9700f933689e08b7a953f1477735bd3bd883b5636fa407ae106e6e21c8ba8fe0

Analysis

user interaction
yes
max time kernel
23s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FlueNuker.exe
Size 11.8MB
Sample260719-etwpvaes5y
SHA256 9700f933689e08b7a953f1477735bd3bd883b5636fa407ae106e6e21c8ba8fe0
MD5 4675ed185cf5b6318901c8a0cd5c763c
SHA1 38e29572ef109acb899d2b9fb2cb3e7e131dce2c
SHA512 987e91182106e32cf674a9bd569dc7827da90f6d919f8d06a46fb3df1173b91491b8cfcad50547466ae39d9a314abbe42e5fe5cac70ab887dbc9d29c39c33dce
SSDEEP 196608:Bi8F9dvlA7JN3yp81aPZmsDGm1X4U9TlOLJWBGMMGbqiqoTUinJBxdqpc24a:vFTvCqNG+XF9TlAMMkUMJopc24
TLSH
T12BC63398D35104F8DAA64678F882531F73B1A5A30F9583A723A095F35F239E34F3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 24 IoCs

pid	Process
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	discord.com
33	discord.com
35	discord.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5624	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4904	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5848	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289081005691820"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{862776DC-3394-4E6F-9D9E-828384DFF231}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{F0467A25-01A3-4353-8DF0-EA171804A042}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe
1324	FlueNuker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeIncreaseQuotaPrivilege	4904	powershell.exe
Token: SeSecurityPrivilege	4904	powershell.exe
Token: SeTakeOwnershipPrivilege	4904	powershell.exe
Token: SeLoadDriverPrivilege	4904	powershell.exe
Token: SeSystemProfilePrivilege	4904	powershell.exe
Token: SeSystemtimePrivilege	4904	powershell.exe
Token: SeProfSingleProcessPrivilege	4904	powershell.exe
Token: SeIncBasePriorityPrivilege	4904	powershell.exe
Token: SeCreatePagefilePrivilege	4904	powershell.exe
Token: SeBackupPrivilege	4904	powershell.exe
Token: SeRestorePrivilege	4904	powershell.exe
Token: SeShutdownPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeSystemEnvironmentPrivilege	4904	powershell.exe
Token: SeRemoteShutdownPrivilege	4904	powershell.exe
Token: SeUndockPrivilege	4904	powershell.exe
Token: SeManageVolumePrivilege	4904	powershell.exe
Token: 33	4904	powershell.exe
Token: 34	4904	powershell.exe
Token: 35	4904	powershell.exe
Token: 36	4904	powershell.exe
Token: SeDebugPrivilege	1324	FlueNuker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1324	4256	FlueNuker.exe	90
PID 1324 wrote to memory of 5624	1324	FlueNuker.exe	91
PID 1324 wrote to memory of 4904	1324	FlueNuker.exe	93
PID 1324 wrote to memory of 1116	1324	FlueNuker.exe	94
PID 1116 wrote to memory of 6084	1116	msedge.exe	95
PID 1324 wrote to memory of 4800	1324	FlueNuker.exe	96
PID 1116 wrote to memory of 3000	1116	msedge.exe	98
PID 1116 wrote to memory of 5848	1116	msedge.exe	97
PID 1116 wrote to memory of 3000	1116	msedge.exe	98
PID 1116 wrote to memory of 3000	1116	msedge.exe	98
PID 1116 wrote to memory of 3956	1116	msedge.exe	100
PID 1116 wrote to memory of 3956	1116	msedge.exe	100
PID 1116 wrote to memory of 3444	1116	msedge.exe	101
PID 1116 wrote to memory of 1372	1116	msedge.exe	102
PID 1116 wrote to memory of 3444	1116	msedge.exe	101
PID 1116 wrote to memory of 3444	1116	msedge.exe	101
PID 1116 wrote to memory of 1372	1116	msedge.exe	102
PID 1116 wrote to memory of 1372	1116	msedge.exe	102
PID 1116 wrote to memory of 2072	1116	msedge.exe	103
