9569869f1e57c078c7626ce29b0f31aa050453949b07dc5c0a8b1a6fec62ccb0

Resubmissions

08/07/2026, 18:17

260708-wxjywsfx4s

08/07/2026, 18:09

260708-wrtadafs8z7

Analysis

user interaction
yes
max time kernel
18s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AnimalCompany-NoEAC.exe
Size 49.8MB
Sample260708-wrtadafs8z
SHA256 9569869f1e57c078c7626ce29b0f31aa050453949b07dc5c0a8b1a6fec62ccb0
MD5 b0d479745e90234729c6cd43a425d6fe
SHA1 2d02f18073e5de6d4324940c5dd6afe0b87bdf42
SHA512 d5c60d5ac0ffa57e3401a6612a0fa430ea530e9bd7ca33436f5cebfa331639f537a6170a4b30d3943270c5ece5285d84428de4c9a6ed6615088f699ac13a4b7c
SSDEEP 1572864:HJCYWE97Ol/sei3ofQVGJqfeUFydsBuzr6Dq5ZNS:HJ8u7Ol/sbcQV9lFyuIzWe
TLSH
T1CBB7336CE2D5027BD443E57CCF6699B1A250FC221B278CAF56C49127DE53BE20C3A789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 19 IoCs

pid	Process
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe
3108	AnimalCompany-NoEAC.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
43	discord.com
29	discord.com
30	discord.com
32	discord.com
38	discord.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
404	msedge.exe
2060	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280078483113186"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{A3D5E216-96FF-47F9-BB42-1A928F22ACC0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{3A5B7316-4534-40F7-B8C0-3AC40B0FBD8E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{09095504-1B13-4650-9671-1FA9E6E235D8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
420	msedge.exe
420	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 3108	5512	AnimalCompany-NoEAC.exe	89
PID 3108 wrote to memory of 420	3108	AnimalCompany-NoEAC.exe	90
PID 420 wrote to memory of 3256	420	msedge.exe	91
PID 420 wrote to memory of 404	420	msedge.exe	92
PID 420 wrote to memory of 6000	420	msedge.exe	93
PID 420 wrote to memory of 6000	420	msedge.exe	93
PID 420 wrote to memory of 2860	420	msedge.exe	94
PID 420 wrote to memory of 2860	420	msedge.exe	94
PID 420 wrote to memory of 2860	420	msedge.exe	94
PID 420 wrote to memory of 1292	420	msedge.exe	97
PID 420 wrote to memory of 1292	420	msedge.exe	97
PID 420 wrote to memory of 1292	420	msedge.exe	97
PID 420 wrote to memory of 2612	420	msedge.exe	96
PID 420 wrote to memory of 2612	420	msedge.exe	96
PID 420 wrote to memory of 2612	420	msedge.exe	96
PID 420 wrote to memory of 2636	420	msedge.exe	98
PID 420 wrote to memory of 2636	420	msedge.exe	98
PID 420 wrote to memory of 2636	420	msedge.exe	98
PID 420 wrote to memory of 5200	420	msedge.exe	99
PID 420 wrote to memory of 5200	420	msedge.exe	99
PID 420 wrote to memory of 5200	420	msedge.exe	99
PID 420 wrote to memory of 1776	420	msedge.exe	100
PID 420 wrote to memory of 1776	420	msedge.exe	100
PID 420 wrote to memory of 2036	420	msedge.exe	101
PID 420 wrote to memory of 2036	420	msedge.exe	101
PID 420 wrote to memory of 2036	420	msedge.exe	101
PID 420 wrote to memory of 4796	420	msedge.exe	103
PID 420 wrote to memory of 4796	420	msedge.exe	103
PID 420 wrote to memory of 4552	420	msedge.exe	104
PID 420 wrote to memory of 4552	420	msedge.exe	104
PID 420 wrote to memory of 4996	420	msedge.exe	105
PID 420 wrote to memory of 1416	420	msedge.exe	106
PID 420 wrote to memory of 1416	420	msedge.exe	106
PID 420 wrote to memory of 3720	420	msedge.exe	108
PID 420 wrote to memory of 5804	420	msedge.exe	109
PID 420 wrote to memory of 5804	420	msedge.exe	109
PID 420 wrote to memory of 2932	420	msedge.exe	110
PID 420 wrote to memory of 2932	420	msedge.exe	110
PID 420 wrote to memory of 4828	420	msedge.exe	113
PID 4828 wrote to memory of 1608	4828	msedge.exe	114
PID 4828 wrote to memory of 3440	4828	msedge.exe	116
PID 4828 wrote to memory of 2060	4828	msedge.exe	115
PID 4828 wrote to memory of 3440	4828	msedge.exe	116
PID 4828 wrote to memory of 3440	4828	msedge.exe	116
PID 4828 wrote to memory of 1728	4828	msedge.exe	117
PID 4828 wrote to memory of 1728	4828	msedge.exe	117
PID 4828 wrote to memory of 4412	4828	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\AnimalCompany-NoEAC.exe
"C:\Users\Admin\AppData\Local\Temp\AnimalCompany-NoEAC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Users\Admin\AppData\Local\Temp\AnimalCompany-NoEAC.exe
  "C:\Users\Admin\AppData\Local\Temp\AnimalCompany-NoEAC.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/thundamods
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fffde0cc188,0x7fffde0cc194,0x7fffde0cc1a0
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13826407246009171917,14926115474459966440,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      System Time Discovery
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,9284118736884376241,6276158889551233322,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,8492442463500368883,8138611580435680035,262144 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,16533325785126867893,18336074453626487506,2097152 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,416367827894337499,193286285934835153,2097152 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,2451338811149225931,8424491199047048743,2097152 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,1037665850930459083,3945309504714619319,2097152 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,11554505523748179189,17203180946497977972,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,10789288273225127550,75506987579001595,2097152 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,10796836604140998807,6589312674587118626,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,3688500981776970301,10099291583038637722,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,16305242737338323947,14885730068624823514,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      Modifies registry class
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1556570709160999310,8142942839997877053,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,6103500514875503706,15122822564468728985,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,6103500514875503706,15122822564468728985,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,3309120632730272571,12115603460243040115,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4972077090136889392,8156627601902889298,524288 --field-trial-handle=2448,i,17617737948913846510,16606124129464158637,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fffde0cc188,0x7fffde0cc194,0x7fffde0cc1a0
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16546709211944377966,606903760680757606,524288 --field-trial-handle=2116,i,5287172850934942102,9106649336230185403,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9173781028343570345,14270095606467828887,262144 --field-trial-handle=2116,i,5287172850934942102,9106649336230185403,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
        5⤵
        
        PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,13242765099644670783,11346000073189940208,524288 --field-trial-handle=2116,i,5287172850934942102,9106649336230185403,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,6478435720473714203,1418864725992729378,524288 --field-trial-handle=2116,i,5287172850934942102,9106649336230185403,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
        5⤵
        
        PID:1160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,6478435720473714203,1418864725992729378,524288 --field-trial-handle=2116,i,5287172850934942102,9106649336230185403,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
        5⤵
        
        PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ad521761c2a4a57d12b6b4f6c05b4c0afd8cf9a5e16500ce20a6aa485489a03
MD5 4d76127fd33feb31a9e49ee2b8800598
SHA1 948622838f9c8c13dd9f160f195785be0988ed01
SHA512 4eb103c9be8d6079b2a15681b595e75864fe59afc3ae7ab7f68d4f843a588a95236ea50b161a4cff6a804062757a2cd2d2def165afb754be1320ddcdfa5cd032
TLSH
T15ED02324BF25FDD7C734147B94304B00757555737D574107E524444C8C754C26B876E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e9eceb5cc4bcc9773dc4920c030963a4771811c48ca4faf24c0bf5cd8d4c9a6
MD5 44fded65e8f23a4e3f0101fc94fba54b
SHA1 07bd2d65cf25db8a9e13cc0d68f444f0edfcfb81
SHA512 20e8353b964c4d39bf2d4d2de5bcaba0b4f428daa14e2e026909f2990aaab0f2b6c3c0ed67c97833c57360ba1b2f8ff0ac1d21c3b1532b7478f9e2de1ce52df9
TLSH
T173D02274BF28FC47CB173872A420CB117BE2A6A1BD5AD423D130444C9C356D22A8F1EA
MD5 SHA1 SHA512 TLSH

Submit Download

6c76f70a-68ba-4cd6-aad4-17cf705a7d55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c76f70a-68ba-4cd6-aad4-17cf705a7d55.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 9338f291c53560521948d099044feaf7f749c17d8ad0338e1a670c2a23e62037
MD5 1dca4e7e9afa740e9991ef46fa7bc098
SHA1 d33859d71b8b7e672c6ad5fa44aa2659b3a1dd96
SHA512 afb33ef929cd89c51a1a693f3f0f4cd7a79959a8ffaafc1316cd42e46cae86da2d8da0660e57dc4fb09e02e24fa842cdd24aa65956099619da7d4a5ddfdc4c27
SSDEEP 192:gHZI/cGLczP1RQjn0luCAyqRUdvjBf0BBxlKCs7y4SH3274F:gHZI/cGwztRQjn0lVA9RUdvjBf0BBPKs
TLSH
T1D0D199016BB707C9CB2C2DB798F59E4DF3B8A49A01DBAD036260583AD637742DCD18B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59913a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59913a.TMP
Size 2KB
SHA256 497ecd25c5934305d2d748c0147e6c17ab631aec8117c04e11bfd7fe0089ecc9
MD5 fc014eeac7ae0b8b0ff59bbd5e5bd11d
SHA1 eac64e3ed5769b3b3e26e27031cce9fb056c0555
SHA512 d16a3a62924566487f416226d16bac98b7d2a06da6b334945842c7ac586d5a2c8c2a414037f3d1c102363e91462880a32e0a8f302cc59f81ce30244f77c32a7a
TLSH
T1CF5140500FFA07D8CB595DFA61F66485B7F998EE420FAE037385913E0B49704DD9283A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a4f01ee54852c38912a46c4f02b69bfde6fcc48185efbae633048e2a93f3a447
MD5 e274cc903a6b1196b8f60b80bdfcea7f
SHA1 572b14636f420809b6de0165424b943b3835a2fb
SHA512 859a2fa7c1572a958a9a9406a14f47d0798874fca0edc36b5cec5ed272309eaf0bd691178353213c24ff9f8390ed009698f7a62c74313ac8b6faac49724299fc
TLSH
T1E6618EF3C3E8862DCA1156F4AA146E2FCE2D0915432C3C2AC5E4AE5BA3E6571F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d876c32fb7899b42b2611c105605f94acd8971f861797b437229f7b4a5882336
MD5 e46ce7f0fa0456b13d6cb1965dbd0876
SHA1 6e980649eb0810d510d2766c5c39f5acdb8f70ba
SHA512 698224591a2c6f4d9e1fe13484d02021f092a7fda8ff8f68ff56868dc6b480670f86e06284d6a48aa19399e0e470606a895cf1b02144ac19f0ef91251032be7f
SSDEEP 192:sxRAR1yM/jK1Ml8wCG/f0s0+iKZy1zoA8pll/g6+WNpbCP9/eBnnrytzG1IgtJ:sxRAR8G/f0s0TcP//5BY9/e12u3
TLSH
T1C562EA16AA345977CCDBD21DFA457F53D6F81563A2901E44AAFCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1aae4e73e50625cec3a24d1d6c3363ae23e2ee4905bc28dda5cdbb9df62e8c72
MD5 8f4b40af010a31c9a8a44bb4d9d84bce
SHA1 431662591fdd33bfed29b67332e98c1a45ea230c
SHA512 c138b8c6a9fc7081393b5f1e62043e6706fb2cd7149e7d81e333c1b0bc3dcef991ce03e41d96c3181d57923a1483ae26f96612d07ccb6bad020d67b72b70835b
SSDEEP 192:sxRHR1yM/jK1Ml8MCG/f0sYWpVK+iKZy1zoA8pll/g6+WN+BbCP9/eBnHxrtng13:sxRHR6G/f0sYWvKTcP//5cY9/e3Rw3
TLSH
T10362EA16AA34597BCCDBD21DFA457F53D6F81422A6901E44AAFCCA0C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1c984f3e1352f25156f937ef512f9f084c037fbde9ff93adfb957e9a8a423edc
MD5 863ebbc5ee2a86c85263cca97c3da4be
SHA1 be113f5ade04ddbf61803944a655bcecc7c79539
SHA512 fc9134a0664e8861ed0aa7351581cb4ea4ed49006e1633b79f26a017ffa71285cbb17ed8ff17a5d11bdeacc58df81e587d4fc06e5b9d987fe2382ff5da13d8dd
SSDEEP 768:Jl6hhs7pLuL7b2Wgqcflw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCb3Xgu4roMgUB4:Jl6hhQE7b2Wgqcflwu1ja1b3QuDMgl
TLSH
T1F4E2EB3B780CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA984C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 fa595e81b100fadd4a1a509b4b78158eb77f10882306d821966b67497a7e103e
MD5 195ddf1662040902515719abb4d5da98
SHA1 9623642f98267fba86299ccae3cc8650d0552522
SHA512 bffe0af7089788e9062d5d92dfa11839893f2defecd12e13e76254a754828b2c170d5ee8238e7c0d0a4bafcd9f10faeb4b269750f11d65d0ef4048e8e1ab71ce
TLSH
T1A8D0A7A7F0664441E77B8F910B32A66E47687C845899508CA602316D1878E87E216E63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 fba1d2881be75dcb97b41603b87513916bfb86d81dd3cf53fc8feab3be9e9471
MD5 f92b60bddc75b53686de9174cd6b87ff
SHA1 3b126c56bc7da6e74d3294b0f0165c690e68942e
SHA512 7069adbfdec0110df0b638d5d329ef33e0177b6211c78b8c77bd05fa47e99b239d9d36dd678927b986f2942117f9da08045d5c8e43db2dcb5a3937de259abebd
TLSH
T17ED0A7A7F0568551F6BF8F910B32666E47587884549D504CA60201695C58E97E112E63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5968c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5968c2.TMP
Size 138B
SHA256 26bb6ec606ca5cb6ef05cb3d3af21e48b49ca3b3bff28ec9914b38f5be8b57b3
MD5 a5b18e6229d057500ab7e59b4cf00a63
SHA1 fcb8cfa011f8ec206694a17a87991e379ee13807
SHA512 4079b977430f16b39b508e36be8aebe837db9e02504181da3d00a11ffbe317f7963e240ff534f75117f884c9f0c80eee3e2ad86697e455ecb11244b601a77312
TLSH
T19AC08CB3B0410401872A06910332621D47093C880C86808CB61731982038E67A50AEA2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4575a84b3c1a3ce6808395a34de2124cb256c3957eed01921def98c9329ddd21
MD5 7b5175d736847484ee3404b1b870a56b
SHA1 ca0ebeae4926d38d583ab53d5295b83789cd8f4d
SHA512 a3094e0dac4d6432bde9e72fe55be68c6568f7ac12fc6e4d88408c569003c35ec796853ec431713de00b8655fae223696ae6ae9355700ea5efc9841139150c59
TLSH
T1A7E0D8A077CAC73E7195308B423CF34CC6E37953D6CC2E122B08D688A207984B743691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 5529cd38e4cd410f8a8258f05d0df037f64830f8e7f36d242f357cfacad8edb8
MD5 e02877d6d08d53a93b66ff1cf686b58c
SHA1 1e87d186114609ebff30f326025d653be2ad436b
SHA512 96956013391c40b13e70150820f4bef968ec6ac93d9ae979399068d1d3224b495ceb89af0becfb3d9897d3274b2d5097c4153ed96fdf4cf8ceaac1cd16a92f51
TLSH
T112E0267067CAC73D644460D742BCA75CC2F17C5793DC3F039B084884A502208BBA76D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be530882c057f8a55f905950e6b8c9c1bacd2875fe3505e9cd594b817ec0b0c1
MD5 86e52f308b902dd87020ae025e47b715
SHA1 d7a6c547f1c14d8cb505cc656c6c5fccd1657c15
SHA512 cec93cc10e8e6ae27153264621ecd2fab4865a4f0fb8fe5babfaeed55056e2d395162caf2c5e751bc6b767d37b1c967dd5555687ba9928fa6694a7e1d4024631
SSDEEP 96:KRPY95PNtBWZWcghBK4ogPBcX/ehNCH0VAE+imkWivPgMkK4BgGkckEP+kRuRDRe:CPY95PNtMZWdhrogPuX/ehNCH0VAE+iG
TLSH
T12D91C613783A07502C3E291895A5C4A7A9C274E23458AD3F7BA906F50F67F128EFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa880ef9-1a58-4c9a-ad53-155258bba84c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa880ef9-1a58-4c9a-ad53-155258bba84c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f4336f6c-51ec-4ade-afd4-e1c600b6b367.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4336f6c-51ec-4ade-afd4-e1c600b6b367.tmp
Size 414B
SHA256 f120d694c360c4658c1cf9aa43efd1928612ab0fff68757c13382ddcae10b785
MD5 c2e861266fdd55b87a332264be882171
SHA1 96f58b884afd32bfe4e83c6c228daa14c37bcef8
SHA512 630826bd3434fc11c4579a3cbbf809a5209098472a10e092f29b5bfcb29560b80c4a00c7f982c163c2a5dead0de39ebf5efc28035e507fd817326d4a237b2638
TLSH
T162E02BAACD21DD3B1CFD075860504BC2EA4013A72B408A5F3B3C410D8FB873A5587C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3260da8b23b6a826f430114550dce3f701457748c04cee83a7485bad33efd372
MD5 b081ee862f9ad8c7050e12f67cea53e8
SHA1 06e6821c4fa2db61db3e455dd308b03d254a09d2
SHA512 996eceebc680d4af56e73f52be14c910a3e846ce5a28b57ffe30151965619b1202d2705b98d3d435689f52649d7a25e9b4bc8592f4e56ef97f8194f06e5f311f
SSDEEP 768:oj+9u3HJYreNSLfnfHfmX7DGFzoqPcNMCNFqMjg:39u3CpfnfHfm3WkqPa0P
TLSH
T1D0F2AFB5ACA05C274DE6C289B71B2B86EFE0116345C41B54D9E96F0E42CB7ED130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 96892d4459ec50674bee098c7b46783b188564b0cf4c86991aa055bc80ade4d7
MD5 574d8771ef0d82cb13fe3592b49ab178
SHA1 766d172525d1d02b310aeeb248717bd591570cb0
SHA512 ad4dbee237d41875d3d01221a2a7f498203306e000866aee0b508bc35e8f52ca1d096ef0249ad7ace58ee1d85b48d029dfe03f0b355a8fddc4952b2d5560dd30
SSDEEP 768:Vrv+4UNbda3XHYreNSLfnfOX7DGFzoqPcNMCNZjeVH1SkM:Vbsb43opfnfO3WkqPa9EH1Y
TLSH
T14C03BFB6ACA445374CE3C689B75B3607BFF4015746840B94D8EE2F0E879F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 221f4d5cdf1b63fae68544c58de33587bbbd911516a9752af8ee4fba39cab4e6
MD5 d5cda60dad9e75308446d3de9022a72f
SHA1 7333916d8884f6ed8889aa8c00e5ef05684f1fb5
SHA512 3fa86c3ad3959168bd17822639d8975ec60db39da247e6954ac02b8a12268236d1eae3b4c953d072914e1459d7ae940ba18ef9db0184804a20e83ab241578395
SSDEEP 768:Cj+9u3SJYreNSLfnfHf6X7DGFzoqPcNMCNF3CKs/ePMjg:x9u39pfnfHf63WkqPatCKUePP
TLSH
T17B139FBD9C61593E48DEF38CAB0E2A269DA40233C1E01958D7E91B0EC2BB5ADF307515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1d3eb72f05df4543d081a34b5030d56cbb794a7a9cfee953b27d210b06ab6501
MD5 34576462d8559e5700f8a6b7243c27e5
SHA1 6e3b7f0b581e27f47dc41e6d0de6ebadd2bff23c
SHA512 81f1e67f39d891ec0a404e951efe24b25d6fd2aadb224905269875bab150ff9b8245e9a44b73038cf619539f898492a7eac78e087269dab186079e6f462aaff7
SSDEEP 3:MsEllllkEthXllkl2zEfl7Jiw:/M/xT02zu
TLSH
T1114404447FD04505C50014304151C3541370DC100511774334D104335CC77411C11010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_asyncio.pyd
Size 76KB
SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
MD5 c2a29938ef6730c1418140a15e0cea86
SHA1 e137c778526eb34068c0d85fd37d30b81773013b
SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
TLSH
T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_overlapped.pyd
Size 56KB
SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
MD5 c96e86f3868d0323c88700f0671d9f20
SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
TLSH
T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\base_library.zip
Size 1.3MB
SHA256 62feb42d87f33707b4ba8bc4086aa8f700c65934734fdb2c5b83728778b815f3
MD5 d0bf574fe7e51384ded00b3d80972caa
SHA1 71de4804c551499e1f6d6661f616abafa20936aa
SHA512 9018c1b7116440e95ec32c272669fc41d9f4c7e9cff423dc38183fba47694f4260e38d024d074a6b177ee1233cc9d5810cbedef3819fa058c8367a41a1841611
SSDEEP 24576:RLNruUFC9fQeOdP2m2dfdRpjEhlbz3kd4W:buUFCZ/1Rk3kd7
TLSH
T19C552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\python3.DLL
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\python314.DLL
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55122\ucrtbase.dll
Size 1.3MB
SHA256 d404dc9aa843d53d7e276dd078b2cac8d7aa905e2838a1fe8385278e19ba3810
MD5 1c5c8447d570e0eceefc9f3f92c008da
SHA1 a198c2897e6a1c5745e2ef7f508541dc21675ad4
SHA512 a1dd080b57a6339cbc66c9abaecc0a59315b9dfe843176267b10a8324b8eb15e0f2c856c7de938d3405905dadc36d75f0ad3ad67d8aff5caa42ceda889c07607
SSDEEP 24576:XUanuON+jflUtGz/rLeX+NNF7R8b1h9X2kwlNsmGb6mxvSZX0ypympKF:EIuON+jfl+Gz/rLeXDdXGQepo
TLSH
T16055AE6676AD01E9C1BFD138C65B4506E9B2781503708BDB03E94E7A2E3BBE5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir420_1734281666\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads