8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe
Size 16.3MB
Sample260723-e4cpqawtex
SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
MD5 0daf2740f8988e864810d10e466ff097
SHA1 86f945159c2debeddc26bb9ed5ad11ee9c691262
SHA512 5c0d8401b12eb6ae09c7989337bbe3ece1493e225ebbcb3fef1a2e6771045a0ca6b10c9125aff2588a61b15176aa3d7e8c07984280f856091af0b6691c6b384b
SSDEEP 393216:leuglhZR8XZOkNvj3TtTiqsswuKGB+1OUYMOUY:s8vXlg1d
TLSH
T15C07BFA9B6BC00D5E867C1BCC2965223E772B45523B057CF5A649AF60F23AD02E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292545922996783"	RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{B08FDF3E-E457-4B7C-A4FF-CFC114728C05}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3684	msedgewebview2.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3684	3024	RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe	83
PID 3684 wrote to memory of 5108	3684	msedgewebview2.exe	84
PID 3684 wrote to memory of 3844	3684	msedgewebview2.exe	85
PID 3684 wrote to memory of 3844	3684	msedgewebview2.exe	85
PID 3684 wrote to memory of 3844	3684	msedgewebview2.exe	85
PID 3684 wrote to memory of 724	3684	msedgewebview2.exe	86
PID 3684 wrote to memory of 3060	3684	msedgewebview2.exe	87
PID 3684 wrote to memory of 3060	3684	msedgewebview2.exe	87
PID 3684 wrote to memory of 5008	3684	msedgewebview2.exe	88
PID 3684 wrote to memory of 5008	3684	msedgewebview2.exe	88
PID 3684 wrote to memory of 5008	3684	msedgewebview2.exe	88
PID 3024 wrote to memory of 4156	3024	RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe	98
PID 4156 wrote to memory of 1440	4156	msedge.exe	101
PID 4156 wrote to memory of 4124	4156	msedge.exe	102
PID 4156 wrote to memory of 4296	4156	msedge.exe	103
PID 4156 wrote to memory of 4296	4156	msedge.exe	103
PID 4156 wrote to memory of 4296	4156	msedge.exe	103
PID 4156 wrote to memory of 4276	4156	msedge.exe	104
PID 4156 wrote to memory of 4276	4156	msedge.exe	104
PID 4156 wrote to memory of 4232	4156	msedge.exe	107
PID 4156 wrote to memory of 4232	4156	msedge.exe	107
PID 4156 wrote to memory of 4232	4156	msedge.exe	107
PID 4156 wrote to memory of 4364	4156	msedge.exe	106
PID 4156 wrote to memory of 4364	4156	msedge.exe	106
PID 4156 wrote to memory of 4364	4156	msedge.exe	106
PID 4156 wrote to memory of 4372	4156	msedge.exe	108
PID 4156 wrote to memory of 4372	4156	msedge.exe	108
PID 4156 wrote to memory of 4372	4156	msedge.exe	108
PID 4156 wrote to memory of 2204	4156	msedge.exe	109
PID 4156 wrote to memory of 2204	4156	msedge.exe	109
PID 4156 wrote to memory of 2204	4156	msedge.exe	109
PID 4156 wrote to memory of 3880	4156	msedge.exe	110
PID 4156 wrote to memory of 3880	4156	msedge.exe	110
PID 4156 wrote to memory of 2660	4156	msedge.exe	113
PID 4156 wrote to memory of 2660	4156	msedge.exe	113
PID 4156 wrote to memory of 4452	4156	msedge.exe	116
PID 4156 wrote to memory of 2412	4156	msedge.exe	117
PID 4156 wrote to memory of 4452	4156	msedge.exe	116
PID 4156 wrote to memory of 2412	4156	msedge.exe	117
PID 4156 wrote to memory of 1028	4156	msedge.exe	119
PID 4156 wrote to memory of 3736	4156	msedge.exe	120
PID 4156 wrote to memory of 3736	4156	msedge.exe	120
PID 4156 wrote to memory of 2908	4156	msedge.exe	121
PID 4156 wrote to memory of 2908	4156	msedge.exe	121
PID 4156 wrote to memory of 1036	4156	msedge.exe	122
PID 4156 wrote to memory of 1036	4156	msedge.exe	122
PID 4156 wrote to memory of 4712	4156	msedge.exe	123
PID 4156 wrote to memory of 4712	4156	msedge.exe	123
PID 4156 wrote to memory of 4208	4156	msedge.exe	124
PID 4156 wrote to memory of 4208	4156	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3024.4996.3654211588604249183
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffee886b078,0x7ffee886b084,0x7ffee886b090
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView" --webview-exe-name=RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,13520441803628265398,11659157555539912347,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView" --webview-exe-name=RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,13520441803628265398,11659157555539912347,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView" --webview-exe-name=RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,13520441803628265398,11659157555539912347,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView" --webview-exe-name=RealSetup_0bb9abf416fd29443b2615a5e86f342244401938b3facdedc54690149ebc50fe.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,13520441803628265398,11659157555539912347,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/download
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffee61ac188,0x7ffee61ac194,0x7ffee61ac1a0
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,17064486462047740428,18286693754373768587,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,77982940919549811,12609889059274514675,262144 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,4355964033291267853,10196913495993421450,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13857624809323660151,11576947206092919509,2097152 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,5777206347610855763,11500315954520844284,2097152 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,3080378793508376387,14598309345155670723,2097152 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,14107326882931808059,1995095969818532462,2097152 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,12076485222863037818,16596885681172245167,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11141432588809137186,5618317613285028535,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,734032510314922836,1944570160289918335,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12498972075908753017,10931758754316698433,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,544271409267556717,1366028393774693229,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,544271409267556717,1366028393774693229,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15951719741245716622,15133036757947114800,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,18414011729676177103,5050543683673199723,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3049043669801871398,636258289032494673,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9037945221069771112,7537667405642569349,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9980226277204474758,16990261713430304866,524288 --field-trial-handle=2284,i,1535696540731354523,8442304262149271044,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c107d5cf33a714a068be0aded9bac4225385ecd3f59f1705fa681e4010125f6c
MD5 aa4214cdd355dd491d7e78f2dc15f214
SHA1 60b5b7a0e0c833918c018f11fa7354bbb8735685
SHA512 aaaa9dc5718e77344760f3ebe4d3dbfe1578d67071ac4752c2addfa29e2e562b6da4ab466d0cef8231f31f45568e99edbac8c445454402bcf9b5c4cbebeb232e
TLSH
T10BD02372BE91D3D0D019303D502002403B26023123CF832310A8480CDC7404082DEECB
MD5 SHA1 SHA512 TLSH

Submit Download

3237f6ef-2b7d-4396-8173-66ada86b2aa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3237f6ef-2b7d-4396-8173-66ada86b2aa0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fbc31b209df42f123e22b302196ab4503f65c8819aa0197d063e2d7e048fb3e8
MD5 7ef747efbdb5008ab3aceda0adbdd538
SHA1 db7d21f788c541b38207d555ef88e68da9868c1b
SHA512 bf17e9b923ca370fa5075acfa8b99946acc27d259c9788b437d7351b202307d338c5b3751f356e405ab83dd57392747beeb9ae0f1afa1fbff63e65b40464b933
TLSH
T1ED811965331154A2EFE5443DEDD24AC579B270AA2A279FAA0070573D2BEDB4F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bbd9.TMP
Size 3KB
SHA256 cf843f038f296d4ba13e886733ebd4c884494d4a6f56389cf4126939c8374b22
MD5 8ba26a2497390b7df06d6d79c3db38b0
SHA1 aeb1d8602fc64fb3292fb87ba68547c6a5efcdf0
SHA512 2c4a7e24dba55cffff280215985d02b63d4dd5115a09fe137c452f8511a61bcf322a0b75802a4aa7adcc13408a8687f51ea13113c64d11b123fd60dc26217c57
TLSH
T15D71C3653352A4B5EFE5493CEDD24AD979B0B0890A239EAA00705B3D2BDEB5F0C601CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7e1b750ea386641eab41ee3b1bb4184b73089dea65347c12f51972832f6ff0cd
MD5 32acc1e24c18f99c789b7c34b541374f
SHA1 708023efda6b289622fbfff9baae0a6a42f34041
SHA512 58f52e81efbaacc870bbebabcfcc7b0068dcec95e2795f5bb795d637269f1b365cc9fa13708e303f26165dcee715a5a572d3491b20da241659198263d473eb0a
TLSH
T145616BB3C3E48A2EC91155F0A7287E26CE1D1919532C3D57CAE4EF9BA3E2871E24054E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ff1278e3a70c6c5fbb614cb06ad411db7e447034093059084d8ac1d2143081b8
MD5 e04df5759dd1f066ed6cc3c4ef51bf2c
SHA1 834ceb70dbabab5ba237bf3172108d8b4024f0f5
SHA512 a4b167677c0d1e6f5e2e3b97e91bc25ae255576fb36b8647aedc1d7f4376c33de4c9d5f5e26c39999aaf7d108cb2b7213a1dc087408e0259164b193c61fee67d
SSDEEP 192:sxZ66RIyM/jK1Ml8pjoJ/fxs5WpVq6XyuFKzIdpopHW6+WNMLro2/YQdUb4GIgyJ:sxZ66i0oJ/fxs5Wvq6XfFKsYHb4d/rmO
TLSH
T17E62D706AA34997BCCDAD209F9557F53D6F90463E2905E8499FCCA0C40E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 97d4af54e01c7e84812f900f6d521fd5b25daf384e2060f384ea690e87100a87
MD5 b38b35714a8b2145fabd4caf9f0ce747
SHA1 adbcf8decbe335339f3e2e5fd2f9b49d5582303a
SHA512 eea0712c985029f33728213a92c92c09ea6733ba9b2091daff2ad68a7fa43579d5f5ce29c6ea1257b60682cad6d8a3149b4ec78b0d42cb061c087ae0e07f3f8b
SSDEEP 768:pZ8iJ9e7pLuLfxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTVhALl6opdaroX:pZ8iJ9eEfxNWvx76ru1jayVhALocdR8u
TLSH
T181F2FA3B6C0CCB7E4F804E9CEC2A7E9A6DE8018F5A98895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec8384ae06286626a069ea0e5f4328b781bbb4957f10bb047acc0eb18ae901fe
MD5 2798c006c9f34d688592b8b8da3dfa85
SHA1 ceab22fbf17f80b19ca599793d089378d8e9f93d
SHA512 e607255a94a8fc9c4832b135522ac5ccc9c9e9d5f98861f2ddce706678979f1816a315766fcd0a160dbbcfb78669cd22c5f78b220de65810d85e47083ae3d031
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYtfo7Sa3df7z4Lv+CIjnU:KoZIhKy00DyxCI/KnqIzwI/KhuUHyF
TLSH
T175915F4675BB12453C7E290CD2A28767DA82B2673444A43A7BAC41B24F67E630CFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2848ea4b82c20c8e36ea88eea951b22830f2e89943c06ce856279bf4abf3b55f
MD5 10ba64331009e8cc0a9e834c8c7b4928
SHA1 053c1e32c101e5b6a864165c05385655db84c199
SHA512 a6b0ad3639c6bdc2ed92decc26b573667d23b1256cd821c7799b320a9d280b45c44bacd5f023f9458647f14ec107bc56cfe2b6d35d4ad900d46d249fdb33385d
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5F5DRBhPwivh50xy0SFYKRAxcbs5:gONp6kDfQmiUyXnZ903YRQiHQU6
TLSH
T1B202D93968782CBB8EA3AE49B48737275FE9113BEA952FC4D5E81A1C40D725C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 232b8fc172825bd0bc807b999538e8353ab874a40276689218f0735861e446bf
MD5 0acc61cc415ba7b68e2245d70cb16cc8
SHA1 4ab1504828583ea5e21468d0c23159bbb91daaf1
SHA512 8aeba71c9280eaac12627ae0cc804c4d66573be57ea6f8b2578367e0483063f92b81ed5b9303eff044cb790fbdde26a92bb8b0d6acc9827a93ac2377a9612e6f
SSDEEP 96:tqONkyQsjpfmUTxK5ih/cIPURHl8h4otop5FIDRB6Pwivh50xy0SFYKRAxcbsa4E:EONO6k8QmiUykn8903YHHNTcRfqYwU6
TLSH
T1DF123875A8BDAC6B5DE3A505B087332B5EA82237EBC56F80E5E84B1C40D735C270B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57ca6feec562d5f5f0e32197f5c739c62aa7370257808305cf35e264f04f1dcb
MD5 55d1bd8cbdddc9a3debc75cb2c9a8ade
SHA1 888eefcfd65951a4d1245ea08d67400ba12f075b
SHA512 1b0d4b30f8c67ec4c026a1aafdee1587b45328d4b1af1d53ecc638cf3e01fbcc67e2a7f5b15a4dbc25d2c2bd896f97f20f558ff7eb6b973e99b254e72c5fc95a
SSDEEP 384:nkZcIjsN70cdP8skVHtGJRAStiX1o0Lq0437z3OObjI9G6w7mVR:Cj2qIgS70q0437729M0R
TLSH
T144C26BB1D8A52CF745A6E8C96586E6176EF4513BC39C4A4CE2F8B73C305F9F81312825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbf46883-2ee6-4590-8de2-832bc99af1b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cbf46883-2ee6-4590-8de2-832bc99af1b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11c8548ee317443a8f161b830fa7715f48176e73a28e950db5ed21a9b77cb99f
MD5 94daffdaf22cd79b9b61d070145b1877
SHA1 952a5193df4efa79b2934f619f0d88a509686262
SHA512 fb84f1eb314c211cd3ab7f71466eebf43c99a79fe396c3dd85009bdfcda6fc383575a0743dc84f57e813607aef585af06c5e50ca9e279e85d3727305d685fadd
TLSH
T15F413A58AAFA1144B3B76F5A9BF6986D447F7C372F06C45D10110E4F0A23B00C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 548B
SHA256 6e06086bfb25fc47230c3dbfccaff32b107a6ab6240bded78be3e77ce78322dc
MD5 6e129b1923ab22e8d21dd9da0ade8aba
SHA1 08db9d3a7fc74cc6448e507d846bbe5373b40f1d
SHA512 eaeb6bb70f21aa1a61492c7abd238d1170a11abad7c1b62d734d02dd9a98b99d9156d35a15a0bd8da062f0695b603dd957132db9bc5d6d7e27a48d70bc4ad2fb
TLSH
T13EF0B42C58FF343D28604A8BB2379DCBC193F04E99857A906641400E7FD5A8B6EEB306
MD5 SHA1 SHA512 TLSH

Submit Download

19b6aabe-38a5-4705-98c3-b9f5b3d846b9.tmp

Path C:\Users\Admin\AppData\Local\Temp\19b6aabe-38a5-4705-98c3-b9f5b3d846b9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

3d500a78-fcb5-4770-be3f-8efa73d156d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\3d500a78-fcb5-4770-be3f-8efa73d156d1.tmp
Size 2KB
SHA256 34d9257c87cbf74d25a937fcdc842fc783682945fc3e1964b06216e61f8047d0
MD5 00678a27ce007caf6facc469199cac69
SHA1 2ff7032a2f7a3f7e9be9bad83fc013d597b8aea1
SHA512 b3e219a6f2dcd9b451e18442902a33760719ffa63cfad60f7c7387b420ee48fde55e84633a6085b363c162807fb37097ea9d1464938f166046a58b0070016365
TLSH
T1D35193B3A8549B7789E39685BA463F576A354271E7522FD096EC0B0C01EB29C2303C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 345e333d7a1176930cac142d9cb481cc2c616ce3aefe4e70a90ae021a077c5d3
MD5 8908e89332655f9f7c7a80e7e45b2db9
SHA1 f6f821d5e49dc1fea37c7f804221f3e5bae1ff53
SHA512 32a2075260f8cb08431024b0f7269c4d3fabc47a323ae532b3b1727e7c2bc387b677f90cd04c2ffa56a15b779ab8f9933beb8dd9819debb5ecf52647c43775af
TLSH
T179D012237202053AC010703315C2E11C0C00D91BC00580055428891E1F080900D07441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f4fe27b35897fdfe06aec1cecb5c85c818db4aab06fb20a4eb5896ad5c2e626a
MD5 19b73c693c3090d9c8861de9df1b294c
SHA1 8d8fdf239f756ad5fbc9ea8d2431923def916f21
SHA512 0850afa2c55fe21179f3c382db6c00329e01bd1d8436cfc86e89f743f0dac0013b171baae0e0ac60cf69b7983ccb34f3dd9901490d4d20cbd733f601e89b96e8
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4a9d3293-4dd6-47df-b665-5cf80b31abc8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\4a9d3293-4dd6-47df-b665-5cf80b31abc8.tmp
Size 6KB
SHA256 65ebddb5d612faa5ce291919d913350d3a85242d17b1d7b8b52ceb5a809f216c
MD5 c238a46ed9c83d1e4dda5c2b289adf40
SHA1 b8300dc8ef1bb9852dc9dd440a08a8ca56abef28
SHA512 a859154e486d4a64efb45a812b2941c89293448b3559b75ce92da9d550a6aeb5a1fa50f32dc53064a45a271c3e4fbddef9c2eedbafbd3fa0e61b5a86f8ecc214
SSDEEP 96:stU05kS040Db9SRA3ffWdZ8i0oE/klm/7qx+WVHMSm+uecadQjcP+gl6KEB:stU0CSCdfQZ8pFV/S+Wi8dvP36K8
TLSH
T107C198475E2869774CCBE21DB936BB42D2FA102275D51E98EBFC871C48E95CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 76b878e3b8e58033b3dc5707c5661df45d8a5888c0ad840f6c74a2e730d74165
MD5 084b16f6556438f229ef09b65a6a9614
SHA1 08b92ef64ba8e625c5f2bbeabac185fa80da17cc
SHA512 6835c384a87a8b5b779c9e0c1887b2de65fbe420955b125adde5b34099243e80160752517e06a6210dddd64f3e3e055835aa507cfdbc8c1276276cffc0a597b7
SSDEEP 3:LstlNllkll/lXOfl//:LsX3lEteNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 23e229669728efecf84c5120ab748772c3bf7b03fcca6a73d9b3027aff8dc581
MD5 6f74d3b3789aa841cae633fc0e44b404
SHA1 3398ab94878d39a7a51eeb4e2cd1aee34065943e
SHA512 39f0f111f54a84a4723e04ebe06680572e7215bd5f385e442dc7efa214d2d95e61dcb0ec3dee0898852d27f207103e792288ea6e6dfd886553cbfc6ba2c6d65d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 aa36d83ae7aacb73feb4a225ff0eefe2121bc033e3b342025bbd31a48e35364d
MD5 12a7a8d1628282b1bad0a783f5f9ae55
SHA1 e89d552c483d578d00fa8dc0ac16f32bf4669680
SHA512 68fc525f9aac2d2efc66210f58b5c19df33320582d11e53506a88f1949b1933d7688f36955e21f0ad2409a5e67ab1d36ed186fd356831f3d1dd6c52a1c629cf6
SSDEEP 3:LstlNllkll/lA/:LsX3lEtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 92b358d7868befba2dd15ce1a79fbc2d3faaf2fe98d05577662dd864f4dd4b68
MD5 9d41607501480e20cfa5035691d75869
SHA1 1f2b57eb326418dee9083c89e9a97055a7686e27
SHA512 cb2c88264fc939fbc0751e4c37da8b6f74c41a53379a1e8d88157c0fc99a7136ee6faa991b270045c7c15c4f35b0461fbf9648d6070b4af00ead1c205dc5dea5
SSDEEP 3:LstlNllkll/led3l/:LsX3lEtQd
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe589e9c.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Network\Network Persistent State~RFe589e9c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Local State
Size 4KB
SHA256 0a2bb26a61da07f9fef07aa271b64ef059720098dd87aae5a8da6f6fad1a1c89
MD5 f42cb83dae1120810c736029672f66df
SHA1 f75a459091cc6a657099879e2c0eba0f0bfefa1a
SHA512 b03c4bc5c0d7ee8e6bd44086e1d1618c306d51515b8fd1a08336e2998e83d4f575ad68f5ae8e8673bbddea3d9f0faa2575253fc038b2cc421cd47e36361a2434
SSDEEP 96:zuJbNkCEK/fmmT/58Frh/cInURoDotoimXD9BtZg6lyZ/a3TFlLa:zybNb6mTCooDUDgjtZ/jy
TLSH
T12681A2776874AA274CF6AA45B9863B0B36644132E2953FD8D9EC0F0D01EB3DC0302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Local State
Size 1KB
SHA256 b50eabf907a6f4b2a8457430af9ad0ff9a9bfcac4beb83e5886bb1cd595fe144
MD5 c8e80c82104944872b650c83c9b9c05d
SHA1 8c57417cde1bc2a0c715e9fbee5486d482eff042
SHA512 942c6bf3d588544a905ec51475563bed73cd213ca04a06b070b33ab3c375c58ac05a776063e35132ddf11161b8a6375ba3ec4b6288b477b4321cdb993c44c673
TLSH
T13D3185F7A0A05F72ACD2628776427A9B3D200171D2154EC4A1EC8B0D05EA2DD4B23C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Local State
Size 3KB
SHA256 c2ebb139954d6a838535a16a9904d90ea9ffaa2137f0dd50b3fbc23ad55d390f
MD5 55aacc283f97382a278721dbd886370b
SHA1 84b0c981505e1bc51581863cdbb2178b1421e456
SHA512 1ebbf2c144bf00ca5138d9479e4aab1819fb0b9a751d18c721714150c529386f0a2c2c06e926f6bcceb3e9219654df7abfd9819598c477a612b61cab482d9d03
TLSH
T16F71957768649A374DE3AA45B9863B4B7A650132E6953FD4D5EC0F0D01EB3D81342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Local State
Size 4KB
SHA256 a7028244777b3af559898b1d106d072e951528b34eec0e9f5ae2d5b30babc37e
MD5 712b354030e363e75deb44c19d19fe24
SHA1 15f59a05e3d6b9d75ddaa97cff81c052f51cd2fb
SHA512 880e526642653d784d76982a8819a2849799c4f413d16304c037ee23e5bf8977a8d39c96fec1b63a15d7ee77a7da806267e05e87a23c213a83d74f7802e750e9
SSDEEP 96:zuJF3NkCEK/fmmT/58Frh/cInURoDotoTmXDbBtZg6lyZ/a3TMSlLa:zyF3Nb6mTCooDU4gltZ/jMF
TLSH
T13491937768709A274CF6EA45B9863B0B36644132E2952FD8D9EC0F0D01EB3DD0342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe586b19.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{56ED0397-73DC-4645-BA6B-BB3DFF6C9FF6}\wv2\EBWebView\Local State~RFe586b19.TMP
Size 1KB
SHA256 45d8717b025baaf26e6f76b3a336e5da054f4a3f358f29ce30c910eae32508ce
MD5 7d486d97a4e92f6826567bd6f060e4ec
SHA1 611c48b6deb49a336030ba7019dcf5c3ec360a9c
SHA512 9e56ba50c20e0bb36bdb963188f21c23c942a54b1cd5bb6c0c20b26e86ae44befc708ce0c02ad91c5e45d9faa000f3c3f220a942942fe753502c34f9c7323f3b
TLSH
T1512140B7D0E46FB6BCC65586B542BA8B3D200171D2184E88E1EC570E05EA6DD8B63C33
MD5 SHA1 SHA512 TLSH

Submit Download

e14b1026-f763-4603-ba15-ac186ea2bac5.tmp

Path C:\Users\Admin\AppData\Local\Temp\e14b1026-f763-4603-ba15-ac186ea2bac5.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aa1daf6-28e0-410e-bc88-69ea876d3d7a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4156_25199935\7aa1daf6-28e0-410e-bc88-69ea876d3d7a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4156_25199935\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3060-68-0x00007FFF04830000-0x00007FFF04831000-memory.dmp

Download

memory/3060-67-0x00007FFF03410000-0x00007FFF03411000-memory.dmp

Download

memory/3844-25-0x00007FFF04C30000-0x00007FFF04C31000-memory.dmp

Download

memory/5008-124-0x00007FFF04C30000-0x00007FFF04C31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads