a2960f3b331a815ce788e1d5e8a736f36174f7cffafac77c82bc89466439011f

Analysis

user interaction
yes
max time kernel
61s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260708-2m9dpabs2s
SHA256 a2960f3b331a815ce788e1d5e8a736f36174f7cffafac77c82bc89466439011f
MD5 9cacb9c9939d26b976040277b7093d0b
SHA1 7dfad43d16ec5f429b3d70c2790cd47929fcc0f9
SHA512 95ff2e774f7170d525872c6335d166ce1cb114ea2b75348c6c1d9def93cf245effc113141a92b0a4519d7f5db6741f0816e022639e2c6154eab2de11b26364bc
SSDEEP 3072:GYFgAkHnjzxQ6KSAiTyHE88aW+LN7jxRLlzglKXf2HDbk:7gAkHnjzxQBSADk88CN7DBXf2HHk
TLSH
T124643C26E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5D5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
140	4484	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac imgui server crasher.exe	ac imgui server crasher.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac imgui server crasher.exe	ac imgui server crasher.exe

Executes dropped EXE 4 IoCs

pid	Process
3284	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
4360	ac imgui server crasher.exe
5236	ac imgui server crasher.exe

Loads dropped DLL 64 IoCs

pid	Process
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
201	discord.com
203	discord.com
200	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280242074633931"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{96CA956C-8243-499B-8EA8-909464CF7A3C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
3540	ac imgui server crasher.exe
5236	ac imgui server crasher.exe
5236	ac imgui server crasher.exe
5236	ac imgui server crasher.exe
5236	ac imgui server crasher.exe
5236	ac imgui server crasher.exe
5236	ac imgui server crasher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	ac imgui server crasher.exe
Token: SeIncreaseQuotaPrivilege	3980	WMIC.exe
Token: SeSecurityPrivilege	3980	WMIC.exe
Token: SeTakeOwnershipPrivilege	3980	WMIC.exe
Token: SeLoadDriverPrivilege	3980	WMIC.exe
Token: SeSystemProfilePrivilege	3980	WMIC.exe
Token: SeSystemtimePrivilege	3980	WMIC.exe
Token: SeProfSingleProcessPrivilege	3980	WMIC.exe
Token: SeIncBasePriorityPrivilege	3980	WMIC.exe
Token: SeCreatePagefilePrivilege	3980	WMIC.exe
Token: SeBackupPrivilege	3980	WMIC.exe
Token: SeRestorePrivilege	3980	WMIC.exe
Token: SeShutdownPrivilege	3980	WMIC.exe
Token: SeDebugPrivilege	3980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3980	WMIC.exe
Token: SeRemoteShutdownPrivilege	3980	WMIC.exe
Token: SeUndockPrivilege	3980	WMIC.exe
Token: SeManageVolumePrivilege	3980	WMIC.exe
Token: 33	3980	WMIC.exe
Token: 34	3980	WMIC.exe
Token: 35	3980	WMIC.exe
Token: 36	3980	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3980	WMIC.exe
Token: SeSecurityPrivilege	3980	WMIC.exe
Token: SeTakeOwnershipPrivilege	3980	WMIC.exe
Token: SeLoadDriverPrivilege	3980	WMIC.exe
Token: SeSystemProfilePrivilege	3980	WMIC.exe
Token: SeSystemtimePrivilege	3980	WMIC.exe
Token: SeProfSingleProcessPrivilege	3980	WMIC.exe
Token: SeIncBasePriorityPrivilege	3980	WMIC.exe
Token: SeCreatePagefilePrivilege	3980	WMIC.exe
Token: SeBackupPrivilege	3980	WMIC.exe
Token: SeRestorePrivilege	3980	WMIC.exe
Token: SeShutdownPrivilege	3980	WMIC.exe
Token: SeDebugPrivilege	3980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3980	WMIC.exe
Token: SeRemoteShutdownPrivilege	3980	WMIC.exe
Token: SeUndockPrivilege	3980	WMIC.exe
Token: SeManageVolumePrivilege	3980	WMIC.exe
Token: 33	3980	WMIC.exe
Token: 34	3980	WMIC.exe
Token: 35	3980	WMIC.exe
Token: 36	3980	WMIC.exe
Token: SeDebugPrivilege	5236	ac imgui server crasher.exe
Token: SeIncreaseQuotaPrivilege	5348	WMIC.exe
Token: SeSecurityPrivilege	5348	WMIC.exe
Token: SeTakeOwnershipPrivilege	5348	WMIC.exe
Token: SeLoadDriverPrivilege	5348	WMIC.exe
Token: SeSystemProfilePrivilege	5348	WMIC.exe
Token: SeSystemtimePrivilege	5348	WMIC.exe
Token: SeProfSingleProcessPrivilege	5348	WMIC.exe
Token: SeIncBasePriorityPrivilege	5348	WMIC.exe
Token: SeCreatePagefilePrivilege	5348	WMIC.exe
Token: SeBackupPrivilege	5348	WMIC.exe
Token: SeRestorePrivilege	5348	WMIC.exe
Token: SeShutdownPrivilege	5348	WMIC.exe
Token: SeDebugPrivilege	5348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5348	WMIC.exe
Token: SeRemoteShutdownPrivilege	5348	WMIC.exe
Token: SeUndockPrivilege	5348	WMIC.exe
Token: SeManageVolumePrivilege	5348	WMIC.exe
Token: 33	5348	WMIC.exe
Token: 34	5348	WMIC.exe
Token: 35	5348	WMIC.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1508	4448	msedge.exe	85
PID 4448 wrote to memory of 4484	4448	msedge.exe	86
PID 4448 wrote to memory of 5024	4448	msedge.exe	87
PID 4448 wrote to memory of 5024	4448	msedge.exe	87
PID 4448 wrote to memory of 5024	4448	msedge.exe	87
PID 4448 wrote to memory of 2420	4448	msedge.exe	89
PID 4448 wrote to memory of 2420	4448	msedge.exe	89
PID 4448 wrote to memory of 368	4448	msedge.exe	91
PID 4448 wrote to memory of 2800	4448	msedge.exe	90
PID 4448 wrote to memory of 368	4448	msedge.exe	91
PID 4448 wrote to memory of 368	4448	msedge.exe	91
PID 4448 wrote to memory of 2800	4448	msedge.exe	90
PID 4448 wrote to memory of 2800	4448	msedge.exe	90
PID 4448 wrote to memory of 2512	4448	msedge.exe	92
PID 4448 wrote to memory of 5072	4448	msedge.exe	93
PID 4448 wrote to memory of 2512	4448	msedge.exe	92
PID 4448 wrote to memory of 2512	4448	msedge.exe	92
PID 4448 wrote to memory of 5072	4448	msedge.exe	93
PID 4448 wrote to memory of 5072	4448	msedge.exe	93
PID 4448 wrote to memory of 4388	4448	msedge.exe	96
PID 4448 wrote to memory of 4388	4448	msedge.exe	96
PID 4448 wrote to memory of 4388	4448	msedge.exe	96
PID 4448 wrote to memory of 4908	4448	msedge.exe	98
PID 4448 wrote to memory of 4908	4448	msedge.exe	98
PID 4448 wrote to memory of 4908	4448	msedge.exe	98
PID 4448 wrote to memory of 4612	4448	msedge.exe	99
PID 4448 wrote to memory of 4612	4448	msedge.exe	99
PID 4448 wrote to memory of 2112	4448	msedge.exe	100
PID 4448 wrote to memory of 2112	4448	msedge.exe	100
PID 4448 wrote to memory of 756	4448	msedge.exe	101
PID 4448 wrote to memory of 756	4448	msedge.exe	101
PID 4448 wrote to memory of 756	4448	msedge.exe	101
PID 4448 wrote to memory of 1984	4448	msedge.exe	102
PID 4448 wrote to memory of 1984	4448	msedge.exe	102
PID 4448 wrote to memory of 1984	4448	msedge.exe	102
PID 4448 wrote to memory of 2200	4448	msedge.exe	105
PID 4448 wrote to memory of 2488	4448	msedge.exe	106
PID 4448 wrote to memory of 3968	4448	msedge.exe	107
PID 4448 wrote to memory of 2488	4448	msedge.exe	106
PID 4448 wrote to memory of 3968	4448	msedge.exe	107
PID 4448 wrote to memory of 3968	4448	msedge.exe	107
PID 4448 wrote to memory of 3512	4448	msedge.exe	108
PID 4448 wrote to memory of 3512	4448	msedge.exe	108
PID 4448 wrote to memory of 3512	4448	msedge.exe	108
PID 4448 wrote to memory of 4460	4448	msedge.exe	109
PID 4448 wrote to memory of 2936	4448	msedge.exe	110
PID 4448 wrote to memory of 2936	4448	msedge.exe	110
PID 4448 wrote to memory of 2936	4448	msedge.exe	110
PID 4448 wrote to memory of 3980	4448	msedge.exe	111
PID 4448 wrote to memory of 3980	4448	msedge.exe	111
PID 4448 wrote to memory of 3284	4448	msedge.exe	112
PID 3284 wrote to memory of 3540	3284	ac imgui server crasher.exe	114
PID 4448 wrote to memory of 3796	4448	msedge.exe	120
PID 4448 wrote to memory of 2592	4448	msedge.exe	121
PID 4448 wrote to memory of 4440	4448	msedge.exe	122
PID 3540 wrote to memory of 3988	3540	ac imgui server crasher.exe	123
PID 3988 wrote to memory of 3980	3988	cmd.exe	125
PID 4360 wrote to memory of 5236	4360	ac imgui server crasher.exe	131
PID 5236 wrote to memory of 5268	5236	ac imgui server crasher.exe	132
PID 5268 wrote to memory of 5348	5268	cmd.exe	134
PID 4448 wrote to memory of 5640	4448	msedge.exe	136
PID 4448 wrote to memory of 5640	4448	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8bdaac188,0x7ff8bdaac194,0x7ff8bdaac1a0
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,6147290525989094174,803420622061433586,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12576517011949901320,7588355384791982015,262144 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,3947547717828093056,2429351555724132437,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18385142150883233936,13080691832359668062,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10438654945597257376,2950865303290133526,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14246609431624366981,13157016882371529740,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,2799438948745640399,24521032035300072,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3704,i,14724151434173282232,11615430814529074972,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4996,i,2645397458325083369,6458248220460886810,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15666471879438007084,2553506406580112886,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,396129981534129066,6972525151247589396,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6260,i,8097648577649331024,2073219534167149227,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6300,i,420870569059105572,5996803770866060169,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,6603841479548961677,2304658134835337705,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,6603841479548961677,2304658134835337705,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,5499257987942425429,8909249074031197106,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6764,i,17363679416749194983,4119310804841828909,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7136,i,13726920806045406756,15280062059255616972,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,1033236881094099344,10555498854320527322,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7472,i,11872955825503429335,3389464263602627210,2097152 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,5508617144095290600,14061374005018484087,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:3980
- C:\Users\Admin\Downloads\ac imgui server crasher.exe
  "C:\Users\Admin\Downloads\ac imgui server crasher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\Downloads\ac imgui server crasher.exe
    "C:\Users\Admin\Downloads\ac imgui server crasher.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,10980492479957657113,1666253972932639738,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,252425221787853730,5512319076318532027,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,1786770591648682727,17425069036288279521,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,93172602144707369,1577230210978524197,524288 --field-trial-handle=2348,i,9900402900898338141,13864633164195469397,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:732

C:\Users\Admin\Downloads\ac imgui server crasher.exe
"C:\Users\Admin\Downloads\ac imgui server crasher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\Downloads\ac imgui server crasher.exe
  "C:\Users\Admin\Downloads\ac imgui server crasher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 844ae3427d65d0118558fd78bcf16af6dcde644e70269131582fa869e189f9eb
MD5 8f6efa399c73cb488b4f64d48ab22793
SHA1 25d98b8b3dbdae40cbc51015a3693f7a3a2772bc
SHA512 07a8ade88bd99425ac062c4c997e40a89eb062cf57388e7841c7fc8a023739ba5e1eb7bbca8b1295bfd4fad9a5f6b362cc32e057631f08b066dedf276c5f6f73
TLSH
T15DD080107935A5D5E255007D54509601511C9B9726635315F210880DAD3745157C15C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 50d4c031f4ac26391529fd56bf2a3f3380e7bff4ca04f3aefe1bafe20be66346
MD5 248aed5d87ccb3ac63511281ce081868
SHA1 d6456f8583b114daba97d7bf52b59d4a723f0a26
SHA512 dfb3defab9ae3f4cc152a0eacc4436d51deb154bdbde7d3671734d60035f40d9edb059228650ab1131252fddf9d19fc4cc6fbf5cfbf4cd3d8c326b89706e8ec5
TLSH
T1FC717F378A92C463FB6602B2D8C306DD75BF84DCF5178E9E1113557D7B18B69C129780
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5871a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5871a1.TMP
Size 3KB
SHA256 0cf41b69ad672c6a4b8bc7ba2b6696c0d56bb4b8e9636f9cff959b8e27a24949
MD5 f73455b22e546021f50f204737c9570a
SHA1 fc1ff91c29e033d8792b55359dc733dbdd7c926c
SHA512 318be1059df15b853666d88cc3f51fdfb561c5b70b346a7ace3b2c95ba28c5358c4c809d9e6228b40e9dc62ef7cfa0cbd1c5ae4f0fd00891bc5ef6a29712be24
TLSH
T10D615E378A51C463FB6601B2D8D301EA747F89ECF4175E8D1117157D7718B69C228784
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3d6952f1d6a71b106ba0a68a9a4a238a025cbccd095998fc39a692fad20eb96d
MD5 7a99e997f3a9d9ddd654077fcd8d4b56
SHA1 4cbc7728d0baf849a4e417f59f75713fa73c4bbf
SHA512 b41a1df69165ad6300d7f45523976451217f6240106aa7bf3bee71ac3e1c04be5b032cca60760a0abeb5caa6e3e0de63087b4bfc78fa024ac9cc8762b1fe3504
SSDEEP 192:sxZXRWyM/jK1Ml8Mf6z/fz6s8TNMEdpVHSgy2HW6+WNuSYCkSrb2IgrJ:sxZXc36z/f2s8JzFHbtXC9
TLSH
T15252E812A634597B8DCBD209F9517B53D6F91472A2941D54EEFCCA0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d64ca61cfa46883225c874ef6e2c611096a6b3b1cbc2e559b6cb8c01d4b0455
MD5 f6d8a70483a13f54c2e1c3907a550ea5
SHA1 ffa110347f16032c88f94c66dc1ea7c4c5b28a4b
SHA512 7b13aa05c9a7690fa055bc388b0d6edcfce0c528a4195d558bc23d9dce1c93146d380635b281f01cc4d83065a33d3c449b8286b44ce493c5c8b33958dae9ca26
SSDEEP 192:sxZXRWyM/jK1Ml8Mez/fz6sSTNMIdpVHSgy2HW6+WNupJIYCk0rb2Ig5aJ:sxZXcWz/f2sSJVFHbllCE
TLSH
T1FC52C812A638597BCCDBD219F951BB93D6F9147292941D44AEFCCA0C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0894d0c38af5fc34f3948cedc1aa2693f96754198e35847acb9ddeecd6e047d7
MD5 5ea262268d3ce515c7b07bf6a4c2f028
SHA1 909e6f1b0a3dfabaa7298ddadfe47d8ea3fb5273
SHA512 831f7a6f285f9297f9bc22cb7bb755a6bcab29f651860335e68cddab7918b0237ff706ccf91a3b7cdd33dcee5b382aa41c86f836b0605f8f0c7ff26e4f051716
SSDEEP 768:9+8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVOroCs:9+8bqn+WvSCt6u1jaCZLbWVFh
TLSH
T1D3D20B3B280CCB7E4F845E5DEC266F966DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ccd9471-1f4e-4760-93f8-61c25dd2753f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ccd9471-1f4e-4760-93f8-61c25dd2753f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8f94fa3d838a6df587f2b7794117edd254e3edfbf961547a6aa5cf676bedf6b
MD5 23912f3329c8f72f44d0ba2bc3ac93d6
SHA1 332ca5b89a71599dc95da9a5ff69752923edae0e
SHA512 a7fb21def876dd70611400ead32591c0b890f6027aa0448b4b6ac4831a2761bc89875c0f0088335778669c1d78cecdca9f530632b53ca1f6ac67e8aa160e2624
SSDEEP 192:kONm6DbTQmiUyg1cBa+jN+FdChHtFKNzKCrqRU6:kONm6tVcBa+edyj+KxU6
TLSH
T16D12193668786C6B9DD27854F88736139EE55127DA8A7B81E6DC5F0C00EBA5C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ba00754465f39c6e8a6cce6747e063e67a830ed7f3807f8b816f0dc7f0d04ffa
MD5 74a262753e5c5338938fe2e608312d03
SHA1 714c67ecdf0402d2b81da163bfeb6fb92896b0f8
SHA512 22a405f983a54f010e49451287624afc234589449879e57c79e3f73f69633a8b26d361b5eb2274928cdfeabe289b940590e57990b728113882b7d1b2ae6e922f
SSDEEP 384:/tNn/s3n9SgsNbIppdGqEa+edyjWKxScjmwU:/j+9zgBa306m1jg
TLSH
T106928D336C785C6A99D25459F84736179FB450B38AC92F81DAECAF0D01DA6AC1307D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2018fa40c22796c77ac803d320f91f8aba22257fb7229a8cf1321ed862080b2c
MD5 ec33d26ff52cc4d4ddb2d16a6d37f40d
SHA1 9de7c2bea1ba9592cc8b089f24189c941ee3c1e1
SHA512 ad3f836baf27b52084905288ce566b77ba3ce80b2d905aefbcc5f5f4a23e6f6aa4b45677363d16d2d3629213542ca9c8eebfa2f749371357f02bfa8fa6556eb4
SSDEEP 96:EqONkiQsjpf1bxX5ih/cIPURHl8h4otop5CnDLBfPgvE5BzatIRdy+0Uf+FdCaCd:vONu6Db6QmiUym1HBa+jN+FdCtRgKpU6
TLSH
T1BF02E83568786CBB9AE26D49F48737275FE4203BD99A2B54DADC5F0C00D7A5C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 109c0de2aa8a9ef8c29c963a660f15a3609d06ae3ae283af0dcc3d490671212b
MD5 73fb07b8ed405c77d55d9ebc25d69408
SHA1 f59d97faa7d0c3c6b2bc728b2ccb60b9c0f90d5c
SHA512 2d4ecb4dd13d820b3945134366b7db4d9f2d5db22e701e8bf8ab9ac7288257bd22b3aab71b96af0ae260ff5f14eb7b785620009d834276b49669975e16651962
SSDEEP 192:uPdsNbsQSpebilIQmiU1lwj2Ea+jN+FdChHtFqamKCrqRTO1a1:esNbsppSUqEa+edyjKKxi1a1
TLSH
T11E423B36687C5C7B69D76544F84736135FB890679AC92F90D6EC9F0C00DEAAC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bcbb3cec05c312666d7f26629ea3d25b6cfb60221046e3177d04d88e7be07d8c
MD5 ada99e88a84b232aa2491d1ce4a1632a
SHA1 f5f946693b5587e2401e379b1b253b21d799bd7a
SHA512 d721831e93f021fa20851a9adbd24edb7347b76cfd755728b062e8723401b0a0913dab87eb2d822af39389a6ce033815b9dcb64d9b77d922f70ce891310ac54b
SSDEEP 384:otNn/s3n9SBsNbhppdGqEa+edyjWKxScjmwU:oj+9idBa306m1jg
TLSH
T18D928D336C795C6799D25459F84736179FB450B38ACA2F81DAECAF0D00DAAAC1307D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d380d1b-d63d-4067-9075-750d9ccde3d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d380d1b-d63d-4067-9075-750d9ccde3d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44c2206764fd3fd86e9a129f6b148272b7c49093f7f4bccf29a50031e649188d
MD5 ff016504eb6f1f97b3fc9d4a05fda8d1
SHA1 37cb5ae0e9c5a70039e2d3429ad2f56896532211
SHA512 b1cd21a4db361d6cbe88123eb7804c0bde9f90d4ee74b810225f5f5077d359b77e401584dd3b021188220d355604a8bfec4fb67aebf87e527b40eeb5d6cad128
TLSH
T164412769AAF91148B3B37E5AABF6696D447FB9372F0AD49D00110D4F0A23B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 d8e5d71e4dd5318d9b8d9783fdc0b0475c9ce35d2187aa862b06e788607b40f5
MD5 d7fc662cd0c4202e4fd86345905dd0ef
SHA1 03da52ed61b881a627f574162e5db5e15a1dd0be
SHA512 0a5682860875fa09e2f9854ae7bb545b696f7054e9b08023705bf39cc8c2c0567a184045adeb8d66cdf0e2e57c7e6b5cd9fce255ff0d847b7bb302c789c61051
SSDEEP 192:5FOhexWChWnWwW6BHnhWgN7aIWvhAIs/zp9JHX01k9z3AtZKYq2:5FpWChW/HRN7aCFbR9zL/2
TLSH
T1ADA239D7CEE85903E9669CB003EDC9437C3C6B921950A15926D9F6092CB37D6EF2432D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 b69e50cee33d9a77b3aa18756f25011608515d2db534b709f5c4f7cd201a2b4f
MD5 400e13af823cd12b784de84dc2cf98d6
SHA1 288d6493f3ff76dfbf00970f17c22eb72c8a29ba
SHA512 2b572dfc521871d35898482da3c59b912e3fa55a71b62a0d445e2524512bb4be50e0cd3dbf10488b0845b17c07c5b8cebc6defc3be1dcb11e47e87d2827228d8
SSDEEP 192:2xWChWV0WnhK+6SQaHnhWgN7agWbU9NBJYh5wE3X01k9z3AkSkANya:IWChWL1+aHRN7UU9xDE3R9zzSD
TLSH
T15CA23AD38AAC8087FCA75D7052E9EE533D3D27D71A50905A1694F95828937C1EF2433D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 be8a2ab362a8d76c521006ec98603ce949e0503542a851ba07b78623447f25c4
MD5 b5a53af6270fa2882cb6be1345660042
SHA1 bbafdcac54c477eb15165bb1cad321f688cbf431
SHA512 5b0e92fce294746c540938709d52b025a19f4f862d7a881e072516c59e6f9f78206d2a1ce3b1f252000dcc57bb643cf4f8cc9d33ee6050537c3ff2cf12b20cbc
SSDEEP 192:8xWChW4WwW6BHnhWgN7awWXqCfybV46X01k9z3Am7gOnuCwAYhn1:CWChWiHRN7WqC6FR9zt0OC
TLSH
T132A24BA686EC514BED9B9C7012ECC9133C3C67E76910819A1798F5581CA37C6EB3473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 176d926f10e695df692cb7691cff4d282f4e0b1d54babaa15c187fd8550fbce5
MD5 4ca6266e84c330ffa8484ef783b92eae
SHA1 4f8c180e91e1b8d7f063380e702ffa536290a9ff
SHA512 c86eec8de48038cb47c87f834baadce9d124037de630db6671f7acf9f7032d46cea89cddea28672ba2a63ea2e93b2a2ce5064d985bf754fa8e0a9c3aaf95ece4
SSDEEP 192:9zmxD3T4qBxWChWdWnhK+6SQaHnhWgN7acWZakATNceKyX01k9z3AUa9/:9zQZWChWW1+aHRN7uVAUyR9zVa9
TLSH
T1F5A23AD28ABC8147FCEB6DB002A8ED037C3D67D61A50A15A0688F65828537C1FF3472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 b07cddbf020a3abc7b5622cfae1739107b107f95f2398020fa48941e4dc06a9f
MD5 596f93b3c915160e1a0d1c748562d4a1
SHA1 fbd7b6a2fce19b615a53925d38282f2374aeb211
SHA512 04937aacaa5f33c1d81082483c740c92bd74c73db4556238c7fcfa58d444042c9efe6235bec6672c048f54eb92577acf835786a521f98cba2129db99f29e9eb8
SSDEEP 192:mxWChWmWnhK+6SQaHnhWgN7agWyiUfbU9NBJYh5wE3X01k9z3AkSkABS:YWChWL1+aHRN75BfbU9xDE3R9zzS0
TLSH
T158A23AD29AAC408BFC979D7042E8EE573C3E6BD62D10905E0694F59829933C1EB2573E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 e016e820ad547d72dc5bfbe99135912a37b557528e3b6ee3a325c281ccb87e9d
MD5 fe35202be1c3d5610cb89a195cccaf5b
SHA1 29e95f18e730065d0ab70cc9540c3c729b6a6e0c
SHA512 bd5212776637c2ae9c4856533b77d86b965ffbd2dccf2fd3204316be3ab9df40f572362d916a88e98799ae31034301d2583243c67f5d42adbb628897991e1ca9
SSDEEP 192:5aNYPvVX8rFTswxWChWQWnhK+6SQaHnhWgN7acWcfs+lKX01k9z3ARiCHT:PPvVXgWChW91+aHRN7XfdlKR9zmdH
TLSH
T1A9C21B97D9A4F29FFC8F9E3111A6D9432C3953860410908A0BC4E76C3DF7386E7A8668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 73046a2a9cbfda9b5a7a4ad783901a760a5348d303b3ff08cac7f2c0aaf3399f
MD5 abfeae561fac9b3686b34b419760cdb4
SHA1 17de9d0fbd9038190068900bf3ce9b75955acaff
SHA512 a2fcbd68126810ec730127bca4ca7d1a63a60439a631314e3411ea69546e8b247603c0260857843afba2d4dd33fd2b3b674d802105c67497b571d7944fca9ef1
SSDEEP 192:i1GYxWChWo8WnhK+6SQaHnhWgN7agWP7ATNceKyX01k9z3AUaOHT:iAWWChWoZ1+aHRN7OAUyR9zVaOHT
TLSH
T1D7A22AD28A6C8543FCAB69B042F8E9173C3C6BE71940A56A0698F58C2D537C1FF34729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-file-l2-1-0.dll
Size 22KB
SHA256 4f5036c0d64f45fffcc940b2ea037c1dfe90b3b003fe0ba86641b90b086c7999
MD5 3f26042e2e711312fd83925722894cfb
SHA1 9af15b3418e9844fa91afbe957c497aaef3caa04
SHA512 55682f20db09d388e66ae66cec3492e651fd11c94c7353082ead7b43247984a127a564d46788b28fe2368775452341c2ae76ffcebb63c9a628cf3fd6261ec4e9
SSDEEP 192:UFxWChW2YWnhK+6SQaHnhWgN7agWouthuFwleX01k9z3AfXwl/:UDWChW2F1+aHRN7DuUwleR9zK+/
TLSH
T1E9A23AE6C66C9183FC9B9DB052A8DE077D3D67D21940916A0A90F6082DA33C1EF3576D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 db018e846b61ecd106377a70c1641fcebe360e54d570c4b0033960dbf7a96aa9
MD5 9e592693b0c1adee0e6c70fcdad3f870
SHA1 863fc85ee73f00f7b8d6e788ad9baca1ee0bf48b
SHA512 c55e324c67ce484fd8e42502f1987f897ffc098ecc33b29203408ff2e6b4abf335eb5a55c6e2bbea8ab750a1f842ab7fdf3c9c346225b54f610953b6dcb4e6fe
SSDEEP 192:+5xWChWwLWwW6BHnhWgN7aIW2iLpA1wki+X01k9z3Al3WlOPl:+PWChWwDHRN73aki+R9zg3Wlul
TLSH
T103A24CDAC6AC5247ED9B9D7002E8CA137C3D77CB1960819E1691F6481C977C9AB3073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 885f2912db662ab5522e34ae29d3c07fba5495913f0dc48053cf03d9445b81b3
MD5 7778315b168b98445f4762a24825f466
SHA1 0bd83bb76520eb694de0e59601a4f239157b43e8
SHA512 63ba5ea59a82c9550b53b7124fa197fdc4576ae5a78662af22b72bad5632e70141aca19f9c6066aab26660ce4e88d08d84898b16f5b6b6d7b0c7f6aebd8390d9
SSDEEP 192:PdxlLxWChWAWwW6BHnhWgN7aIWISYh/qIs/zp9JHX01k9z3AtZKZ980Y:PdxlNWChW6HRN7P1OFbR9zLZy0
TLSH
T1FBA23ADACBA85503EC9B5D7043E9D8033C3DB7C62A2084661A89F6592CA33C5EB3473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 a0578cb085b32fba3ab59184115d7622fe229cd6fed4506deddd5683bdf60d88
MD5 1b3dd417aa3c05fca439e0ac281e5837
SHA1 237e2d600af3d48f24d6c6eb9c121023e343aa24
SHA512 52476fa06ef974c2e1b1f97b14a2bddbac841cce402834e3fc476ed34dcc5987ecb450fcd65e0b4a0343a0d188c900eebc4d74bc7ee8d24cf2f689932d3814a9
SSDEEP 192:UKxWChWhWnhK+6SQaHnhWgN7agWwOG9UqKIxYPVCX01k9z3A0H7v+vYIl:bWChWK1+aHRN7ROcYER9zRH7v+AIl
TLSH
T1DFA23AD6897C5582FAEB6DB002A8ED573C3CA7D2194090270B94E6582997BC1FF3473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 32eabd1ecc45e47f19050e8c329011c53b977937a44fd22478e3181c7fe07a09
MD5 49a741e0efe9fc8c34e4f71d31060d29
SHA1 43655394153cc864991349b7684dd3b94782c501
SHA512 e31a77ed97a6e5ccfdbfb64fce1535b975c1c0dfe264f5109162746fbbd434e4fbcb6455b3d9e009817f5543dc10e5dd59a8eef26e8b8fa22e8d77e3f4b82449
SSDEEP 384:9TvuBL3BWWChWcHRN7FcUthXBnR9z9OdWMi6N:IBL3B6bKCf9zcdWMi6N
TLSH
T100A229D6C6AC9143F9DA5DB082A8C8077C3D679B5920847E06D9E34828A33C1FA3073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 2da92920612255750b5cb52fbc85fd304754ca64fda71ffdca4ad825fafc8bc9
MD5 584957c5f0a10632b0f392666c7698b8
SHA1 d01f1c33a6e96ced56211869e5c440e8cb6842f1
SHA512 3f1e32a2e69a54cb431ebffba510c1eb60f31891b9af58d5b606d52b4785632f602e6a3f968042bc17f87c9f52d90ca845b96c4281cdcc78e204896bb00b919b
SSDEEP 384:DnaOMw3zdp3bwjGzue9/0jCRrndbTWChW/HRN7wFR9zt0OofX:GOMwBprwjGzue9/0jCRrndb5EwX9zu9v
TLSH
T16BA22B96C694D34BF84ED870706BC8032C3867954861D59917E6FF1829F379AEB7032D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 c7769ac1baf3120ba48cf75164cd4e372b9a1ce39659100d6c17e11ea3b51731
MD5 4c940b6630f2d495a32644d6a463583e
SHA1 8e977c1f5f24c40ff9197ea9fdfefb86b6dd1123
SHA512 6fe2f04bcfdfe84b1f416d48b960572dda90ea251be51fcfe2f0ece47fc188fad0ab962309840fc690f51711983981db03ab1c4688d059e4d628a0a69f32bf09
SSDEEP 192:BGxWChWdWwW6BHnhWgN7a0W6/U34DcX01k9z3ADD9MXYe:B4WChWlHRN75/cDR9zMDte
TLSH
T1BAA24B8986A89507F89A4C3053E9D9437D3DA7D718A0856F13A4E6592CA33C6EB3432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 c5b7ac7e3d6d16667af29ae315b6b84a61197d7e3aabb68761e1c31cacbadf4e
MD5 9f2d4b91d7b337803a4d1ea4f0ba659d
SHA1 52180e590fa899cb448fc392327ed9e720650f32
SHA512 d81c4e3fbb5b173f4ba839fa5c0d154dcf42a3d6f4c5e1fd28fcb141bb166b5108af0732734a52e596e40f82c5d64dfcc8cfc8796e2859f185c3563c6b862c96
SSDEEP 192:sxWChWuWwW6BHnhWgN7a0WXnVueTXflYBQXBnX01k9z3AmOdm1XI1+x:SWChWIHRN78cUthXBnR9z9Od8X
TLSH
T192A24BE982AC9182FDAB5CB042E8D9537C3D67DB2920842917D5FA052C633D4FA3473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 54ee1158b46537fa1bd5f3a97150dcf67710d456ecf9c0e16fbd76ce0b0e166c
MD5 201240e414423a1822a6b7b0af8f35d4
SHA1 19be33bd79c0f8cee411bd6f3fb2651a897d1bb8
SHA512 4cc4a34f5fa9c9a870b9b32a3adc7b9f6c057a45958c8a2cffa05768058eb9fb3b259aeafebb600693f523ca8abff6ea50b5e693a01a8642c262e766bee25d4c
SSDEEP 384:eFKWChWI7GHRN77NlicUthXBnR9z9Od0T:dexlPCf9zcd0T
TLSH
T10AA24BC695BC5006FA9AAC7042EDE8377C3C57B72D50806E0694E7192CA7391FB74B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 9ac0a042fb988eeff8cabe8b8d4c0222901a44be9006833a305c286543f91c61
MD5 529f69479fdfec5692539680cfa6d12a
SHA1 e0689e477b34a1cdefd67f0dfc64bf20c629ecf7
SHA512 e236bcbecf3d78cca56a40eb5696ed648a508e6ae5e3922c4ec055567950aac7ee69081d7cb05834e8d9dcd8328ca64bbc79aaa96a9c359849ed8b9f1b6bb55f
SSDEEP 384:zck1JzNcKSI4WChW/1+aHRN7FIrrj/R9zd5sJc:LcKSZ8+2FIrrjZ9zv1
TLSH
T15CA219D685BC92C3F88EA8707294E9532D7F8785192485350694F6A93EF73C2E63823C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 f5e313238ed38f0866005abc8c3f5c6aea367081256f77c79b09cd02d54176c7
MD5 960c917ebfd0fb0cfd0b3be588a62b9d
SHA1 086ed5e6190aee0e467b05264e4a27f1f4ecce4d
SHA512 feb7d44050d95746dcb56ea590dfc08a5f610e0d55c8a94912c29146abd2d59ade781da81429cfcc77b69cb445a0a566d9eed27512d24a8ced2a22792c417310
SSDEEP 192:7aDfIemxWChWxWwW6BHnhWgN7aIWzjUHWX01k9z3AdOzqaNCx9:7aDfIeYWChWpHRN7IjjR9zgQoj
TLSH
T174A249C19AAC5582EDDB8C7062E9D9133C3DB7D62930856A0685E2182DE73C6EB3437D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 00a972562198b185709bbf52cdd9dd66e6a3b18de0e78bb5f07cc301fa9c3778
MD5 99a2b34f67116ffe3e783fee67d219b2
SHA1 42d96a9f72af4d50b37e7d874210d1b3e351e808
SHA512 51a442f0c7032cd895634266b0bb3b5c2cf7b80227fef4bb64ad7b1fb89e4c39f9e0f83ddcf234d03900306fed465cc499f43f49f0dcf14c65a292348e75a5f0
SSDEEP 192:DxWChWhIWnhK+6SQaHnhWgN7acWmMak2K13X01k9z3AtT0:1WChWhV1+aHRN702QR9zGT0
TLSH
T16FA239D2C66C8047ECA7AD7042E8D9473C3C37D76A50911A06A5FA9829A33C5EF3473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 4ff5f28e09f5e4486bc1e97968d4c57bed3749d0af7817dec348d2fec306b0cc
MD5 cb7485aeb43ff6735315619fb0b8a1e0
SHA1 ed44c05272da482ed7d74e290738b7e446b842bd
SHA512 c005abf601abfbaac0bf0f940f92fc91fbe176e971d1a5a1499a68f9c7d6befb283e6a077d58bc4cc813b7debb60b6b320b764ab56f36d267632bdff47cc3c96
SSDEEP 192:nGeVNxWChWoaWnhK+6SQaHnhWgN7agWL4GMsc+6UQ/X01k9z3Ahh65sjm+P:nGeVbWChWo/1+aHRN71rj/R9zd5sjm+P
TLSH
T1A9A23AD796A85143FCA7AEB013ACEE9B3D3E1BC21984912A0594F55819933C4FB3472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 7aa140bff47124aa0ae3bc695d173532039e1bc43bdd5ebc48e6d2a2db623f33
MD5 1e1288d2f939b415675969988d5f134c
SHA1 db350da728415ae963557c35062438a9d31af2a8
SHA512 229c7e8a6094b7aba792621c75dff161cf6cd3a24ba57f060fc93baf97156e8f8a83b4188728eee2211f70db47b2d6915df4e0d75556848e0813c0f8b511aac2
SSDEEP 192:vZyMvrrxWChW3WwW6BHnhWgN7a0WoTsX01k9z3A3ILD2v:vZyMvpWChWPHRN7XoR9zoILKv
TLSH
T10AA25B9697A89007FD9B5E3003B9E993BC3D67DB1860817E5694F2181C937C5EB3432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 406904bbb13bc63592ae91ee5302e34958b32016c7f452c56dd9cb1d65d78db7
MD5 ca1cd6c0b678a841dfe55af37a8bbbf4
SHA1 33f7017f0fca748b08f6ce5ab84afa13bcd8dc25
SHA512 ba6a0fa4ece241e0b5c8e316b4625d467b6622c9750942cdd940932f5c5ebb1644b3effdf6a29d2cec7818a0abf3037b271434f5803c5ddbb46935dee92010fc
SSDEEP 384:8awidv3V0dfpkXc0vVaCQWChWh1+aHRN7oGbeU9xDE3R9zzSH:RHdv3VqpkXc0vVaT++2oGyULi9zzo
TLSH
T1E4A23A86D2E8A587FC5FDC7042DAD9533C3D17C70A10D42716D8EA6839A33C5EB2962D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\base_library.zip
Size 1.3MB
SHA256 70f440c215a8cd55640714637b21d3aa0041e6d85b184805151311f98b6e841d
MD5 f89ac9087b0d57655d7b48650616a902
SHA1 bbd4174ac8c5f98059f00e78e6e8f6718d492789
SHA512 61cde42b1507f39fc4359f987805eafbdf791dfeead38ef05854bc8e7310da339c610121e755beed59a29dd4680bc3a6ffd31371ceeb2bb892a2abbe873a55d2
SSDEEP 24576:sAlbGdxQeOdP2m2dfs7RpNyLnLuUF93CV5:0dx/ARMuUF93Cj
TLSH
T183552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\pydantic-2.13.4.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\python3.DLL
Size 72KB
SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
MD5 8d3d1ffbe3bb9539402e8bccb7fadcf8
SHA1 904397a69e08c93fc2080a3cdbf6810bc40313fc
SHA512 312fd7f95d2a76d9dd09336949d3b8ca9b53753a9f45da9d2fec128b2746f128fc1354693e0a995c1e1859a3d90497c8a4a8d4fedffc8bceee0392c456efc68a
SSDEEP 768:IQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIU:xbTrnXngXMBEI1G0hyvcvR9NfIko
TLSH
T1C0734D5E6B54F8A2D6B629FC78D199CE242B12FC5F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32842\ucrtbase.dll
Size 1.1MB
SHA256 31fb114dd8329a9c5fb27437dd81561cdfa36cb47f668612b085b9e39e1854c8
MD5 a2f8dfb553a1cd7607e6988e27bea22f
SHA1 7753002b288140763a75d48d03f0c65592b4fe23
SHA512 07df5ee333c4d244afbe535c57351d2c7324422623d01b3aae5f1776a45479bc662ab9e88a33cb5258c5ff15ccf5b11999e3a6680dc976e4bb0d4037942c9abd
SSDEEP 24576:qRmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypmkW:atI045H+ZB7fgDzt
TLSH
T190359E28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3540-2072-0x00007FF8B7770000-0x00007FF8B8AF0000-memory.dmp

Download

memory/5236-2706-0x00007FF8B03C0000-0x00007FF8B1740000-memory.dmp

Download