PID 1116 wrote to memory of 2072	1116	msedge.exe	103
PID 1116 wrote to memory of 2072	1116	msedge.exe	103
PID 1116 wrote to memory of 6040	1116	msedge.exe	104
PID 1116 wrote to memory of 6040	1116	msedge.exe	104
PID 1116 wrote to memory of 6040	1116	msedge.exe	104
PID 1116 wrote to memory of 2424	1116	msedge.exe	106
PID 1116 wrote to memory of 2424	1116	msedge.exe	106
PID 1116 wrote to memory of 2424	1116	msedge.exe	106
PID 1116 wrote to memory of 2916	1116	msedge.exe	108
PID 1116 wrote to memory of 564	1116	msedge.exe	111
PID 1116 wrote to memory of 1596	1116	msedge.exe	113
PID 1116 wrote to memory of 564	1116	msedge.exe	111
PID 1116 wrote to memory of 2040	1116	msedge.exe	112
PID 1116 wrote to memory of 2040	1116	msedge.exe	112
PID 1116 wrote to memory of 1708	1116	msedge.exe	114
PID 1116 wrote to memory of 1708	1116	msedge.exe	114
PID 1116 wrote to memory of 568	1116	msedge.exe	115
PID 1116 wrote to memory of 568	1116	msedge.exe	115
PID 1116 wrote to memory of 3668	1116	msedge.exe	116
PID 1116 wrote to memory of 3668	1116	msedge.exe	116
PID 1116 wrote to memory of 4888	1116	msedge.exe	117
PID 1116 wrote to memory of 4888	1116	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\FlueNuker.exe
"C:\Users\Admin\AppData\Local\Temp\FlueNuker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\FlueNuker.exe
  C:\Users\Admin\AppData\Local\Temp\FlueNuker.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_BIOS | Select-Object -ExpandProperty SerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/63TGJaJ7PX
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x35c,0x7fff8acbc188,0x7fff8acbc194,0x7fff8acbc1a0
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,4025221776601297018,10535271792603392743,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      System Time Discovery
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,12958008609860890796,3984348558088455453,262144 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,15068659899719261097,17909953447894575058,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,4504279980924762493,8637649610925620557,2097152 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,13901682725891381591,6862391103173820956,2097152 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3856,i,4760849286239990101,7178316916736949714,2097152 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3896,i,8232677873326363295,4285520547057257825,2097152 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:9
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5336,i,7247424100477541582,4117762913597965622,2097152 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7890554078364388247,6717755782936728656,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7890554078364388247,6717755782936728656,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,2516136213006109601,6657243281615530776,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,342450050196774229,14278318206898456896,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,14915179291151154876,10480716600857732674,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      Modifies registry class
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,10906712606401175814,8602461147751974959,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:12
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,11465547141143279548,6645935902158700740,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,16150530267465406782,10742741003392203082,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,8086401160001889608,3633069180535404418,524288 --field-trial-handle=2148,i,4633994250868960794,12245519489195321569,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
      4⤵
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 87891ec1c1f05bb50c601650182cc510db5eaf48c0b07189bf0722e4ef40315d
MD5 d75a6a344ddb8c27addadd34addacad2
SHA1 ddd014657762b227a1281749c11b616a7f1dbe2e
SHA512 feac4d4122ee919d198840293cf9752b37667d3cf2c9d426f17a66f8410593da41fa0f2f8586971f935fef4697b65d3da069070db951c54dcd09bd3773260c22
SSDEEP 192:sxR3/yM/jK1Ml8wC5/fzsAZZPZrUWAzoA8plJ/g6+WNpgJ/eBQxXJ0G9IgtJ:sxR3785/fzsAZZRo+f/54/eUR3
TLSH
T1AF62B816A924597BCCDBD209FA517F93D6F91563E1900E44AAFCDB0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f3b09266da89c602744b9b82aa9d45f1af7bf50da0958ef496d3e277a96b8a26
MD5 5ae38efb6a45c0ee142ef8996e119ac5
SHA1 b1cf3581107cbfa4d093f3d0caa6a69cc3ecc91b
SHA512 6c4f96f4ed85e18bd0515090318c188bbf10c3fe4db2031792a4a4a1b34f6d1e635913977db511fb00c4afe839e1107a7a9d8995d1f41d2bed397217ea401759
SSDEEP 768:0xCyDs7pLuL7ijWgbrfK18F1+UoAYDCx9Tuqh0VfUC9xbog/OViO4rVA+roJorI:0xCyDQE7ijWgbrfK1u1ja5O4pAVJ4I
TLSH
T1D3E2DC7B680CCB7E4F804A9DEC297EDE6DE802CF96D8C95447EA480C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 0b23538b848a43b72933adfce4bad79956565d7439698c08c1771ebb9973f7ec
MD5 1e32423a27cfb387b490224da61ec9c8
SHA1 2fb2c5df1e76d8289f929890a4c50fe060ce892d
SHA512 2b5fc74ec5d3dbb35d871e223b8df80a86df35e3151837d0f1cec8ad742a3c8867f7de5f783c1479275bb028eca239926ed784bdbda978fecad61cb0226327d5
TLSH
T123D0976BB1A90080DB638BC30A211AAA0A152C8C204AA08DA403251C4830A53E912FE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5903fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5903fe.TMP
Size 138B
SHA256 75c77b838b6e801ae29426e4c6d502e5bf3ad67dc7677f5a075e0218ae8f076f
MD5 e45d15673e47ea79809fa63e139d7b2e
SHA1 c2c791eeb9b001dd23435e38e91e204ad0f1e8be
SHA512 c3f47a184a6e4c978c9bc525ce07de9d3570e2468e1bab3cd30fc53c1f1a8384109409b5d828733b02059cf4090e49a35dbde254692cdd189468d4fcabd2adfd
TLSH
T1B5C02BEBB2440450C71147830732166C47092CCC5883904DB41771981030E332103FF3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9ae0693860f64597dddbc0a6d62f6ceb53a3b55803cb2cdd523c8a950d41cb9b
MD5 af657d8db9571cc389f6e7c9b4221a85
SHA1 d2641f684911eb6424ca082bcd57eb1c32c09afc
SHA512 85ef7e4de25b53893415495a97bb7807b1b1836bd7bb1168487ae37015d3ce019a81f111ba1ae8fb7430d05403636169ab019d7b73eb7205b7cf1b2581c9178a
SSDEEP 48:KccIfKF+cXyRAInKVecV1I9K+wIHyhOIXKTKQg:KccwKF+OCAwKVeK1GK+wCyO8KTKf
TLSH
T1BAC11052B13A865138BD65198194C617DAC2F077311AA82B7FE815B20B7FF029EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 affef93ad63900d9bd634994bf0f7ea2201c526b1c13539c708e197dfbefbe0c
MD5 9b4b64071782269b372d86bbe7d3092a
SHA1 4d871d4639fe28c4d4a87f227ccd78d22a786d0a
SHA512 512871c3c09e4c446e7c19811ca8e174e1b8f4704186601946d671edddeb3306742ddbda72c36e8390c31085713c811429781c760f4cd0501f901f6ef8adfba8
SSDEEP 768:Vrv+4UNbd53uikKL2StGjF669yrqUjWiIwwxMtdgF:Vbsbv3AhjF66INWZTMfA
TLSH
T10E03BE70B8588AB3C8F6D782B25336C3BF7410A396C50F88DADDA70D454B5D9274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 78f69ef466bc6f36f5e7ca24dc47f8c6b6fe56a66ca0cd1bc0e9cb9e2d04f7d8
MD5 49e1c3f9959837fe55e225d43c34bcd2
SHA1 2a2acd2a75803b9862b9b5f68b63b2b7db21fbdb
SHA512 0239fa6f3f6c550961642a998f17bb69d0cca3a4f13779dcd4c00fb3f50eb804ddbcafc52542cd987ea877213ceb589518bcf741ed8e47977af8cd147b0ca972
SSDEEP 768:arv+4UNbdl3MPkKL2StsjF669yrqUjWiIwwxMRMUiler:absbX3zdjF66INWZTMuUsQ
TLSH
T11903CE70AC588AB7CCF2D28672433783BFB4509396C50B88CADD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0120332cd9d0999832a0c0e69c8234d6abefbf28099744acb45a7a91fd07293e
MD5 939dc89bc561d21a904aede59d9d1d54
SHA1 9859fe4609a3e9d5288c458d5f4cf73fbb84aca7
SHA512 8ef76251cb93d32c6b8b34bf3f3ef0328c33a1043baffe68aa8057ca24c1318a01ea673de7d5e47dddc999972302360a1e69918095193f50c934e682af749754
SSDEEP 768:Yrv+4UNbd53KikKL2StGjF669yrqUjWiIwwxMtdgF:Ybsbv3khjF66INWZTMfA
TLSH
T16B03BF70B8688AB3C8F6D782B25336C3BF7410A396C50F98DACD670D455B4D9274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c75b2402-47c3-49f2-b70a-e30cc079e265.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c75b2402-47c3-49f2-b70a-e30cc079e265.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_cffi_backend.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_hashlib.pyd
Size 67KB
SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
MD5 c435a8d2988b2b248664a45ac26b8b14
SHA1 224adc85a39374e72de0383810aa747a7bc89705
SHA512 480a76ad73ce1942751af83fca8913e3a36961876b15341035162a121b71aa0a86e992d3b6ca54a8a7ae7d43efc24fe8a824819f833c539a2abd30c41257d62c
SSDEEP 1536:2qCcJ6CJ2GEioPMc5Wv52ztK4oIADIJy7NsR9BfIkH:xCcEyG1X5Wv52zBoIADI4
TLSH
T1F3636C46A6984092D62382B5C9E34E43FA74F6512B1197CFA239C1CD2F233C3677B75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_queue.pyd
Size 35KB
SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
MD5 ca3c81d27c1baf30131d62f290d69057
SHA1 d8c637b974f7c6d5a8761b02e145f8a1c3b5538c
SHA512 684111ef143ef891701e209857486e3172e6f1d02fd50236e591e231748ba7acee31cffb840a5cb56ba57e92c57654e461cf479cace7bfc3fabcd42442911b7e
SSDEEP 768:ZlBxk6rOVBBmMIARUb6hy5RNLaRYT2Ip4DaTxf1ml9dH3jL:ZjSBBmMIARUbmy7NsR9GfIbH3v
TLSH
T128F28DC66A689097E6A3C970C2E2DE53F575F793170086DF2169828E1F273C2A33635D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_socket.pyd
Size 85KB
SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
MD5 8a8a372bee9f3b313e44bf441fd5dd61
SHA1 802cc8454b2c5ca4c8a7754821b756d3ca248058
SHA512 bbf0362e306e0679937158647f402bd93a23f7f4270f90eff524b44b0f0af114456f8681b933424a50e3fa764b2ea5aabc67e385a02da2427c340163bf6ed739
SSDEEP 1536:ecVuncT0XH3XAJtZypxQ7XP+66wSz2/jAjI/Lb6NsQ3cs8PgMrMIAGwsy7NsR9dB:nEny2+jypxQ7XPz6wSz2/jAjQOsQssVG
TLSH
T1C5835B01AA6040F6EB72C172C2639E63FB74B5C012D4A75F5466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_ssl.pyd
Size 180KB
SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
MD5 372d2752bed978ad699a22fe125fe285
SHA1 9600c5fc4f904f65b29fb523cf9aadc9f109716e
SHA512 87c0a1385e624acfdeec9194a20d02475aac5cc965f558b40a932d955b49e70517f4691c142e8718bec283b3ab5d7671b886084792f47a236759000308716414
SSDEEP 3072:2Lj0a+17gAx5pW3kfh6CM6qMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/Uo:4+17gAA3Qh6CM33bLOUBD
TLSH
T147048C47B1946EF7D913E8B9C2234443EBB4F145332287DE48D6D6860F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_uuid.pyd
Size 27KB
SHA256 35f26f7f55ded30da92ed30258fb9624a7398ba3eadee134813133c560fcbbae
MD5 f422a29fd0cf366bbf400691c3edbf8d
SHA1 8df1f6f480e916f2ada3d7f90e1f1cbe64f8b781
SHA512 e5388352d230aa5a278cc833583940d4711b5126fe4efd3c225812bcfa8df57ee7cafda7a2975e7bce6882886e325f6b1f1cce4f1d7a588a9f854752d2d3bd69
SSDEEP 768:WPn15cwIAIwjhy5RNLaRYT2Ip4DTxf1mlIJnl:WPn15cwIAIwdy7NsR9BfIkn
TLSH
T1A3D27E8A9A784047FE935B70D1F6DE43B939BBD31A11865B317A81C50E133C1B32B26E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_wmi.pyd
Size 39KB
SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
MD5 495460dff020ae1b0ed769ca066d2635
SHA1 04dff00adde1f80ed9a367a0d7221af1968afa17
SHA512 d3171934fad631f51edd02526e6f05e43986c1bf8bc16d02877077d39bd7aa27f83efb2f27ada23e792c2a1bad8ce17bc2f0801e308f425c21d3bbae99ace5c8
SSDEEP 768:D2/EEqrVmjsyu2OQMVwIA3ilhy5RNLaRYT2Ip4ETxf1ml9dHMjL:OE9BEe2OQMVwIA3iTy7NsR9YfIbHMv
TLSH
T1A0038E89E6680092FB67DA70C5A6CE53F575B7931712838F326582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
MD5 6a2afa7e9ef97caef783732afbc5a7b3
SHA1 d1d73a533fdccc03aed6d059f2bf012172b23881
SHA512 6fde5059726a6ed57b02adadc36c1811c6b5f50976301b62136a386e4f5d5d8c9ac70a6286607c12854eadb2fb06033b2d0af88de0d6c9361e8d3c6bb1e0ff6d
SSDEEP 98304:rQEAy1nOkNM93c3PYUKMgr56ABAaMvjSL2piQHKEJn+8ingcn2jt:r26ABAaMvjSL2EQH1B7N
TLSH
T105A66C25BAA950ACC86AC4B4C38756339B7134DA0B747AEF49D496B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\launcher.dll
Size 16.7MB
SHA256 692c9606c2dc0ab1a308df729642a803f361b56527029fcf691b11a3e539784f
MD5 2b08812079a80054793321a346acfd66
SHA1 fac12907890cb6d566699fdd867dc214a72f5de4
SHA512 a443b530fabe837e6368b8fe34d0296cfdb13bd49ab00ac6fe3092fc485d5ec6689050df146e5c8d31af790ffd117e1ff7b9dd084df5605d38f9b537cdeff0c4
SSDEEP 196608:zQS2xkaSLD0v5tCAfuWj16j1stMmSbYJ2+ELAd:F3ckj1G2+Eo
TLSH
T189073C1322B50453EBF7E0755E6AE993DF30F44AD320D393A82898BA3F86D715F64258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\python3.dll
Size 72KB
SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
MD5 33282f049faffb54e4b5604f18bcb4f7
SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
TLSH
T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\python314.dll
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\select.pyd
Size 32KB
SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
MD5 220234862600483073f18e48a7860bc5
SHA1 fd000174506afa55ffe67f72b45f8bb9e572ad6c
SHA512 c4b7f64f8934c9892763487fcd0eaf4c8087679082d0bb250cc264bdabaf88fb7245ec5b54abbe412a05c397abe56729f297bff98a956f9d4d8f98310ecbfcde
SSDEEP 768:oB7YoHf8aqFMIARGLhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:oB71/8aqFMIARG1y7NsR9RfIbHHv
TLSH
T126E27DCAAB745047E6A3CA7186A2CE43F939B7A35651829F31B991C90E173C1F337319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\unicodedata.pyd
Size 740KB
SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
MD5 89acf0e666a540a8e22cac1a09f15ff7
SHA1 e11e74df8f7b7448c79f31fafd6a9ef5f1a393d3
SHA512 26c9958de86384a1bfab493f2f733e087de887f3f0c7532bf30fb3de2dd32b5942ac806b8bee1370e2f9ae67b5df7fba65fc43aa88dab78f8408c09d1c769a28
SSDEEP 12288:PPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNi:PPY05ZmDPqO54lDJPTMNi
TLSH
T1CDF4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4256_992119_rq8bLQsVWto\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1116_1207208763\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4904-50-0x00000240EA3C0000-0x00000240EA3DE000-memory.dmp

Download

memory/4904-47-0x00000240EA0F0000-0x00000240EA112000-memory.dmp

Download

memory/4904-51-0x00000240EA3E0000-0x00000240EA492000-memory.dmp

Download

memory/4904-52-0x00000240EA1A0000-0x00000240EA1AA000-memory.dmp

Download

memory/4904-54-0x00000240EA620000-0x00000240EA644000-memory.dmp

Download

memory/4904-53-0x00000240EA620000-0x00000240EA64A000-memory.dmp

Download