0284aeb71d6663d0fe612efd533cb6a660d40e8adb984d86572d901946f4a7ae

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ThimeoStereoTool10.41x64.exe
Size 26.9MB
Sample260709-y1srbaas3t
SHA256 0284aeb71d6663d0fe612efd533cb6a660d40e8adb984d86572d901946f4a7ae
MD5 d3fe0f82e65ad2b102d9a6fa1b027ce1
SHA1 21a156385ebfb8660d9dab882462dfa75d782b97
SHA512 78d1231b1509f695a894f0b5978a63f39728dfbeb4ef98aeb5e4cd78a1f1762a48e153e05703ed5ee91e6af40621d80b590d4f021f3944ce7890862a9c61e781
SSDEEP 786432:qZ715cDlSmRW1vQcF+GRFvZNSG3O0iP6BamgXUzx:qb5cDf3AZbhiP6B1D
TLSH
T1C057336416F7972DD993A2B0FD8520C3D0363A123BD8F57F822EE50ABE576714624B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3332	StereoTool64.exe
3400	StereoTool64.tmp

Loads dropped DLL 2 IoCs

pid	Process
3400	StereoTool64.tmp
3400	StereoTool64.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Stereo Tool\libcrypto-3.dll	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-EVV64.tmp	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\lame_enc_3_100.dll	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\StereoTool.exe	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\lame_enc.dll	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\unins000.dat	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-IENTE.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-7CR36.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-FSUM1.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-R9RBP.tmp	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\lame_enc_3_93_1.dll	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\libssl-3.dll	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-04I7D.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-04ENT.tmp	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\unins000.dat	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\libshout.dll	StereoTool64.tmp
File opened for modification	C:\Program Files\Stereo Tool\libsndfile-1.dll	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-1QHSQ.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-8JJK1.tmp	StereoTool64.tmp
File created	C:\Program Files\Stereo Tool\is-J9RLR.tmp	StereoTool64.tmp

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1424800239\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1424800239\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1811117826\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1811117826\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_310153066\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StereoTool64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StereoTool64.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5848	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000c00000001c54d-6.dat	innosetup
behavioral2/memory/3332-11-0x0000000000F40000-0x000000000100F000-memory.dmp	innosetup
behavioral2/memory/3332-95-0x0000000000F40000-0x000000000100F000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ThimeoStereoTool10.41x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ThimeoStereoTool10.41x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{2577CA16-5AD3-4244-8ACA-FC794C7396E2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ThimeoStereoTool10.41x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ThimeoStereoTool10.41x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ThimeoStereoTool10.41x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ThimeoStereoTool10.41x64.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp
108	msedge.exe
108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3400	StereoTool64.tmp
6072	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3400	StereoTool64.tmp
3400	StereoTool64.tmp
3400	StereoTool64.tmp

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 3332	5680	ThimeoStereoTool10.41x64.exe	87
PID 3332 wrote to memory of 3400	3332	StereoTool64.exe	88
PID 5680 wrote to memory of 6072	5680	ThimeoStereoTool10.41x64.exe	90
PID 6072 wrote to memory of 1076	6072	msedge.exe	91
PID 6072 wrote to memory of 4560	6072	msedge.exe	92
PID 6072 wrote to memory of 5848	6072	msedge.exe	93
PID 6072 wrote to memory of 4560	6072	msedge.exe	92
PID 6072 wrote to memory of 4560	6072	msedge.exe	92
PID 6072 wrote to memory of 1284	6072	msedge.exe	94
PID 6072 wrote to memory of 1284	6072	msedge.exe	94
PID 6072 wrote to memory of 4280	6072	msedge.exe	96
PID 6072 wrote to memory of 680	6072	msedge.exe	97
PID 6072 wrote to memory of 4280	6072	msedge.exe	96
PID 6072 wrote to memory of 4280	6072	msedge.exe	96
PID 6072 wrote to memory of 680	6072	msedge.exe	97
PID 6072 wrote to memory of 680	6072	msedge.exe	97
PID 6072 wrote to memory of 1072	6072	msedge.exe	98
PID 6072 wrote to memory of 1072	6072	msedge.exe	98
PID 6072 wrote to memory of 1072	6072	msedge.exe	98
PID 6072 wrote to memory of 6056	6072	msedge.exe	99
PID 6072 wrote to memory of 6056	6072	msedge.exe	99
PID 6072 wrote to memory of 6056	6072	msedge.exe	99
PID 6072 wrote to memory of 3776	6072	msedge.exe	100
PID 6072 wrote to memory of 3776	6072	msedge.exe	100
PID 6072 wrote to memory of 3776	6072	msedge.exe	100
PID 6072 wrote to memory of 5724	6072	msedge.exe	101
PID 6072 wrote to memory of 5724	6072	msedge.exe	101
PID 6072 wrote to memory of 3364	6072	msedge.exe	102
PID 6072 wrote to memory of 3364	6072	msedge.exe	102
PID 6072 wrote to memory of 3364	6072	msedge.exe	102
PID 6072 wrote to memory of 4856	6072	msedge.exe	103
PID 6072 wrote to memory of 4856	6072	msedge.exe	103
PID 6072 wrote to memory of 4856	6072	msedge.exe	103
PID 6072 wrote to memory of 4876	6072	msedge.exe	104
PID 6072 wrote to memory of 8	6072	msedge.exe	105
PID 6072 wrote to memory of 8	6072	msedge.exe	105
PID 6072 wrote to memory of 4876	6072	msedge.exe	104
PID 6072 wrote to memory of 1264	6072	msedge.exe	107
PID 6072 wrote to memory of 5356	6072	msedge.exe	108
PID 6072 wrote to memory of 5356	6072	msedge.exe	108
PID 6072 wrote to memory of 4732	6072	msedge.exe	111
PID 6072 wrote to memory of 4732	6072	msedge.exe	111
PID 6072 wrote to memory of 4172	6072	msedge.exe	112
PID 6072 wrote to memory of 4132	6072	msedge.exe	113
PID 6072 wrote to memory of 2508	6072	msedge.exe	114
PID 6072 wrote to memory of 2184	6072	msedge.exe	115
PID 6072 wrote to memory of 2184	6072	msedge.exe	115
PID 6072 wrote to memory of 4632	6072	msedge.exe	119
PID 6072 wrote to memory of 4632	6072	msedge.exe	119
PID 6072 wrote to memory of 5700	6072	msedge.exe	120
PID 6072 wrote to memory of 5700	6072	msedge.exe	120
PID 6072 wrote to memory of 6096	6072	msedge.exe	121
PID 6072 wrote to memory of 6096	6072	msedge.exe	121
PID 6072 wrote to memory of 108	6072	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\ThimeoStereoTool10.41x64.exe
"C:\Users\Admin\AppData\Local\Temp\ThimeoStereoTool10.41x64.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\StereoTool64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\StereoTool64.exe" /silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Users\Admin\AppData\Local\Temp\is-AP595.tmp\StereoTool64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-AP595.tmp\StereoTool64.tmp" /SL5="$80166,27342191,791040,C:\Users\Admin\AppData\Local\Temp\RarSFX0\StereoTool64.exe" /silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cybermania.ws/
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16487703565679173083,6855545063123607470,262144 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4327377530197376587,85915584228325853,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,1824705280677959921,6925619647467462486,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,13354001425943151544,11477783235529904671,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,13945619212195495605,1197378903321255149,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,18383825264280962543,1226475454031236527,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,1829169262919843220,8863385535463869212,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5388,i,6658978191161970580,17664322249047478188,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11646425802100405160,9181701932300687645,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5660,i,15405117425388608865,15285570572093073686,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5680,i,6435989177218026715,12862574223070487957,2097152 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15992014006038047368,151865681267907505,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12042941377548304402,12906423825741558199,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3636581669954552702,11778626359486897322,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3636581669954552702,11778626359486897322,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,4721528581865395394,18180024320814778097,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4401992311992500980,12750417397308585866,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,18268317587616590217,10612815998447632670,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,7293379655938773145,14068012366333067051,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,11558158863930147314,4960532441457166630,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,10702520576546809360,15207855929467917370,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:14
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,17005875399283521501,2030882027903758185,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4099228765712200325,5059580886896794912,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,16719331504353558099,9852268665137392036,524288 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:14
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4496,i,17345365397916850659,13926749791040141699,262144 --field-trial-handle=2372,i,17267661626044106146,10371936245076924469,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StereoTool.exe

Path C:\Program Files\Stereo Tool\StereoTool.exe
Size 22.7MB
SHA256 3cecf2dda8fb17d8be6237e980f4ca6a6286e69ddc3be1275312c2fc37536351
MD5 2fc4e991b4970c1b2d24152b60c359a9
SHA1 2e1c799f2a71f118c37c25527733e6dfa32b53aa
SHA512 efd8098cf99baf17e69516668aeee6947fe7d4ed3c032e867af367f8a3bd45a7a28352bba488599afe7ca5ea59c08f145248a42e1769ba13b74e2c56d1d11d74
SSDEEP 393216:yzgl19jmGH4LaVJbVAQoAbIW83yD6sWgquvGCbMsVn6LhjanLqYdf/t:yzghjFY+nPyR3yD4gquvGCPVnIhIdt
TLSH
T1A63733FA6DD237A4D140EF3A71A705DE85C31C0BFD2690401AF4572AB9263A9EA345FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CyberMania.vsf

Path C:\ProgramData\CyberMania\CyberMania.vsf
Size 32KB
SHA256 53564a28d1a00386b9536dfbf0371393d949b2bafd9292e8b80497d1e59e00bd
MD5 66792a9c425c811b704f2f9f428672ac
SHA1 47e0366a2c2c75361dc5c094faf1a109d2aa7db5
SHA512 ece42f9d09583520416507cb24a62bb73633d41df8c2acfa21bc8d7fd4dffa51515f481e4a6d1eea6637d3dbfaffb390c5b84d106c93d7d0fcbd1052ac479177
SSDEEP 768:GFYjg5V84tpppppn4Zs7jmtXvwPkJMSVK27JYnFpYEN0:GFYjgp4Ijm+Zq7JGdq
TLSH
T158E2D0B1968DDEAAE562127908B7FDAA913831732EC9F3B72371107D023A478D392447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60b9f2ae-a2fc-4724-b909-b48adb3b22cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60b9f2ae-a2fc-4724-b909-b48adb3b22cc.tmp
Size 43KB
SHA256 225119723510cae01f7976db303c3ecf86df28a50508f5ee602d6034229c2eb0
MD5 f6e7892e2a94499f6776e935c2593c5e
SHA1 c31e42f15c112213a40d3db108c6083fdbd27543
SHA512 84e1b7bffeff6d0350161c943695d92f9966484c37b3fd010008a2c9da1f3a342996a3cacb13b40135b9ee24f008e5be6e9c38eda3eacd422949877786222dc7
SSDEEP 768:nFDj+9RH3iawgGi5tpNO+2p8+p3bd66j+4BRv86aLIW5QMVcLCO7w/f:s9RH3iPi5tk8+p3Z6n4yrQHCt/f
TLSH
T11D1318F298D78937D8AD8747A73D2E429EBCD06375844994F7C85E0DCC861BFC60A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

4799f9cd-5e0c-465e-8e12-e42aaa31d793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4799f9cd-5e0c-465e-8e12-e42aaa31d793.tmp
Size 15KB
SHA256 57d3d93dde359c9ce86cd618e8afc40f7fff21953eb9781a5e42b59f7051a180
MD5 b476fa6569133d649fd9650af4940f5e
SHA1 19ce04c8497cf56e58fbd746be0a67b7a1c77ecd
SHA512 f3229ac3c190153ba28d0c38bb9ec35f3975ac48a3247abb0daf5d97d74506778e8d71f14bf0f395fe7b15b4984997b5775e3194440a8b0b996c432cf38c3dd8
SSDEEP 384:sxRBvlI8D/fqsOAtWzrAd/5Hpt/USoCeIVDWEw9TefI3:sdvltD/fEA2Md/5HpRUSoCv9Wp9TefC
TLSH
T18962DA16AA34597B9DDBD21DF951BF53D2F81423A2901E44ABFCCA0C41E6AEC6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2fbe1d10d045785ada50f7cd4915aac6604ee3e16b43e3e152774f673b037265
MD5 c894b668fa43fb4ffdf682ce968ca369
SHA1 f819231955f4627f6bb711d4817c0e2fd9a98357
SHA512 c67ba8fca96398b0ec26ef1f50edf3e530a364a169b5414f51adcf070c94c4ce959a72aa98fba5603d8e626a3b17f0a4f45813308ff73fc41b0cebde690d3430
TLSH
T155518583132629CFD3E149B121F16864F2FEA87C8117AE8959672D34C602FCA50E347F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c903.TMP
Size 2KB
SHA256 2d74324717e37926a509cbda6e943f02a240fc1aaddbd4fbcf57577c1f133f30
MD5 fdd9228fdf8f5256b2eed8a0373d5686
SHA1 059964ef7ec87ee14b6472aa3d113074fad2564b
SHA512 ee85d0b0f689e7d3d621a2c3f0dc70f9a6a2c5ae430200604ba13c8d7ef26db7b9f9f8d9802a1ce9445f701e3cc791233d4fcad4941d45680249bed99d786e54
TLSH
T1FA5151D3132259CFD3E159B121F16468B2FEA87C81076E88417B2D75CA02F8A60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 12c7c29ee3f2ab76caf21c007f8b8881205ca93bb4c1749dfb72df9677fae35c
MD5 5750346bac39eec4d4474a437e4d8dc8
SHA1 356d72073abfef022228e5f2921ad54903fbb2ea
SHA512 833d4cd99559d72fe5fd88960bb6eb17fa223da68379f9cec7a6e17c5c9ef62996413012fb9c3431b345d545dc263cdae77adcd0ecab3b06ae0e0ee4a6f0e947
SSDEEP 192:DHKNpR3vy+1hJxQka91aNjhC1NqqNJITfSqiqVvKfO0ESY8PM+6Gj6KX8t:DHKNP3vy+1PxQkaLaNI1NqqNJITqqiqx
TLSH
T1E0027EF383E4CA2EDA1159F0AB65AE1BCE1D092947583D26CED5DE4BE3D2071E10164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 17b4e6de1e3b5d41fe6631440d1edc202d159af58fc0f2aef6e873cc3bb3afc9
MD5 beb99a33ce4d42c6213ac2a8d37c9a49
SHA1 528137b3ef0dee1522e7a88875ef174f26bb8b32
SHA512 6fa9b957a5df2c6ae0b3774e397ec94c03cd70b46a3ff6b325428a0bc2a959f3acecca7a298c1bd764a998d6a283e34e156a1baed66cb7d42ee53339fdfc36f2
SSDEEP 384:sxRUvlI8D/fqsPAtWzrAd/5Hpt/USoCeIVDWEw9TefIe:sQvltD/fFA2Md/5HpRUSoCv9Wp9Tef5
TLSH
T1B162DA16AA345D7B9DDBD21DF951BF53D2F81463A2901E44ABFCCA0C41E6AEC610381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cb809a923c10ac9c7e062655ace853e2fe8e99d92117b2aa1a97cf5a26bb7dc9
MD5 03fc4a3cc340b8150fbbcdcf74906efc
SHA1 e0218eac5095399ef03700ca91475ce265d1fdbb
SHA512 e61ce5e8f87581c87e331b0743949629ac2d30789d65e5be3528bddfa8eebff7ced48e3855ec0c5ff29f7d43a9d627c9e19c3248c97ce3064e144ab74f2523d5
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fz+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUbMQqqjDrovD:j/8vN7E7tQWgQ+fz+u1jafbMVqjwr
TLSH
T1A1E2FC7B680CCB7E4F404E9DEC29BD9AADA801CF5698CD5447FA880C03C57EB561A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54b39957-aded-44e3-90c0-09dd9b72f6f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\54b39957-aded-44e3-90c0-09dd9b72f6f4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 843e1624a15a55024cd7754961842cb4a08c810288b572accdbd4871146b1ccb
MD5 9a59d76399b9990f0a4ce5ffc611ecb8
SHA1 2fc3edd330da5008117471fabe9ea9c4068d2ac0
SHA512 27aa08e58d8e384a065d8928e60e95c6a8c121d4d8e75a2a2b8cd21fbb72a2a526674f9fd053442788c0452dcec1e16dc6fb78395ea3100b68ac5c2b8cab064a
SSDEEP 768:Mj+9RH3imi5BpOf+syp8+p3bd66j+4BRv86aLIW5QMVcLCO7w/f:L9RH3imi5BsM8+p3Z6n4yrQHCt/f
TLSH
T181F2AF71E8AA9E738CE5D648F6573783AFF4156359C00E94E8DD6F0E018B29D170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ab6c624cca7401588b2b76f803caf33dc875e287dd8db7b5e82b9a35f825820c
MD5 53499607882f871ca71ed5e694d7cd7f
SHA1 5469d1527749ce99f4a157977d44d900444b3df0
SHA512 edb79826ca3d48597ab0e0fd8dbd7755e7627c33894c29a3f5c1ae0abc9865636e2b169591723090f03b6ac920f4902104dd1219ee1fec87e4dbdebc5d83df3f
SSDEEP 768:Irv+4UNbdD3GcfKNp8+p3bd66j+4BRv86aLIi5+2bwCl1:Ibsbp3QL8+p3Z6n4yP+0ww
TLSH
T1D003BE33E8A899739CF6C648B24677437FF851A396C10ED4E4DD2B4E416A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c6b3220a8b411b28709b1d7575450acf8ee022341bf1170d3d3ffdeecc2106f4
MD5 9b8b9d0df6f20e4576ec5060d2180239
SHA1 449565ee292ae7e870b4784e260f4d572c645f89
SHA512 ac35cb4c3da7524dd4d80203d459b58e1db9a2751cc4013dde2c91ebe21594e326d575f8d5fc2e0848e64ebef13065e0eabca3611f58ebb25d5f0c56de3558e8
SSDEEP 768:nrv+4UNbd7H3iGi5PpOf+sQp8+p3bd66j+4BRv86aLIW5QMVcLCO7w/I:nbsbdH3iGi5Psu8+p3Z6n4yrQHCt/I
TLSH
T16A13BF32E4A9DE739CF6D644F14777837FB424638AC00E94E9D96B4E015B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

2340ef00-6f0f-441f-b389-4d748a655aef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2340ef00-6f0f-441f-b389-4d748a655aef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CyberMania.URL

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL
Size 207B
SHA256 a129a28ef3cb954a1bcb8ae8600d6735c56ef1fdd8a9d33337b5d0d1a568aac8
MD5 8bad483b28b28d8fefa6c5beeca2a71e
SHA1 3034ec1305a20341794844343f7de65ed906d0ba
SHA512 c03ed3cb993ba09125843f985510ad5196be737a2d165189d4e5f0a80ddc2669606d6cb2054a85feb5d3ef1acff96e8d0a289ece6a3d98613ac84ee997a415c8
TLSH
T11ED02258CB88C2E9C3429206B2B1FE08F48E39A0C8C7C88D8280CE0C2C811C1CC8DBA2
MD5 SHA1 SHA512 TLSH

Submit Download

StereoTool64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\StereoTool64.exe
Size 27.0MB
SHA256 0a27c9e2e9a1990f3072fffbf98bb57275f020be75de69d3be11f6908b1de961
MD5 5382ffc12ce99ea8d2485df9db225e85
SHA1 44157d0ca34deaa044c65cd3c87b82a21dd04c11
SHA512 f749debda1c4047d9f7060148a7598884603f70210dea454afd29bf6e0680ff7d1e5ba01df31437fa0d7a7a5b8d61ffe108c190fd32dce07756ad519de1b93bb
SSDEEP 786432:1gJXejf8HSYrcrjwE6B7B9R8kw2PWNLBZq:1gQ783rcPwE6B7bnwSWNK
TLSH
T114573323B7C7A23EF4880F3B19B3B25840FB79516521AD56CAF444ACCF261641D3E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StereoTool64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-AP595.tmp\StereoTool64.tmp
Size 3.1MB
SHA256 d9024c30ed44c4f91d088442e3cdf22874e07be1f7c5fd68475fbe7639497c69
MD5 88c301c5e6bc46ba9e30e1a88470ef3c
SHA1 97759a30c9b435b273dc0bc5a4a3753df12b246c
SHA512 26cf11bc235f1f9f0b63025d3e4b974c58ac85fa948712ba466ea4ddf2a3e12a5989d44f9fcd7f6eaf5fe09ddd95c19b597afe4ed8fcb611b436c70b9445b990
SSDEEP 49152:NdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQG333k+:DJYVM+LtVt3P/KuG2ONG9iqLRQG333n
TLSH
T1C9E56D17F389613ED05A1A392527D241583BBE70762A8C575BEC3E8C8F361486E3B74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CyberMania.dll

Path C:\Users\Admin\AppData\Local\Temp\is-HT65N.tmp\CyberMania.dll
Size 3.0MB
SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
MD5 b0ca93ceb050a2feff0b19e65072bbb5
SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
TLSH
T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6072_697731011\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stereo Tool .lnk

Path C:\Users\Public\Desktop\Stereo Tool .lnk
Size 891B
SHA256 fc90d5730076b55663e8cd2bcd2781bf9f424834b4b666a826ba1df8251c5074
MD5 abbd881a2e7822b2977a5cdce6d26f50
SHA1 b1aff55e983ba7c4936721c7450b543de7315497
SHA512 00a5b8c3c944777cad890c8d705e4485b5410dc3d69ab3c79a013c9c6398c74fad6adaf2788ac2c2abe3fad9c0ed97d1d83d7ceb301b551e15e4c5ecf1717f74
TLSH
T138114C0013F21B65F0D7C1737E322B155733FA129765676D4046428668736505AADFE3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3332-95-0x0000000000F40000-0x000000000100F000-memory.dmp

Download

memory/3332-11-0x0000000000F40000-0x000000000100F000-memory.dmp

Download

memory/3400-51-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-91-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-63-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-62-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-60-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-59-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-79-0x0000000045070000-0x0000000045071000-memory.dmp

Download

memory/3400-57-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-56-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-76-0x0000000045060000-0x0000000045061000-memory.dmp

Download

memory/3400-75-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-74-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-73-0x0000000045050000-0x0000000045051000-memory.dmp

Download

memory/3400-70-0x0000000045040000-0x0000000045041000-memory.dmp

Download

memory/3400-84-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-83-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-81-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-80-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-72-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-68-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-71-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-54-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-61-0x0000000045010000-0x0000000045011000-memory.dmp

Download

memory/3400-58-0x0000000045000000-0x0000000045001000-memory.dmp

Download

memory/3400-55-0x0000000044FF0000-0x0000000044FF1000-memory.dmp

Download

memory/3400-53-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-67-0x0000000045030000-0x0000000045031000-memory.dmp

Download

memory/3400-64-0x0000000045020000-0x0000000045021000-memory.dmp

Download

memory/3400-52-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/3400-48-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-47-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-45-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-44-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-46-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/3400-43-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/3400-89-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-90-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-65-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-93-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-92-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-94-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-82-0x0000000045080000-0x0000000045081000-memory.dmp

Download

memory/3400-96-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-99-0x0000000002F20000-0x0000000002F21000-memory.dmp

Download

memory/3400-97-0x0000000000630000-0x000000000095E000-memory.dmp

Download

memory/3400-66-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-109-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-88-0x0000000044D6E000-0x0000000044D6F000-memory.dmp

Download

memory/3400-69-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-78-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-77-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-50-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-49-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/3400-37-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/3400-35-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-38-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-39-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-42-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-41-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-40-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/3400-36-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-33-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-34-0x00000000049F0000-0x00000000049F1000-memory.dmp

Download

memory/3400-23-0x0000000044BD0000-0x0000000044EEA000-memory.dmp

Download

memory/3400-25-0x00000000049C0000-0x00000000049C1000-memory.dmp

Download

memory/3400-31-0x00000000049E0000-0x00000000049E1000-memory.dmp

Download

memory/3400-26-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-27-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-29-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-30-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-32-0x0000000004860000-0x00000000049A0000-memory.dmp

Download

memory/3400-28-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/3400-17-0x0000000002F20000-0x0000000002F21000-memory.dmp

Download