a2960f3b331a815ce788e1d5e8a736f36174f7cffafac77c82bc89466439011f

Analysis

user interaction
yes
max time kernel
29s
max time network
69s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260708-2m9dpabs2s
SHA256 a2960f3b331a815ce788e1d5e8a736f36174f7cffafac77c82bc89466439011f
MD5 9cacb9c9939d26b976040277b7093d0b
SHA1 7dfad43d16ec5f429b3d70c2790cd47929fcc0f9
SHA512 95ff2e774f7170d525872c6335d166ce1cb114ea2b75348c6c1d9def93cf245effc113141a92b0a4519d7f5db6741f0816e022639e2c6154eab2de11b26364bc
SSDEEP 3072:GYFgAkHnjzxQ6KSAiTyHE88aW+LN7jxRLlzglKXf2HDbk:7gAkHnjzxQBSADk88CN7DBXf2HHk
TLSH
T124643C26E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5D5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
132	1904	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
167	discord.com
168	discord.com
7	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280241983067496"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{89E2D6CC-56F9-420C-8ECE-B3BF093B283C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3956	3100	msedge.exe	88
PID 3100 wrote to memory of 1904	3100	msedge.exe	89
PID 3100 wrote to memory of 5752	3100	msedge.exe	90
PID 3100 wrote to memory of 1368	3100	msedge.exe	91
PID 3100 wrote to memory of 5752	3100	msedge.exe	90
PID 3100 wrote to memory of 5752	3100	msedge.exe	90
PID 3100 wrote to memory of 1368	3100	msedge.exe	91
PID 3100 wrote to memory of 4404	3100	msedge.exe	93
PID 3100 wrote to memory of 4404	3100	msedge.exe	93
PID 3100 wrote to memory of 4404	3100	msedge.exe	93
PID 3100 wrote to memory of 2776	3100	msedge.exe	94
PID 3100 wrote to memory of 2776	3100	msedge.exe	94
PID 3100 wrote to memory of 2776	3100	msedge.exe	94
PID 3100 wrote to memory of 5640	3100	msedge.exe	95
PID 3100 wrote to memory of 5640	3100	msedge.exe	95
PID 3100 wrote to memory of 5640	3100	msedge.exe	95
PID 3100 wrote to memory of 2992	3100	msedge.exe	96
PID 3100 wrote to memory of 2992	3100	msedge.exe	96
PID 3100 wrote to memory of 2992	3100	msedge.exe	96
PID 3100 wrote to memory of 5556	3100	msedge.exe	97
PID 3100 wrote to memory of 5556	3100	msedge.exe	97
PID 3100 wrote to memory of 5556	3100	msedge.exe	97
PID 3100 wrote to memory of 4516	3100	msedge.exe	99
PID 3100 wrote to memory of 4516	3100	msedge.exe	99
PID 3100 wrote to memory of 4516	3100	msedge.exe	99
PID 3100 wrote to memory of 1048	3100	msedge.exe	100
PID 3100 wrote to memory of 1048	3100	msedge.exe	100
PID 3100 wrote to memory of 2740	3100	msedge.exe	101
PID 3100 wrote to memory of 2740	3100	msedge.exe	101
PID 3100 wrote to memory of 3932	3100	msedge.exe	103
PID 3100 wrote to memory of 2560	3100	msedge.exe	106
PID 3100 wrote to memory of 2560	3100	msedge.exe	106
PID 3100 wrote to memory of 2560	3100	msedge.exe	106
PID 3100 wrote to memory of 5956	3100	msedge.exe	107
PID 3100 wrote to memory of 5956	3100	msedge.exe	107
PID 3100 wrote to memory of 5956	3100	msedge.exe	107
PID 3100 wrote to memory of 800	3100	msedge.exe	108
PID 3100 wrote to memory of 800	3100	msedge.exe	108
PID 3100 wrote to memory of 800	3100	msedge.exe	108
PID 3100 wrote to memory of 1064	3100	msedge.exe	109
PID 3100 wrote to memory of 1064	3100	msedge.exe	109
PID 3100 wrote to memory of 4848	3100	msedge.exe	110
PID 3100 wrote to memory of 4848	3100	msedge.exe	110
PID 3100 wrote to memory of 4848	3100	msedge.exe	110
PID 3100 wrote to memory of 3648	3100	msedge.exe	111
PID 3100 wrote to memory of 3648	3100	msedge.exe	111
PID 3100 wrote to memory of 3648	3100	msedge.exe	111
PID 3100 wrote to memory of 5548	3100	msedge.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffa9601c188,0x7ffa9601c194,0x7ffa9601c1a0
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3165686709209448045,2007488574738170900,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1249599068750135913,847259480846833410,262144 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,6527923909112624299,14785827528531154545,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,18123511313707289841,8540658848044468932,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,1010776518415656001,12483748052331624360,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,394066029404235854,6230999057889597135,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,18147064651374168661,9672768124114608165,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3772,i,12720511450313408976,5836137739396050123,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5464,i,6588970863021349046,10350435452280721555,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,14945264180225920497,13359398104794999497,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,10112907364764225298,378782137595657459,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,7343692882805019236,5739564151669748296,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,7343692882805019236,5739564151669748296,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6612,i,11355650816239880627,5277421180911981120,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6944,i,2699204828920752736,11859679069548308515,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7372,i,14697265725319955991,11950870596254725070,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,3514532229297196303,15282940794390662652,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7700,i,11149595482222899579,1722513687877328173,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5500,i,17984435779736824929,1731888625633602108,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,11052817132433842477,9126428027849242547,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,15407996604325284963,7054598085767495726,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16929883289111112549,13979554993837077558,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,11415553586804799455,14216744355561908278,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5852,i,2283193187529180259,4747052660183059926,2097152 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,15006382392431681570,9688956769249201349,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,1735400223752076098,8380386899915958544,524288 --field-trial-handle=2176,i,11526896189142756635,14274120377402461512,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
  2⤵
  PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2336

C:\Users\Admin\Downloads\ac imgui server crasher.exe
"C:\Users\Admin\Downloads\ac imgui server crasher.exe"
1⤵
PID:1184
- C:\Users\Admin\Downloads\ac imgui server crasher.exe
  "C:\Users\Admin\Downloads\ac imgui server crasher.exe"
  2⤵
  PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    PID:1428
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:2492

C:\Users\Admin\Downloads\ac imgui server crasher.exe
"C:\Users\Admin\Downloads\ac imgui server crasher.exe"
1⤵
PID:6052
- C:\Users\Admin\Downloads\ac imgui server crasher.exe
  "C:\Users\Admin\Downloads\ac imgui server crasher.exe"
  2⤵
  PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    PID:1416
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ad521761c2a4a57d12b6b4f6c05b4c0afd8cf9a5e16500ce20a6aa485489a03
MD5 4d76127fd33feb31a9e49ee2b8800598
SHA1 948622838f9c8c13dd9f160f195785be0988ed01
SHA512 4eb103c9be8d6079b2a15681b595e75864fe59afc3ae7ab7f68d4f843a588a95236ea50b161a4cff6a804062757a2cd2d2def165afb754be1320ddcdfa5cd032
TLSH
T15ED02324BF25FDD7C734147B94304B00757555737D574107E524444C8C754C26B876E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

5e8f4459-e655-456d-bb5e-ec611c456308.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e8f4459-e655-456d-bb5e-ec611c456308.tmp
Size 27KB
SHA256 e94bb640eb8bfc7d67ec2902dbd14bc3cfdbd14adff4a55a48e7bc6c23ff8ec7
MD5 0ba61e393f28e1af988987db4bd03dfc
SHA1 4ac438bdff342b2de2166e7f0ca0c283df99a57b
SHA512 7b9d7c1838cf02c25a3ae4869a6f6212fbd6c3d234decdb810389c2bc2c25e7be3f709bba7a6b0a7f199211aef89a0e9cbdbd5cc7078919bb2a1a36af8c3cfa4
SSDEEP 768:Jl6h92WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxXguCroMggBW+:Jl6h92WgqcfHwu1ja4QuZMgT+
TLSH
T121C20C2B640CC77E4F844EACAC296E966DD801CB97988D5447FA894C03CB7EB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5e049f45314979c474b0170beb4b0c4ffcf5f020d68b4522c64ecba8d496c843
MD5 3ab31d13533d84205430a573c7a856a5
SHA1 4a604d3f3438df0b1a1192d40017ccb5d3b3d183
SHA512 4286d4be0c94f924d52cb6a8fd41a8c690e1ac5e1abbeb2499c3b13741ccfba1acc35acca944b9b8534f91eda1502d5dd61967086c4fb6cb48fd1f1d3d9df534
TLSH
T1F3418920337A36C3CF94A1BE6BE232C93A3C545976CB6E04D270A13C1E7AB14781B505
MD5 SHA1 SHA512 TLSH

Submit Download

9cace23b-be7a-42d5-8983-ccea0746c051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9cace23b-be7a-42d5-8983-ccea0746c051.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 50b4702388b98d6dd606073ce77a0a0f6eb60797286a8684286bc66883a85b4b
MD5 401affc64b7249213bd775701336bf61
SHA1 11cd6907752ca33b63e7db94faba977e0ff3d31d
SHA512 6c78ec2c4db4bca5eadbf8d453bf043cf2f16ff49929b8d04533791446fcd3d8bc9b156154ef78dbd1aaed8b0b0efea9b7380cdadd0f5e5415b3c7034bd2c47c
SSDEEP 192:sxR01R+yM/jK1Ml8wGm/fTs6LELG3rgd+zoA8pGntn/g6+WNTGEYn9Ft7GGIgDwJ:sxRMc4m/fTsKECkhA/5aE+fv4
TLSH
T14662D916A638597BCCDBD20DFA417F53D6F91562A2901E44AAFCCA0C05EBBDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eebf42cf95e4c0a46afa413b96b383c632585b6a1259140d76c40d9505863011
MD5 34bb160abb47d1656ce49a4f6183d219
SHA1 91335d1756acd340bbf7a38f591b185e82d671ab
SHA512 8b19621381b57a0ba168bc37a09601d91594c8431bf836f225e5b71ad01b6cbcb9215a80f11394c4807020ee3f6cd950d3e82f6818ce8813df4e8c19cb1c2b21
SSDEEP 192:sxR0GR+yM/jK1Ml8wbm/fTssLELI3rgd+zoA8p4X/g6+WNIYnot7GGIgIJ:sxRLclm/fTssEskh2/5ITvs
TLSH
T11452EA15AA38597BCCCBD20DFA557F53D6F91563A2901E44AAFCCA0C04EBADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f6743e9cfa54c83aed54392e53175c9b789bdb10682e66e319630fcb29386eb9
MD5 496ed61acd9293cc170d04292184e89e
SHA1 6929d5861ba8b144aeb7ba1c3e6448179c952d94
SHA512 0837e5fa5e2c01a0c399c700720c9e13e3c7239475bcb7af915a76d4ab8b2967527c11e39d197490b33a74639c76cdcf68fb7949c7a4bab5c1cbfc84fe6c975c
SSDEEP 192:sxR01R+yM/jK1Ml8wKm/fTs6LELI3rgd+zoA8pGntn/g6+WNTGEYnot7GGIgDKJ:sxRMcMm/fTsKEskhA/5aETv6
TLSH
T18962DA16A638597BCCDBD21DFA417F53D6F91572A2901E44AAFC8A0C04EBBDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 736891d4153f50061e7cbb0814a0cbedf61614c8d9a808fa40155ae9b2949537
MD5 1527f93a710c9a74e6267241e28d1b62
SHA1 b0c50cccca157f78f6073bf7d6904426b6686a6c
SHA512 ec578c5921ddc421ff0f18d020a3fb3103282ec6f71b0f71e4abeed2ed3ce3f28de47bd0d6d6b1ed30718d6559b58f9ee8a078c339ce6b392eccdaf7c3792d1e
SSDEEP 96:KRqP2qc8cKWkB5gaKK4/ggKcKiJ46jHgRkQiOCYWm7LgYYK49gKYcY4rKQDMpdLV:CqP2qc8c1kBKay/ggRKiJ46jHgRkQiOD
TLSH
T14B91581C70B703903C7E245C9198AD5AD6C1B0A2312AE56B7BA952D51F2FE018EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6e116465-8f34-4608-8fda-f618d8e61bc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6e116465-8f34-4608-8fda-f618d8e61bc6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b17923d0ea72a83a865364f0bffe20e0970c5a938dd159ef3e694fce98b053f5
MD5 e02b0523a13c7cfad8fd31a02bce7b55
SHA1 8850d0bda6d1a9d21aaac7b3a14c3fc76223c1d3
SHA512 7fbcdbe90b513c16699bbf64ec8bfae85c00e00e7008e2849e333979107ac8183ea15c2704a504e4a04865449c894efffc203de3e54e3b4e5da0f2089100d67c
SSDEEP 768:sj+9U3O6YreNSLfXfNfWX7DGFzoqPcNMCNFjMj0:r9U3apfXfNfW3WkqPahb
TLSH
T103F2AFB5AC655D264DE3C2C9B7173B46EFF0066342842E849DED2F0E46DF6AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2fdd792d8e75a868bb51baf813635e187ab17cca5980d7025194e8b6cde5584d
MD5 66bda00e699132139098e47f9938a6fb
SHA1 352c3aae3c89538446bf70f2cb97aa81f2d2faae
SHA512 9dadbdd6b1e4f87b6dad201683858ed7d3b889f1cd36d0c50685b750e0de9683150641ac61acbc955c661e7ca7fcb4c320c44b74f2521608524d393ea4b7792c
SSDEEP 768:Lj+9h3w6YreNSLfXfNfJX7DGFzoqPcNMCNFjMj0:e9h3wpfXfNfJ3WkqPahb
TLSH
T14DF2AFB5AC655D274DA3C2C9B7173B46EFF0066342842E849DED2F0E46DF6AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6eb162c4f0e716f2a918de2811e3c33638ba5d0f32eaeb531d9d6d3d1a11ac73
MD5 c8e8fc61ee77cb0846c88223a65243f9
SHA1 0a1e28f982033c79014b83f2556b8dc3498c0c6b
SHA512 d2d6c47e98665bd66bfef440f2d945cde44ba8d4cd80cd9ea2ba09639ccc03aebbdbf629a7221d6e75b1e03536ee52381e4a7b16f3b16fffdc4d58b372710917
SSDEEP 768:Gj+9h3w6YreNSLfXfNfJX7DGFzoqPcNMCNFjMj0:V9h3wpfXfNfJ3WkqPahb
TLSH
T17AF2AFB5AC655D274DA3C2C9B7173B46EFF0066342842E849DED2F0E46DF6AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8af7c807eef98bc34d6e5af456b3245ac9653355099891a100125685a9f1c90d
MD5 e6fff01a5ec7f749288da9f6317c1748
SHA1 ab80683bd2fed889a8def49e29282df547fb5f23
SHA512 ede26458193c108fee02825619640aab36eed728f98311de4641819daf04db39cac2ac6de139124df413d3238123d39cb033d976720b86fd6f4b934533a96607
SSDEEP 768:pj+9s3c6YreNSLfXfNfWX7DGFzoqPcNMCNFjMj0:09s38pfXfNfW3WkqPahb
TLSH
T186F2AFB5AC645D664DE3C2C9B7173B46EFF0066342842B849DED2F0E46DF6AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 29c37698d8f92df5bc79f7b69b6fa2de55380337c8d283528c97a997240f700f
MD5 d4d85304ce21eba8cec3a910536f15a0
SHA1 3328b36a0bfbd8c25effcc2c42529634e3ac112c
SHA512 7f96659f1279bb728751a38795d7c7b622fe7cb1b9c99589b2e92c8ff5c88406ec64a3b083d89b200a0af74919157124b292bbf59f5ed51475b8c28334ab68e2
SSDEEP 768:Vrv+4UNbda37mYreNSLfXfoX7DGFzoqPcNMCNZXeVH1SkM:Vbsb43JpfXfo3WkqPalEH1Y
TLSH
T1A203BFB5ACA849374CE3C689B75B3607BFF4015346840B94D8EE2F0E479F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6554950d-f59a-439b-9ca1-94d5db79480b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6554950d-f59a-439b-9ca1-94d5db79480b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc9128a0-b57f-4411-aa69-edd416a1be16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc9128a0-b57f-4411-aa69-edd416a1be16.tmp
Size 34KB
SHA256 c6b8e8016f810715163af759105b8044dd5ae6982475fe8559c11fede4fb2b28
MD5 91f75cf19c14b27b566716aa8bbeb7ac
SHA1 f183c028dcca004faa9b68e972e94564612ecb14
SHA512 61de372acd6b7d1b85eaee85217cab142a08e144ef4e5158cab1e9454d9240e29600e7dd0963c4d1ecc5829918880cf6d2a5fe78e431b76a4b2a30f294847b2a
SSDEEP 768:pj+9T3yMYreNSLfXfNfWX7DGFzoqPcNMCNFjMj0:09T3ApfXfNfW3WkqPahb
TLSH
T111F2AFB5AC645D664DE3C2C9B7173B47EFF0066342842A849DED2F0E46DF6AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_hashlib.pyd
Size 67KB
SHA256 d4524b261f09806a828c62fc97e8517328b23d65ab87d20706a4bafd86bbf345
MD5 3c7f5536fd531f5115738cad734ba92d
SHA1 aaafd1ee00d2da6bdbaad00ef78f8fdf99865f5e
SHA512 492e61def2ec6b01d0df0c55887a7273adc7fb8bb216a6a9bceda9556546fcebde6a7175c16eac4c87ad2313d74adcfc62a571b401ad2ed9eda79217f92c56d6
SSDEEP 1536:Bs0SOWZsPZJWvSLTRfgI1DIAyvcvR9tfIL46:WLYhJWvSLTNgI1DIpl
TLSH
T17D637B8AA6984092D62382B4C9E38F43FAB5F252270197DF6279C18D2F233C35777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_queue.pyd
Size 35KB
SHA256 cb529f77bc4665dfa3b66fae3d00ab84de1e9618d0cb94900efbf28527623c0f
MD5 77eae2640493cbb57e92997366ab6e7a
SHA1 bacd865b27b8bdb9649c569b8f6ff1a758677f54
SHA512 df81c1767dd7b87032838e8817ef6987e93e075f28f557e84c4e5f7029969b8e219bb75da8c63955ec19bdb34a3bef88936edf26ae5f2f272297fbbbdc03b2dc
SSDEEP 768:f7wx6rEOJgBvlAEI1RUuFYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:flEOJgBvlAEI1RUuCyvcvR90fILqFrT
TLSH
T1F5F27C8AAA9C5087E6A3C930C2B2EF53F535F7D357019ADF207881891F233C1A736659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_socket.pyd
Size 85KB
SHA256 ff3e97cd11bdc68798e5b3dcd5295d1efba179b7344142d50d066bbf1c2d79cd
MD5 e60e2de0be0f2db133252f103e9b1f8d
SHA1 686000117f1dc472ea8012a7368c936bd04ded08
SHA512 49a002516235cec6870b0d08da61d3aac4440b4ae1437b7357fa493dfcba0b2212cbfefaf5833baa8b6f904f6439389ec3a6b53cd7faa718273ca0c3e00c38fe
SSDEEP 1536:KcVunc70XTxn1egypxz7XP+N6wSzsGNesQAcsqIP4fYEI1GweyvcvR9YpfILO+:zEna2Dypxz7XPs6wSzsDsQ1s6fYEI1Gv
TLSH
T18D835A01AA6040F6EB72C176C6639E63FB74F5C11394A75F1066C65A1F33382BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_ssl.pyd
Size 180KB
SHA256 43e60bbdff2fe41701f39fa25ea6a8251a2b7623ff18f980a209a451eb5e648f
MD5 d900bf186dc66f71d07808eeae323c17
SHA1 9e86985f7cf11165a773a33efaff343da0e34f00
SHA512 d3229f5da6623844b31bb4b7d93d0baa5e7c71a3b3462e5ce3679238d2d10c17ac47e758188314edc0c30a45d9fba9a08c475cc387d7d22f17aab3e5537861f4
SSDEEP 3072:UQjyHsqUEao3kfj6CuHqMX3jYnizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnEO:MJUEV3Qj6CuJ3snOUBzCI
TLSH
T165048C47B1846AF7D913E8F9C6234543EBB4F045332297DE48D6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_wmi.pyd
Size 39KB
SHA256 5a7f3444f1c2f85fb5573bc330c1aea2c583912bb6f948ff81f8fd89a30e67be
MD5 6fded560f9627954b2e46f0fdc9d92d8
SHA1 6f359326458d37c266244b2ab674d3cce7a76e1c
SHA512 f4785ef2f6b052deec4755102ec23c9e1fe7890cc4f852c70ac3fafa8b0fa25c17cdb95caee37f32fd8ff1e4e47a54f05e30b84dd40e8c19999a096e80e13bf2
SSDEEP 768:7u2/EEqrVmjsRuJOQMVII13i0YyvcZRYT2Ip4xTxf1mlIJ2l:7TE9BEXJOQMVII13ilyvcvR9jfIk2
TLSH
T146038D89E6680093EB67CA70C5A5CE43F575F7932711878F32A581990F233D1EB3A279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\base_library.zip
Size 1.3MB
SHA256 70f440c215a8cd55640714637b21d3aa0041e6d85b184805151311f98b6e841d
MD5 f89ac9087b0d57655d7b48650616a902
SHA1 bbd4174ac8c5f98059f00e78e6e8f6718d492789
SHA512 61cde42b1507f39fc4359f987805eafbdf791dfeead38ef05854bc8e7310da339c610121e755beed59a29dd4680bc3a6ffd31371ceeb2bb892a2abbe873a55d2
SSDEEP 24576:sAlbGdxQeOdP2m2dfs7RpNyLnLuUF93CV5:0dx/ARMuUF93Cj
TLSH
T183552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\pydantic-2.13.4.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\python3.DLL
Size 72KB
SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
MD5 8d3d1ffbe3bb9539402e8bccb7fadcf8
SHA1 904397a69e08c93fc2080a3cdbf6810bc40313fc
SHA512 312fd7f95d2a76d9dd09336949d3b8ca9b53753a9f45da9d2fec128b2746f128fc1354693e0a995c1e1859a3d90497c8a4a8d4fedffc8bceee0392c456efc68a
SSDEEP 768:IQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIU:xbTrnXngXMBEI1G0hyvcvR9NfIko
TLSH
T1C0734D5E6B54F8A2D6B629FC78D199CE242B12FC5F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11842\ucrtbase.dll
Size 1.1MB
SHA256 31fb114dd8329a9c5fb27437dd81561cdfa36cb47f668612b085b9e39e1854c8
MD5 a2f8dfb553a1cd7607e6988e27bea22f
SHA1 7753002b288140763a75d48d03f0c65592b4fe23
SHA512 07df5ee333c4d244afbe535c57351d2c7324422623d01b3aae5f1776a45479bc662ab9e88a33cb5258c5ff15ccf5b11999e3a6680dc976e4bb0d4037942c9abd
SSDEEP 24576:qRmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypmkW:atI045H+ZB7fgDzt
TLSH
T190359E28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5532-2657-0x00007FFA8AB50000-0x00007FFA8BED0000-memory.dmp

Download

memory/5776-2656-0x00007FFA88EE0000-0x00007FFA8A260000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads