33078df93d73b692457dabb0580183f19c15757488b38a8db7a9275e0143d00b

Analysis

user interaction
yes
max time kernel
30s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
view.html
Size 117KB
Sample260630-ndaxwadw21
SHA256 33078df93d73b692457dabb0580183f19c15757488b38a8db7a9275e0143d00b
MD5 c4fefea788b2d607a89e032e641d924e
SHA1 9d067f21262184ba17b3e84ef4572a299032ea2a
SHA512 73a2e4f198f1dedcda31e3983ebc85a63e048284816d29e5e9582796657b0ca9a4c8b00723d512cb4222598439c8027c2c89fc2faed7b0dc785ae7dbc83cff1a
SSDEEP 1536:GEVVOzQm/nAdEKnMEMBQYDjjeIRlUyjeIRlUi7f:AnpL
TLSH
T192C3726202119CFDEEF744A3208A1D563E5C1137B3A25077F3DD5DAA1B979AB022837E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	2056	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	drive.google.com
31	drive.google.com
26	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2056	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/268-260-0x0000000000FD0000-0x00000000010D0000-memory.dmp	innosetup
behavioral2/memory/268-294-0x0000000000FD0000-0x00000000010D0000-memory.dmp	innosetup
behavioral2/memory/268-353-0x0000000000FD0000-0x00000000010D0000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3392	taskkill.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{1CB8F258-16E3-43EF-ABB6-263E92DE056A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	taskmgr.exe
Token: SeSystemProfilePrivilege	5064	taskmgr.exe
Token: SeCreateGlobalPrivilege	5064	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
5064	taskmgr.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
5064	taskmgr.exe
5064	taskmgr.exe
5064	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5064	taskmgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 6080	4788	msedge.exe	88
PID 4788 wrote to memory of 5128	4788	msedge.exe	89
PID 4788 wrote to memory of 2056	4788	msedge.exe	91
PID 4788 wrote to memory of 5128	4788	msedge.exe	89
PID 4788 wrote to memory of 5128	4788	msedge.exe	89
PID 4788 wrote to memory of 5796	4788	msedge.exe	92
PID 4788 wrote to memory of 5796	4788	msedge.exe	92
PID 4788 wrote to memory of 5208	4788	msedge.exe	93
PID 4788 wrote to memory of 5208	4788	msedge.exe	93
PID 4788 wrote to memory of 5208	4788	msedge.exe	93
PID 4788 wrote to memory of 3496	4788	msedge.exe	94
PID 4788 wrote to memory of 3496	4788	msedge.exe	94
PID 4788 wrote to memory of 3496	4788	msedge.exe	94
PID 4788 wrote to memory of 2240	4788	msedge.exe	95
PID 4788 wrote to memory of 2360	4788	msedge.exe	96
PID 4788 wrote to memory of 2240	4788	msedge.exe	95
PID 4788 wrote to memory of 2240	4788	msedge.exe	95
PID 4788 wrote to memory of 2360	4788	msedge.exe	96
PID 4788 wrote to memory of 2360	4788	msedge.exe	96
PID 4788 wrote to memory of 912	4788	msedge.exe	97
PID 4788 wrote to memory of 912	4788	msedge.exe	97
PID 4788 wrote to memory of 912	4788	msedge.exe	97
PID 4788 wrote to memory of 2116	4788	msedge.exe	99
PID 4788 wrote to memory of 3276	4788	msedge.exe	100
PID 4788 wrote to memory of 2116	4788	msedge.exe	99
PID 4788 wrote to memory of 3276	4788	msedge.exe	100
PID 4788 wrote to memory of 1728	4788	msedge.exe	102
PID 4788 wrote to memory of 5260	4788	msedge.exe	106
PID 4788 wrote to memory of 5260	4788	msedge.exe	106
PID 4788 wrote to memory of 5260	4788	msedge.exe	106
PID 4788 wrote to memory of 5676	4788	msedge.exe	107
PID 4788 wrote to memory of 5676	4788	msedge.exe	107
PID 4788 wrote to memory of 5676	4788	msedge.exe	107
PID 4788 wrote to memory of 5820	4788	msedge.exe	108
PID 4788 wrote to memory of 5820	4788	msedge.exe	108
PID 4788 wrote to memory of 3404	4788	msedge.exe	109
PID 4788 wrote to memory of 3404	4788	msedge.exe	109
PID 4788 wrote to memory of 3404	4788	msedge.exe	109
PID 4788 wrote to memory of 4936	4788	msedge.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffa7878c188,0x7ffa7878c194,0x7ffa7878c1a0
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1857071103671589604,13886065411496617485,262144 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,11296679754513092050,8443491134594094046,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,908008988003728425,8116264076323695826,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,9586572389663944944,10144871963797894359,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4779356434003139077,534471107039024779,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,8024709328806667501,9203108720722334149,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12397868420365124570,18163585267233435693,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3772,i,14811807111281807443,9833992685849133984,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15223249053637892711,6837880795000520862,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5509666830080632576,3162529320676612571,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13888912150260742255,1731166438213553892,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13888912150260742255,1731166438213553892,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6780,i,11746930233830277980,11495155363040782132,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4584,i,15166620207180882426,2096053749947685582,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,17667005402283565618,2292795452284784273,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4576,i,3613653851975955686,5852754996741481904,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,15615306880824218314,15766784241684107805,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,16422451021276389312,2881948396514365426,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,16963398922814813870,13934811322832953540,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,3443419653639761706,12112450777104158188,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2804,i,2969616536003002685,3109778922128249004,2097152 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:2908
- C:\Users\Admin\Downloads\LunarPatcher_Setup_v9.exe
  "C:\Users\Admin\Downloads\LunarPatcher_Setup_v9.exe"
  2⤵
  PID:268
- - C:\Users\Admin\AppData\Local\Temp\is-3W6EJF34BM.tmp\LunarPatcher_Setup_v9.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-3W6EJF34BM.tmp\LunarPatcher_Setup_v9.tmp" /SL5="$90060,76314117,991232,C:\Users\Admin\Downloads\LunarPatcher_Setup_v9.exe"
    3⤵
    PID:3412
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM LunarPatcher.exe /T
      4⤵
      Kills process with taskkill
      PID:3392
  - - C:\Program Files\Lunar Patcher\LunarPatcher.exe
      "C:\Program Files\Lunar Patcher\LunarPatcher.exe"
      4⤵
      PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,8310215249591251845,9639831411213607940,524288 --field-trial-handle=2632,i,6004936175694981597,5593302393072916690,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5808

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Program Files\Lunar Patcher\LunarPatcher.exe
"C:\Program Files\Lunar Patcher\LunarPatcher.exe" /background
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lunar Patcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lunar Patcher.lnk
Size 927B
SHA256 6410ce2a7aaa0004329fc44f03d535f6e77bb81789e6a76bcdf75dc8fad49a05
MD5 8fb6d04e5667ebe543560b240852ba6a
SHA1 83325d7ab84443a6d21e55ab67ff69c027b88435
SHA512 e440ece342f1530baa3b742caf7bacb71be79ac8ac416b1e081ce23b3b2b44ebae6393ff0712b3847c80f6575bae84e93c64f2951c23801f24d1baf473a6ebf2
TLSH
T1B911491E17A26755F277C232A77113218733FD0BD365935D82CC01C05C782528AA4F66
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\.lunarclient\settings\game\accounts.json
Size 53B
SHA256 656967cb536e94199da44fb524374cbe48d488b0cdce9a945ac50fbc39bd34ab
MD5 0654a4dce2cd001de0c1e67db48cb81c
SHA1 dc8262ddd094989857ac5f23d608de8982e0593e
SHA512 520ebf23ccaec668c82272db2c595937061a65eee6533bdb87178d389a1d6fe23c42c70e18daea6479d13803ae83d1b3136bc1b9b0bc2f437c73c8473aeb242b
TLSH
T1BF900245060511B399A458153136118964111A4901301D5D71F3B43465494940541742
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

11e59754-c958-497f-9cb1-be6aecd8d487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11e59754-c958-497f-9cb1-be6aecd8d487.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1a303f89-ec10-4872-ba48-5204746dd499.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a303f89-ec10-4872-ba48-5204746dd499.tmp
Size 27KB
SHA256 fc0e7c941710de592f9dcd65f1a616a6b06a530846ab2881e75e8fe1f79b867d
MD5 d549018ad42f6adee0cc908606f2e6ac
SHA1 907e7c536663a928bda8de9063f4f7545324fd9a
SHA512 88b928d457356dca8fbd22c7947881b2c3574c3b311e4755d14fe1974b37a1ef868a7cd417e34750a676069e665fac131badb63c3e60e5ef82692bbe0d77a2bb
SSDEEP 768:AIox30WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOccioro5Kltc:AIox30WguMfnAu1jazXiT5KQ
TLSH
T18CC2EB3B640CCB7E4F845DACEC25BE966DD801CB97988D5447FA890C03C77EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 41c8149648a652b117d1371055bf840c4cc176c1e4fb0031f13de5e143c1be0d
MD5 890ae5d25da18eed87220df0955df6f7
SHA1 5ab5a554c9289e27caaa44e11d40136d8257fa51
SHA512 223b1a93fc83427accca4cbaad695a484a2b20bae10f00659dcd3103baa74ef23458e42bb1e6bc84033f26bbf6ea210d189dd70b1ecc30e9022125f711d887d6
TLSH
T14B715EC43C167ADEE36FF0B390D211AA37F4C2AD850B6A17D848B3B45836B9479C6934
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c6b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c6b1.TMP
Size 3KB
SHA256 7eb7b6393f905adbb43e71e7b0edaf5ae78916c49386c4b3229a2963a1fad9a0
MD5 8eec9abdb064d0f3ac9fac5d816592e0
SHA1 cbcd194130e0472577908da469ee07c5513261ea
SHA512 3276dd9aeb1554e51c601a7d18860f835e17003542ae4284c60863594591b47a80a08942ed8b620e74501ebe436d28007db2946738b146ebec5c05909e674da6
TLSH
T194613DC43C567A9DE32FF0B390D111AA37F4C2AD850B6A07D848B3B84836F5478C6935
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ccdafe75b5ab4a072de6c31f1b056b4bcc5f7ba8a82958f21f3de58ea40c71b2
MD5 d3e1202877df8b713d879a55f6d59b3b
SHA1 626d5f2c14f01d1e1758e61d17d64a4c37e7dd36
SHA512 45d20e30e0c4ad45c4936a00b908b2e6b86955e29594c67115a699d49bdeb2d2b239ed7ea3af1160ab93d5e50532d9f15842315b3e4f326793288d436cd43bd5
SSDEEP 192:DXJKsFIjMH6eahNifjholcTHv5R+zdpcN8Rj60cmYV0k:DXJKsFIjMH6eahNifSiTHv5R+zDcN8RO
TLSH
T1C2E1ACF7C7D8877E881156F0AB257E1ACD2D055A832C3C2689E4AF4F63E1471D2426AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c17b4ac3dbfa9e2e6d6f932b0f58f9138f83b8083dc0fed350762d9436196ad4
MD5 fba35e452bc027e459df7fc97515e879
SHA1 a54289b40f84bc4900ca670ab75f57605c18251a
SHA512 eabe4c587994382e98b1af9ff45df1653cbecf500a04f480f24e6cb516d6381844493d36f5448ed05ebc9e378e3301caa7653b22510a70fa2ca6754303bd1c01
SSDEEP 192:sxRPRXyM/jK1Ml8wFg/fps3DdfCr+zoA8pUnt/g6+WNIYyNJLG08IgIJ:sxRPnbg/fps3D4jy/5IZKs
TLSH
T17D52D9166A285977CCCBD20DFA557F53D6F91473A2900E48ADFC8A1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 68081cb689fd354bfe54d197eef61b30690e4f9fa3717a3d11616315f6e0ec59
MD5 b37b556260d9de99c0d99aecfe295d45
SHA1 ef9b958b7865535ed2706b5081ee4d537e2db69c
SHA512 48c5d69db755307cb596c67db3d09dd3247ddd7fc20ee7bd7c823a4ea3490cb2664f53c27c801662ee239d84ed3a0f95df344a62b11fd5061323cf39be4f5952
SSDEEP 192:sxRIRXyM/jK1Ml8wog/fpsyDdfCr+zoA8pZoM1w/g6+WNIYyGJLG08IgDyJ:sxRIxOg/fpsyD4jG/5IaKK
TLSH
T15C62D916A6345977CCCBD21DF6517F53D6F91463A2901E44AEFC8A1C02E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 67cdbcea2580e9273a4a1765961e307a4d3130e88435c858461dcde85b7156dc
MD5 fd14ce89e4746dcd9b22829eac49f7bd
SHA1 77ab229a21cd4200e7d797da0b4b9f4b796e0ae9
SHA512 76b924276337242a743b37642cf3d34a6d5b9e370783b75203b985d21039c5c851242e52933a904326017643ba08f39b65163be59e1644c1f17a76c2fe2bb6db
SSDEEP 192:sxRIRXyM/jK1Ml8wHg/fpsyDdfCr+zoA8pZoM1w/g6+WNmRh/YymVJLG08IgDyJ:sxRIxBg/fpsyD4jG/52/UPKK
TLSH
T15062D916A6345977CCCBD219FA517F53D6F91463E2904E44AEFC8A0C02E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9241ae366ff621a165d711e590029f385411b7d3fec12d5db5b88f30a9819b56
MD5 7ce93caca288059885e95e049edc90a1
SHA1 2149c62d784a0e85aabf47adb94a78a22905f0df
SHA512 145ca6bfd771f6390898a204206c1db61bac02490d3ce1a453e65c2a8f7219df59996a984d16fe7790ae7803bc0660bb91bc10cc1315076a441b7b609e7a1f50
SSDEEP 96:KHyruiQEYkoEJPOqkKGBO4kaCipQC5KEQKFaUCMKfaud:kyruiQEYFEJGqmBO4VCipQC5fE7d
TLSH
T1AA91EE51757E3700387E794D9674E81F428130A2309AB87A3BA8A5E61F27F014EFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a45f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a45f3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bf86cded52e1398993a44986d4e4e7f10cf41c6a1f1e4298ed65eefb6bc6fb5c
MD5 2507d0690f152d2e34500f96710850ec
SHA1 9f96aa32193b98f25b1b90109c487ec0366d8d56
SHA512 9b50cc276600350ae30bffb5e4bf4290d79e801d548ccdd15d371870948660d1ac125074c4d699b8d5b836fa96ac0c551e82d089318fdb53c89ee65e5a5d47c2
SSDEEP 768:Hj+9X3fYnEtQOJIh0NgahM/hUAFjQIMyOV3N5E9E3Fzn12bfk:q9X3lNchNFUIpONNmIByk
TLSH
T147F2BE72ECA59AA31CE3D2C5770A3247AFF441A786C51A84C9ED5F0D438729E135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2525611cd1cb936bfbc935634a173913b4fa8ae8a6c10ff2546fdb06d73fe279
MD5 8690b05ed73251af54fcfda6d625943b
SHA1 5fea4b9c9dabbebfacf1bf8a12ef6b6cf2c03f11
SHA512 89cf545084ddd0757386fdef22687465ba2e82f47efb25bbce6a0b9349f8073c313e2f7b84ad8ebb3e1e13153c4b3e0b4bb02160d02bf60fa40bef03edffe929
SSDEEP 768:+j+9d3fY/EtQOJIh0Ngahw/hUAFjQIMyOV3N5E9E3Fzn12bfk:99d3xNghNFUIpONNmIByk
TLSH
T1B2F2BE72ACA59BA31CE3D2C577063247AFF441A786C51A84C9ED5F0D438729D135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb65b5cf426a76d9190f67acef0a2ddd2e72443a65d57316667327cc23c49c8f
MD5 3b70fba4075cc7b8dea7fe961dc012b0
SHA1 4e9faafc119f2d61ecdaf123066e90a3092c2f4c
SHA512 e2fdadb1902c50986d693e4e2424bbd9f67c010c975a0689537df515dd9b396ba6211849e2170e25af5c5c341dbfb9cf1d4a6366c15227b0591594626f51fd1f
SSDEEP 768:Dj+9K3SYzEtQOJIh0Ngahw/hUAFjQIMyOV3N5E9E3Fzn12bfk:G9K3GNghNFUIpONNmIByk
TLSH
T1F7F2BE72ACA59BA35CE3D2C5770A3247AFF441A786C51A84C9ED5F0D038729D135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0a9b64d9636ecace6c2551bcae8733f045379d5018d8cd24e797edafa7ebd44c
MD5 8bdf5dfd12cfabbcc588af6b065fa8a0
SHA1 a81f6bc3cbcd7bf6793a223f0f8ac893e39499cb
SHA512 cb3623700044ccda7e8cb03fc8e2f15ba9081137da1f8c7b26333e633c1d35d09fc0f3b7a53b0da54f1c372eb12c3a2a581f04e14fca6254d84573bbb236fffd
SSDEEP 768:drv+4UNbdI3fYyiQOJIh0Ngahe/hUAFjQIMyOV3N5E9E3Fzn12bf2:dbsb63WNChNFUIpONNmIBy2
TLSH
T18C13BE32F868DAA35DE7D2C5B20A72437FB401A786C50A84C9EE5B4D438B1DE135BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8a034cbe8a4dbff657dd832a8f28367a63dfa924b4b216e9195fedf739dd746
MD5 ade035d0ecf26a6b202e45a09eeadd70
SHA1 1ed3d0161a4029d9e57947ba8b1761ff9d52dbc3
SHA512 64bb69316b9123d53ce6de821c9fbd805db39e704de82b1eb77ba4e834d542fe48c5c4cb74eab236290129a435a9950b7ad0258d12a7de794afdfe7586b2e55d
SSDEEP 768:1j+9k3SYhEtQOJIh0Ngahs/hUAFjQIMyOV3N5E9E3Fzn12bfk:A9k34N8hNFUIpONNmIByk
TLSH
T159F2BE72ACA59AA31CE7D2C5770A3247AFF441A786C51A84CAED5F0D038729D135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4c6e3d4cae4792fdf2972ef60eb440a825823b2bc6de5267b59be9294fc67aee
MD5 a938a859be209aab52d9a06b41041c41
SHA1 6cc7a892e3864736e1275de0a17279cb3106e79f
SHA512 bdc8d4ddfcb018cf1c4fce91283523b66a4a5dc145c04e7ee6697dbc461b487fb19f0a9bf2d2eea897c6bcfa57ecd291b4305e6d94db2e1e3b50f32cce097852
SSDEEP 768:kj+9Z3SY0EtQOJIh0Ngahs/hUAFjQIMyOV3N5E9E3Fzn12bfk:z9Z3VN8hNFUIpONNmIByk
TLSH
T1A9F2BE72ACA59BA31CE7D2C577063247AFF441A786C51A84CAED5F0E038729D135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 985ee8a4ccbdb1685c360c02ec36b58b2ab4560ba3c7a22cecc18cb437edce54
MD5 8e946ef793f35ac8ea4cb831a988e219
SHA1 74af8889a828644f7f764e0b0aed1fa5f4e4eef9
SHA512 815a16390f6ba661ab327ad38e1f40efb52a1e3b1230ea5cd3a5cf823577a0480361aeb6d7d2f190e946ba7397c475d81ad0ea5a80e746fc20be9fd3124182eb
SSDEEP 768:9rv+4UNbdF3OpsQOJIh0NgZ/hUAFjQIMyOV3N5E9M6o+8r0mL:9bsbf31NYhNFUIpONNmUDrv
TLSH
T16E03BF32A8A4DAB39CE7E7C5760A72537FF441A755C10B84C9EE2B0D824B1DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d9187a869133b2af94b5cb71f9e669df382564e5b52649a3ad54d65e970b58ac
MD5 ecefa22d5f7bbe5baa232d54e818e1f5
SHA1 f139f584a5abbe055ce80978d9b768e03030f9be
SHA512 fc007bfd86420bdd39d0254a7e9251e59423a1fc20c414e4cf27460c7aa9034659fcb8526b6e8fbd11742a3919a5f0863b3adb7d14961aef8efe44cde9c121c1
SSDEEP 768:1F7j+9K3nwg6YXEtQOJIh0NgahY/hUAFjQIMyOV3N5E9E3Fzn12bfk:y9K3wNohNFUIpONNmIByk
TLSH
T1F4136BF298D78676DC9E8787673D2E02AEBCC0A3B5805940B7D9590DCE472BFC246C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89957f4a-28e9-4ae1-b528-561ca6b18ea2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89957f4a-28e9-4ae1-b528-561ca6b18ea2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\MfMNQN1rjsWn\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
MD5 20d9ebd5020c322365d11bfe49740609
SHA1 0c4248028be99dd04c48428537d98c19b20f12fb
SHA512 05c98a4ae88e305ca02c961526fb7a947036a197ab8d564fa9f530325192233b1285dd3880467db89f3f8a77b84f674c6c1716ad8e62b7b74a4db32d599578b4
SSDEEP 49152:y6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3h/d:yUdeqt737jFmRtF
TLSH
T177268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\MfMNQN1rjsWn\PresentationNative_cor3.dll
Size 1.2MB
SHA256 0002f81ee5c803cb90329f2ab08556fd6de29d1ddd6d83446d1d4c19748f25e8
MD5 5abba52442f893f51903867a984309a8
SHA1 935e25fd68702de5b41ffdbd89be7c74e0a35d98
SHA512 63791cb693e4abda219c6f0df951c3b91e8dbc19bf2fb2caec091fa62bca8d91044cba77979e9a690138354676e7cea1a3a320b38b06ab0366d6830092455a99
SSDEEP 24576:agaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPnFR:rnR+g8lYP00OM8zT3GbNUdvoxWZBlIue
TLSH
T163453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\MfMNQN1rjsWn\vcruntime140_cor3.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\MfMNQN1rjsWn\wpfgfx_cor3.dll
Size 1.9MB
SHA256 905625129daab0f6dee6c6d2e95beb47f24590b8d9022392fa4440e9d2957402
MD5 76bb2f5f63ae6f99b58a1a5f0bfbc38e
SHA1 7362d1303d3ae8dd93deeea2e4a43f1894e0d36b
SHA512 705a01621a614656fa8d1013d5413c2044a0e14ca4b912bc6ab7f9133d6447e08d3a633fc727d5adb9ec56efb3dd328f1cc476c38d41c7e1777dd8b7622f390d
SSDEEP 24576:6Iq/d8FBpNk3uQA2F6QB8jObZ7qtiFAdW8SRPTi2A6qTy5IvsEm5b6pSLdZ+c:r3s+QA2SObh9aWd9maqTy5ksEe+c
TLSH
T108954A46B6EC40E9D47AE23CDAD7861BF27178102761A7CF23A0479D6F27BD0097A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LunarPatcher_Setup_v9.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3W6EJF34BM.tmp\LunarPatcher_Setup_v9.tmp
Size 4.3MB
SHA256 d472aa68730d35e17770f1be18d55ff253d2e66a7709b3f18db780b0311a408a
MD5 42c515e6ce1f8de5cecb1bf7396befc0
SHA1 72a6dc52a25834c608017bd8bcb0df15398a3ccc
SHA512 4858dfa595dfe09e05bd60277bd043321d53ee69d50b373fa0efa739b6becbdd919a0240355becd2340521c7e651c82c4a80f61ca1f6bb32cd475efe8c9e2478
SSDEEP 98304:LlUAbauOajmH8wRY/kFmEU6jmhO+Jr3333G:bOunjmc2FrSy
TLSH
T120267E03B388753EE4671E3A483FA684983F7E213A25CD4B6BF4195C8F3A5416D2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lunar Patcher.lnk

Path C:\Users\Public\Desktop\Lunar Patcher.lnk
Size 915B
SHA256 7103aaf4b96f5a4e4f5cc0f0b9ee69507b139a6e6ca7ff01622972909a7cba29
MD5 0abcb7ec80fcdb672b09c9467ce728d7
SHA1 d8f4f2ea6972e3eb1848421953d943368a9bbb64
SHA512 89215d99836e84448c0a5b8e4ed5097e25c5e2ff5504c793a9ec0b77445ca85f6fd2fba227da1241ff0cfd21354701643df15d6cc5e790df7b2f5f0c29890cd0
TLSH
T18211681E1BE26395F277C232AB3023214733FD0AD365835D82CD01805C782528AE4B6A
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 15c8a22d668203cdadec823b98ba7d96a91fe5e6f5a3df6907250e051573fecb
MD5 112a6ded121ee3404dafa048b10cb34c
SHA1 1ad8a1cae10bd3026fbf517835f25b65cb35d3c7
SHA512 6fdd663203e7fb435ee95d7253a2bad96e44457790e19a9589f86e2318b6775777ed41a992bc1cc6b0aa98b6694a04458faf9b8bcac926d3e341b0c878ca3299
TLSH
T116317A354A4558AD22B347A08428B46BE23BD0FA0DA7F5A5794DC20E3B7090EA3B7349
MD5 SHA1 SHA512 TLSH

Submit Download

memory/268-353-0x0000000000FD0000-0x00000000010D0000-memory.dmp

Download

memory/268-294-0x0000000000FD0000-0x00000000010D0000-memory.dmp

Download

memory/268-260-0x0000000000FD0000-0x00000000010D0000-memory.dmp

Download

memory/3412-352-0x00000000006D0000-0x0000000000B2B000-memory.dmp

Download

memory/3412-349-0x00000000006D0000-0x0000000000B2B000-memory.dmp

Download

memory/3412-295-0x00000000006D0000-0x0000000000B2B000-memory.dmp

Download

memory/3816-346-0x0000014498460000-0x000001449DF70000-memory.dmp

Download

memory/5064-196-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-197-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-199-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-200-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-198-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-189-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-195-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download

memory/5064-191-0x000001D5C16B0000-0x000001D5C16B1000-memory.dmp

Download