msedge.exe	91
PID 4360 wrote to memory of 3184	4360	msedge.exe	91
PID 4360 wrote to memory of 4632	4360	msedge.exe	107
PID 4360 wrote to memory of 2216	4360	msedge.exe	92
PID 4360 wrote to memory of 4632	4360	msedge.exe	107
PID 4360 wrote to memory of 4632	4360	msedge.exe	107
PID 4360 wrote to memory of 2216	4360	msedge.exe	92
PID 4360 wrote to memory of 2216	4360	msedge.exe	92
PID 4360 wrote to memory of 1912	4360	msedge.exe	94
PID 4360 wrote to memory of 1768	4360	msedge.exe	95
PID 4360 wrote to memory of 1912	4360	msedge.exe	94
PID 4360 wrote to memory of 1912	4360	msedge.exe	94
PID 4360 wrote to memory of 1768	4360	msedge.exe	95
PID 4360 wrote to memory of 1768	4360	msedge.exe	95
PID 4360 wrote to memory of 452	4360	msedge.exe	96
PID 4360 wrote to memory of 452	4360	msedge.exe	96
PID 4360 wrote to memory of 3084	4360	msedge.exe	99
PID 4360 wrote to memory of 3084	4360	msedge.exe	99
PID 4360 wrote to memory of 3164	4360	msedge.exe	101
PID 4360 wrote to memory of 3164	4360	msedge.exe	101
PID 4360 wrote to memory of 636	4360	msedge.exe	102
PID 4360 wrote to memory of 636	4360	msedge.exe	102
PID 2384 wrote to memory of 4084	2384	Nova Executor.exe	104
PID 4084 wrote to memory of 1724	4084	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\Nova Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Nova Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\Nova Executor.exe
  "C:\Users\Admin\AppData\Local\Temp\Nova Executor.exe"
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\shockify_8h66ilbx.html
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7ffad0e3c188,0x7ffad0e3c194,0x7ffad0e3c1a0
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,18157695201637815871,15067185086828913619,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      System Time Discovery
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,2692774261923635336,2870516211031343317,262144 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,3348336200240756153,3527111512909328204,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17943684460083796302,16283921565978673136,2097152 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,10037040054981645976,16888698820576229064,2097152 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,14642066747147955217,16355321358287713881,2097152 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,11396662350671151798,1010350523855442937,2097152 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,17083853435345228803,399075680467028733,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
      4⤵
      PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,14650341153497283308,8550394548440917524,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,14440294780602813000,17071572113454690279,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3168526311834611525,6765038133506433638,524288 --field-trial-handle=2132,i,10145345034687531910,9922791802870591889,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /s /f /t 0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /f /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3906855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5ae9dd52a34e86c3861569b62f6f0ad1566802215950a3a8d3ee51c7173d0559
MD5 4904b15c4051129e88f0b333b2ec7a00
SHA1 97a465eb079df7617b08a1fe8be02ccb0e1355c6
SHA512 7efe3d098e8e685242fe665884958f4c4ef11792cc5c8025079368d9ec7b4f8384d3d5b601e4fa0fe63a0e6d794ab6cf711184b4f4fd6accbd552c0bb273d586
SSDEEP 192:sxZyRNyM/jK1Ml8Mid/fIsvwZzVPEdpdXHW6+WNGYvFj7a1IgyJ:sxZyDqd/fIsvy69HbG24O
TLSH
T19F42E851AB345977CCCBD21DFA517F53D6F50562A2900E48AEFCCA1C01E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9889d67f2c12f8aa104f1ab49ddaca3f3a11bad69165f42fb2310f1e19e8b169
MD5 cc8dd1b5b7935ad51c224f60c73262e5
SHA1 0eeb34989996da483d4e88345763f0fae63ffa6c
SHA512 2555b1637a4fba5c41f5bbe677480f8de6acc1740cf8f95941120ef3fd9fd7a7a306c4a57f1e776c9baad7e3126fd19319d1a2604add80fc660a21af8cb8f67b
SSDEEP 192:sxZmRNyM/jK1Ml8Mjd/fIs6wZzVPEdpdXHW6+WNGYPTj5a1IgEJ:sxZmD7d/fIs6y69HbGGWI
TLSH
T1C742E8526A345977CCCBD219F951BF53D6F90462A2900E44AEFCDA1C05E7ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 532b71232492a6c5fd6304e11ce8f7bfc25bdf4823e777240664269f1393cc79
MD5 0a98601618ef36fbe0fff5ccd5248398
SHA1 16a50337ae3fc97a83050dfa37692e5c3ca0e735
SHA512 809c0e81a98aa05b1bd297cb5fbdb972865984c61c1ddfe445c7a07f2a96a4d838084ea0bb4e6b44f92098949a2e77afc1c43a8f380b9c43e771774bddb23ae7
SSDEEP 768:3thseJQxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5cLly0pptCroS7:3thseJQxWvhfynu1jaacL88ptZO
TLSH
T15AE2FB2B680CCB7E4F844E6DEC2A6F966EE801CB57984D5447EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 26ac7812f0822a68748ba2f31f02e615b9cfff32953031a2b86291d2822c1101
MD5 e0cb0c46528245d7fca7c76b3093691f
SHA1 e6959084dda358391b1a4edb24e9523147af161c
SHA512 8bb8652d43d37d569c817fcc19edbf1b142e49fadb971e7bc7f44055dfb1245bec3e2e4b1de4ac15cb0434fd9e4b5b408776e885140315e813cc89365384127d
SSDEEP 192:zSLsNvFQeWM7aUFQmiU1z8yZMTobWCIK++Wyiq801uqtSohT:zAsNvFT7DjyQzFIKPl1ZhT
TLSH
T17A4229B2AC798D6798A7F165F48E33135EB410BB9A845F14F9D96F1D00C729C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9cd265b669308771bc609e5b0b3433bcd884d57abdd7d9af62301cd23235fbb3
MD5 f6b50aa6a151edb0b808ee341a353159
SHA1 832c69b35df2f0045e3ad5770c29e3a312c70fad
SHA512 5a3bdc00ae6eff48ad2386c1b149feae58b75d35901f92698103f0e6b51871873bdca2c18192da33c2a826875a9b92f01e7bb7b0d55ffe46945ef9905d64ac0b
SSDEEP 192:lONG6vMtPQmiUy4ZThTobWCIKp847DLU/u:lONG6UtRRTiFIKRnU/u
TLSH
T1F8020876BC685C7B9AA3BE45F48E27171FE4216FA6905B50EAE82F1C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6726ca6e2798eca70190617c0fea6a3bf8fe9fed1b3ce9a7378b933fcc64ace7
MD5 c0364bbdcd486455b879436e817fa1c5
SHA1 3c96dab8c274019ca98ededd5c39ddf66283f71d
SHA512 a69df73d2c56c2c54e1716374e594abf5a4d99b42a448080997131c9ef755a3cfefc08766a3f385260e2aa071814dd21412aa81c04065a5127eb1f11555b332c
SSDEEP 192:zSDsNvFQeWM7aUHQmiU1z8yZMTobWCIK++Wyiq801gqtSohT:zAsNvFT7DpyQzFIKPl1vhT
TLSH
T1534239B1AC798D6798A7F165F48E33135EB410BB9A845F10F9D96F1D00C729C270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 feeb069400af90aced85ae6a57a83e70274a50035c5ccac611e8e9e7a4dcfb07
MD5 ff0564be046306011d5d9bb52ec3f9b7
SHA1 f9b93bf249322d1b925d2a5567aa06dc48a78aaa
SHA512 58a45df2ffc199b748dd1de64752bad9dfc00287e5d78932faa3bee054bdae08f4edf35068279a32a99e3ef85626e31afc2d37d577f7db1e57b3a2cf950bd2ee
SSDEEP 192:4ONC6vMOPQmiUyGZfhTobWCIK++Wyi080IuqtSoU/u:4ONC6UORbfiFIKPlAZU/u
TLSH
T18E1219B2BC699C6B5997B155F4CE23531EA421BBE9809F10FAD86F1C00D725C270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55559730-b96d-4c9f-805b-798eabd25961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55559730-b96d-4c9f-805b-798eabd25961.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e5cd65e18ab8da3048520150a4b056207a3d7131015779727a02321c09166339
MD5 942e165b87c982fa113b8fd071141a9a
SHA1 98c6c674fe2ca0bf50d090b040483a761797b65e
SHA512 ac00abb5229ebe8e2ca42d39c9818a049c33a3ffcf0e192eddecdeb39f12f2c7e70d831c6b5ee778ec1283eae15f31224a5cd50a40b77a411dc19936a40227e2
TLSH
T120412B58A6FA1154B3B77F5A9FF6A86D487ABC772E46945E10110E4E0622E00C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_ctypes.pyd
Size 121KB
SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
MD5 10fdcf63d1c3c3b7e5861fbb04d64557
SHA1 1aa153efec4f583643046618b60e495b6e03b3d7
SHA512 dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f
SSDEEP 3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
TLSH
T13CC36B0B339410AAEBA34179C5B36E07D7B1B45A175087CF12A4C69A2F637936D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_decimal.pyd
Size 247KB
SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
MD5 21c73e7e0d7dad7a1fe728e3b80ce073
SHA1 7b363af01e83c05d0ea75299b39c31d948bbfe01
SHA512 0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
SSDEEP 6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
TLSH
T19B346B57A2490CA4DE73807499979B57FBB278850320D2CF43A48AA73F577A327BD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\base_library.zip
Size 1.3MB
SHA256 6a7f9f31b0ffa25f9a9e9fb9371402df58841096d550494f40dd5a385ba6f699
MD5 694934518d0feb79a77f94d27e1bf284
SHA1 fac93a6c91ce6926c3bdda3802d5a705953255cd
SHA512 a275af12af8f7c530a53e6077e483902837efb7b5ccc39f3666a27d56d9a36ef7b54f2f42b9580cc329c4a98582f25b23b4f4e86ce4d119a5aa47ebaca436048
SSDEEP 12288:3MTttcY+bogLgCzDD97w0P6dYAw0VHtzJYTq+zYgEkA1qJuA7aYckOmgRiV0H:2ttcY+5L5i0P6dYAztJGaYckHCY0H
TLSH
T15C55D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31482\unicodedata.pyd
Size 1.1MB
SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
MD5 a1388676824ce6347d31d6c6a7a1d1b5
SHA1 27dd45a5c9b7e61bb894f13193212c6d5668085b
SHA512 26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89
SSDEEP 12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
TLSH
T1BF354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shockify_8h66ilbx.html

Path C:\Users\Admin\AppData\Local\Temp\shockify_8h66ilbx.html
Size 8KB
SHA256 e008f7e60a7c0b1632275f97d91c64d35214e79278e571b805a4ad6f980770e7
MD5 bac89b8f92b6d6dcb3e4a295e45f3b42
SHA1 7acc78c257c43be88b1ee333691031a6a877f2c3
SHA512 0f1a8a91bcd9124d7f65893d9ff37356435815c173b31f823f1f99206c17d4e9f5124462757877b3726d26afab98de8522c79658d64c8e3f9ee9bc00cef48fd7
SSDEEP 96:OI5rhGc0txR2FuFP+FLZ6Gwpkfmk2moE3dR7gf9b:OI5shtxREZ69pBkmR
TLSH
T16202543752010016A13B97B6DFE2439DFE3E9123A203DE193AED16C65FF265846A6FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads