blankgrabber | 64476622e882ab6953411889eac2eb280cd257cbb539285bc6c1a1d332f6b566

Resubmissions

18/08/2026, 10:20

260818-mdfyfszgrc10

26/07/2026, 00:27

260726-ar61kshq7z10

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe
Size 20.1MB
Sample260726-ar61kshq7z
SHA256 64476622e882ab6953411889eac2eb280cd257cbb539285bc6c1a1d332f6b566
MD5 ee859206f59319637aa601fa41098b7a
SHA1 91a4c4a072bd93cb1d17553ed9e4d33f1831f812
SHA512 c7bbacb9dcf60eae566352399986861dc66ccff71c187b93f99e285c35331e41e3a65dee6b84ecfd10caf1fc5660b6c400c86581aea972c789ff814485a0520c
SSDEEP 393216:H4SvbbaX90TEZ4+xCuBkho4YbeGsFrSClVLLmXf9WVFid0B49iRqcQEUnZ5:H4AvI90TEZNCuGunaSClVLLmP8VFiEGX
TLSH
T13227338B653871D8C166937B9EF8A32CFD7A60795B84380E0A6C85B4BF973344C65393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery execution blankgrabber stealc persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 15 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c482-1152.dat	blankgrabber_exe
behavioral2/memory/1068-1351-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-1538-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-1942-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-1994-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-1999-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2048-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2053-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2058-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2065-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2069-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2073-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2078-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2082-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe
behavioral2/memory/1068-2117-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	blankgrabber_exe

Detects Reflective DLL injection artifacts 4 IoCs

resource	yara_rule
behavioral2/memory/4352-189-0x0000018B60F30000-0x0000018B60F33000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1264-2033-0x0000000003BC0000-0x0000000003C05000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1264-2039-0x00000000053C0000-0x0000000005405000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1264-2044-0x0000000005490000-0x00000000054D5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c47c-36.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables containing URLs to raw contents of a Github gist 15 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c482-1152.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-1351-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-1538-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-1942-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-1994-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-1999-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2048-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2053-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2058-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2065-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2069-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2073-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2078-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2082-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1068-2117-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c47c-36.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c47d-98.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Downloads MZ/PE file 3 IoCs

flow	pid	Process
82	5732	56b5x0mp.exe
14	5732	56b5x0mp.exe
78	5732	56b5x0mp.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe

Executes dropped EXE 14 IoCs

pid	Process
5028	j0tev7jb.exe
524	cqmtb7sn.exe
2824	WinSysKdrv.exe
1708	4nzd08z1.exe
5732	56b5x0mp.exe
1068	4nzd08z1.exe
2652	winhost.exe
5248	EmbeddedDriverService.sys
3620	rizudgpw.exe
3384	WinSysKdrv.exe
4680	qjgjudqn.exe
5880	btijx.exe
4236	btijx.exe
6008	tkpcladi.exe

Loads dropped DLL 26 IoCs

pid	Process
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe
1068	4nzd08z1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Component Manager = "C:\\Users\\Admin\\AppData\\Roaming\\wzpao\\btijx.exe"	qjgjudqn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	chrome.exe
2836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	j0tev7jb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	j0tev7jb.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134294993079406585"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{7AF734F6-448E-4972-AD3F-CEB24C6E1D22}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5028	j0tev7jb.exe
5732	56b5x0mp.exe
5732	56b5x0mp.exe
4336	chrome.exe
4336	chrome.exe
4680	qjgjudqn.exe
4680	qjgjudqn.exe
5880	btijx.exe
5880	btijx.exe
4236	btijx.exe
4236	btijx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	explorer.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
2824	WinSysKdrv.exe
2824	WinSysKdrv.exe
3384	WinSysKdrv.exe
3384	WinSysKdrv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe
Token: SeDebugPrivilege	2824	WinSysKdrv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4336	chrome.exe
1164	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1264	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 5028	2932	2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe	90
PID 2932 wrote to memory of 524	2932	2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe	91
PID 2932 wrote to memory of 1708	2932	2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe	94
PID 2932 wrote to memory of 5732	2932	2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe	95
PID 5732 wrote to memory of 4352	5732	56b5x0mp.exe	60
PID 5732 wrote to memory of 4408	5732	56b5x0mp.exe	61
PID 5732 wrote to memory of 4416	5732	56b5x0mp.exe	79
PID 5732 wrote to memory of 1264	5732	56b5x0mp.exe	80
PID 1264 wrote to memory of 5680	1264	explorer.exe
PID 1264 wrote to memory of 5288	1264	explorer.exe
PID 5028 wrote to memory of 4336	5028	j0tev7jb.exe	98
PID 4336 wrote to memory of 5484	4336	chrome.exe	99
PID 1708 wrote to memory of 1068	1708	4nzd08z1.exe	100
PID 4336 wrote to memory of 4120	4336	chrome.exe	102
PID 4336 wrote to memory of 4120	4336	chrome.exe	102
PID 4336 wrote to memory of 4652	4336	chrome.exe	103
PID 4336 wrote to memory of 3204	4336	chrome.exe	104
PID 4336 wrote to memory of 3204	4336	chrome.exe	104
PID 5028 wrote to memory of 4336	5028	j0tev7jb.exe	98
PID 4336 wrote to memory of 4328	4336	chrome.exe	105
PID 4336 wrote to memory of 4328	4336	chrome.exe	105
PID 4336 wrote to memory of 808	4336	chrome.exe	106
PID 4336 wrote to memory of 808	4336	chrome.exe	106
PID 4336 wrote to memory of 4468	4336	chrome.exe	107
PID 4336 wrote to memory of 4468	4336	chrome.exe	107
PID 4336 wrote to memory of 3708	4336	chrome.exe	128
PID 4336 wrote to memory of 3708	4336	chrome.exe	128
PID 4336 wrote to memory of 5424	4336	chrome.exe	109
PID 4336 wrote to memory of 5424	4336	chrome.exe	109
PID 4336 wrote to memory of 4748	4336	chrome.exe	110
PID 4336 wrote to memory of 4748	4336	chrome.exe	110
PID 4336 wrote to memory of 3688	4336	chrome.exe	113
PID 4336 wrote to memory of 3688	4336	chrome.exe	113
PID 4336 wrote to memory of 2020	4336	chrome.exe	115
PID 4336 wrote to memory of 2020	4336	chrome.exe	115
PID 5732 wrote to memory of 3620	5732	56b5x0mp.exe	116
PID 5028 wrote to memory of 1164	5028	j0tev7jb.exe	119
PID 1164 wrote to memory of 1932	1164	msedge.exe	120
PID 5028 wrote to memory of 1164	5028	j0tev7jb.exe	119
PID 1164 wrote to memory of 2836	1164	msedge.exe	121
PID 1164 wrote to memory of 504	1164	msedge.exe	122
PID 1164 wrote to memory of 504	1164	msedge.exe	122
PID 1164 wrote to memory of 504	1164	msedge.exe	122
PID 1164 wrote to memory of 6096	1164	msedge.exe	123
PID 1164 wrote to memory of 6096	1164	msedge.exe	123
PID 1164 wrote to memory of 3296	1164	msedge.exe	124
PID 1164 wrote to memory of 3296	1164	msedge.exe	124
PID 1164 wrote to memory of 3296	1164	msedge.exe	124
PID 1164 wrote to memory of 1412	1164	msedge.exe	125
PID 1164 wrote to memory of 1412	1164	msedge.exe	125
PID 1164 wrote to memory of 1412	1164	msedge.exe	125
PID 1164 wrote to memory of 2148	1164	msedge.exe	126
PID 1164 wrote to memory of 2148	1164	msedge.exe	126
PID 1164 wrote to memory of 2148	1164	msedge.exe	126
PID 1164 wrote to memory of 3308	1164	msedge.exe	127
PID 1164 wrote to memory of 3308	1164	msedge.exe	127
PID 1164 wrote to memory of 3308	1164	msedge.exe	127
PID 1164 wrote to memory of 3708	1164	msedge.exe	128
PID 1164 wrote to memory of 1056	1164	msedge.exe	129
PID 1164 wrote to memory of 4644	1164	msedge.exe	130
PID 1164 wrote to memory of 2196	1164	msedge.exe	131
PID 1164 wrote to memory of 5364	1164	msedge.exe	132
PID 1164 wrote to memory of 6008	1164	msedge.exe	133
PID 1164 wrote to memory of 1744	1164	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4416
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-25_ee859206f59319637aa601fa41098b7a_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\j0tev7jb.exe
      "C:\Users\Admin\AppData\Local\Temp\j0tev7jb.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4336
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd4542c728,0x7ffd4542c734,0x7ffd4542c740
        6⤵
        
        PID:5484
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1808 /prefetch:2
        6⤵
        
        PID:4120
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1660 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2460 /prefetch:13
        6⤵
        
        PID:3204
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2140 /prefetch:1
        6⤵
        
        PID:4328
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3240 /prefetch:1
        6⤵
        
        PID:808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3560 /prefetch:9
        6⤵
        
        PID:4468
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3524 /prefetch:1
        6⤵
        
        PID:3708
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4240 /prefetch:9
        6⤵
        
        PID:5424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4464 /prefetch:9
        6⤵
        
        PID:4748
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4844 /prefetch:1
        6⤵
        
        PID:3688
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,10404568398203205601,9056197165760778118,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5144 /prefetch:14
        6⤵
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2bc,0x7ffd415cc188,0x7ffd415cc194,0x7ffd415cc1a0
        6⤵
        
        PID:1932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2540 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2508 /prefetch:2
        6⤵
        
        PID:504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2772 /prefetch:13
        6⤵
        
        PID:6096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3548 /prefetch:1
        6⤵
        
        PID:3296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3700 /prefetch:1
        6⤵
        
        PID:1412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3984 /prefetch:1
        6⤵
        
        PID:2148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3988 /prefetch:9
        6⤵
        
        PID:3308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5056 /prefetch:1
        6⤵
        
        PID:3708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4128 /prefetch:9
        6⤵
        
        PID:1056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5108 /prefetch:1
        6⤵
        
        PID:4644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5220 /prefetch:9
        6⤵
        
        PID:2196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5256 /prefetch:1
        6⤵
        
        PID:5364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5368 /prefetch:9
        6⤵
        
        PID:6008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5420 /prefetch:9
        6⤵
        
        PID:1744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3652 /prefetch:9
        6⤵
        
        PID:4484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3512 /prefetch:9
        6⤵
        
        PID:2780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4068 /prefetch:9
        6⤵
        
        PID:980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4072 /prefetch:9
        6⤵
        
        PID:3436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5432 /prefetch:1
        6⤵
        
        PID:4784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6472 /prefetch:14
        6⤵
        
        PID:2156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7320 /prefetch:14
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7356 /prefetch:14
        6⤵
        
        PID:924
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7204 /prefetch:14
        6⤵
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7204 /prefetch:14
        6⤵
        
        PID:5244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5948 /prefetch:14
        6⤵
        
        PID:3096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=8512 /prefetch:14
        6⤵
        
        PID:4556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=8376 /prefetch:14
        6⤵
        
        PID:5748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=8244 /prefetch:14
        6⤵
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2512,i,424896399201422717,7557050892745500131,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=8204 /prefetch:14
        6⤵
        
        PID:972
  - - C:\Users\Admin\AppData\Local\Temp\cqmtb7sn.exe
      "C:\Users\Admin\AppData\Local\Temp\cqmtb7sn.exe"
      4⤵
      Executes dropped EXE
      PID:524
  - - C:\Users\Admin\AppData\Local\Temp\4nzd08z1.exe
      "C:\Users\Admin\AppData\Local\Temp\4nzd08z1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\4nzd08z1.exe
        
        C:\Users\Admin\AppData\Local\Temp\4nzd08z1.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\56b5x0mp.exe
      "C:\Users\Admin\AppData\Local\Temp\56b5x0mp.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\rizudgpw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rizudgpw.exe"
        5⤵
        Executes dropped EXE
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\qjgjudqn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qjgjudqn.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4680
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
        6⤵
        
        PID:2824
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"
        6⤵
        
        PID:1076
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\wzpao\btijx.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\tkpcladi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tkpcladi.exe"
        5⤵
        Executes dropped EXE
        
        PID:6008

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:5248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3760

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
PID:3384

C:\Users\Admin\AppData\Roaming\wzpao\btijx.exe
C:\Users\Admin\AppData\Roaming\wzpao\btijx.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5880
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:5904

C:\Users\Admin\AppData\Roaming\wzpao\btijx.exe
"C:\Users\Admin\AppData\Roaming\wzpao\btijx.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4236
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1983a21f-2fa7-4e08-9151-4c5625a68570.tmp

Path C:\Users\Admin\AppData\Local\Temp\1983a21f-2fa7-4e08-9151-4c5625a68570.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4nzd08z1.exe

Path C:\Users\Admin\AppData\Local\Temp\4nzd08z1.exe
Size 19.5MB
SHA256 5a418d9f12f18fb3922224721ed7dee7603b3b0da5bf7887954fba14d456ae63
MD5 6df9e371b752fef626c6f6a360cb4388
SHA1 19b14f6fb0301698e43b590e4d97a3adba6a3c86
SHA512 30592e25fc49dc78de951e8f749b073eb1864aceeffcf5be0a5c973dd87ba3c469f7f683432d898dfe1e83beb43eade461d1b824c6d859d37cff76c5650565d6
SSDEEP 393216:NROekA3ohxfLUwON1EX9QdgQEYplB/j0vrxuinlX09dfAtL+iA4REjFV:NRKnhxfQdoYgQEYplB/jirxXXOgLoUE3
TLSH
T193273336D96334F8C34FD1B8668338D06974FDE84834B8765569BA3A2B4E7F1CA69301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56b5x0mp.exe

Path C:\Users\Admin\AppData\Local\Temp\56b5x0mp.exe
Size 57KB
SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
MD5 51242d1f06d41c80ea8c6fa541be3d6e
SHA1 a01f91e44b2a59f24b9e9c72e46e2207b6f86526
SHA512 bc7bde4ea9431f0e7c5345ea9cd1da7ec2f6a27da9f0bcfbd86b15dcfb2df3f416603d29986b849668b5e85c73678b76ad518d98cdecc6b8ae504a284fd90ff6
SSDEEP 1536:sKWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:sKm5dAppRdX0jlP1wT0E
TLSH
T184433A58A6DE624DD836D4B5D6A5D333FBA3F8427235974F0132C91E0F22B26BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4336240722859\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Crashpad\settings.dat
Size 280B
SHA256 c578822bbc30823fb31d09d1073e172ff41bd464fbabd675f7de121c29d644af
MD5 3c2639aab92fa5eaf9992d36e036cdb6
SHA1 75f93e18f4b8813a05648668cac01214296ec3d1
SHA512 eb68a1963fbfffa3a1f31db5d80c676b85bf9488eb08f7b5f553eeedd3e30056312f6bd13d283069eaf7cede9ea0317a71c0ec54db4b3296ac73fe9e3cb77825
TLSH
T1FBD011A8A2082208CE80A032A8E2A2200E88C2A0A23308202020A0002882200ACCA8B0
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Default\Network\Network Persistent State
Size 1KB
SHA256 374b9754c061f445f8c93b4d5205a0c92100018ee5a9ccb764818092051d9999
MD5 35708c8f8f8243688e7484779a8d5f04
SHA1 9b61d9010ec1ee98ad19ce3817cc47097cb6e2cf
SHA512 68541babb4a06d4d7546034ef5dd12823e95826f772d35b9dd2d6694d2a82c4c86705911a0a1ed0499e25fb118a4214c48ba05cb242725ad93d4a52587a02a8e
TLSH
T16A31AAF7C2E8856D890156F4FB196E1BCF2D0954832C3D5BC4E4AE2B93E2870E24059F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Local State
Size 4KB
SHA256 d5b78d05af965893f43fd4c347d037a917cc10f470a07d64e0c25960bf3e6fed
MD5 025c0acb3bd5d5a98fd0095a9c762a93
SHA1 11ef5eb5cfc8cc92cf3a293a7c1d94b75198ec87
SHA512 c28343258550898e4a27f631ae78b56be4a66829c77216f2c1ab1543bdba5feff0983cd97c37f4356f4b775a079d033ef418500f27884082b46330a93df6805b
SSDEEP 96:1qGNkRQsFfTmdjtdO58Frh/cInURcDotovbwDVB3FvvFgR0eUcBEmHpq4a:MGNFv/dNocDUwarHgR1/q
TLSH
T13BA185766878BC7B9EF29E45F58A77136FA42237E1943FC4D9E80A1C01D729C134182B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Local State
Size 7KB
SHA256 516bad011aa183c0243bd0071f997c8f42a323e755fe73843a72239364183e98
MD5 3e53c46afb5b6cc2289a4a90bdc6cefb
SHA1 4e8701b9c2efd82c3db310126357203a9e3da8ce
SHA512 a75164b9db69f0df401eac32539c44cd67f0e3e7f1be00077e4a068b662ae68e5e692070f90565f3f946f372f73c66fc96a17f07d0c2ed6ff6b9084ffbc505b6
SSDEEP 192:uuuL8NkQ3ZJdSocDUurZSv9Hw9R1/goc2n:nk8NkMbGBK9HwEoB
TLSH
T12BF1E57268B4AD7399F6AE05F64E37135FF420A7D5942E98EDD84B1C04C729D134282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Local State
Size 3KB
SHA256 922211077ae91ab6f6da33667cb1a1e4d4a4562117309630120e609442302cb2
MD5 8fcee2678e2417c9ef65d20bcff1aa94
SHA1 755fa89f940d7d0162eaefe3798b93da9982a376
SHA512 3acceabf9b97b59cddf59b69906fdac1d1e5ae1ac0e4cd58c1de4d8d2120b6d386715c3ea8ac3ca2eecceeff5e1c155ff18152b08ed11016b1a1e4cbf61db2ed
TLSH
T1358184726828BC77D7F29E45F64AB6138F783267D2612E84E9D8061C00D765C134583B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595bb3.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\Local State~RFe595bb3.TMP
Size 1KB
SHA256 f0c59fb8f3ed550012e1e788b0ff5653280d3b69643bbf0ceb65dc377044bd5c
MD5 904e486a5398767babac282715d764b8
SHA1 72dcc42261ea318b3e553bffcab96c3002302752
SHA512 7265b624c534da4dab1c1cd6a96843d886802ee34510c02635cb6f7bfd15fc12f48df7805b2e45a12fa413578cbbc372ac450bd6c3a20f9cd10282ac1ab84e85
TLSH
T1853162B1A8987D3BF8F19649F349F7A31E3422B1C2556EC8A5EC061C01E369D165AC3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1164240734703\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

_brotli.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_brotli.pyd
Size 836KB
SHA256 1e4cf067342ee168410560db9bbba370a1b609abc028bff61a3dcc1274dfcd16
MD5 edb74f5271682cfac5428582828cd89e
SHA1 49130d97fdaec012db24ce4ce42d2e270ee53bcc
SHA512 1a47c08e10e79e90a69979a7b3eeadf8288c53e96b33089495aaefee546c165004197a6674051b1cfa169fa796d383e9996367fb215ba94161eb704ab82de895
SSDEEP 12288:HG17+oU95/FTDTfikAHhlyq8hnnb3xKWulsONs:HG1ytb1AilgWulsON
TLSH
T1FE058D0BD8B35779CC27C4798DAB1336EB357568530089A7B258E5313B43A141BBB3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
TLSH
T108537C05A69540A8D96781B9C8A35F57F9F2F1011B109BEF0368C18D2F237C3A6FB766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
TLSH
T1F1834911A69050FAEBB3C0B6C1675E23FBB4B4C01390938F1156C66A5F33782BE7DA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tcl86t.dll
Size 1.7MB
SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
MD5 b0261de5ef4879a442abdcd03dedfa3c
SHA1 7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA512 e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
SSDEEP 24576:+AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDA:+A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDu
TLSH
T1A5858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tk86t.dll
Size 1.5MB
SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
MD5 ef0d7469a88afb64944e2b2d91eb3e7f
SHA1 a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA512 909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
SSDEEP 24576:gR3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbi:SeFSpvzg0RwgVdF9EWyCzfdmHQnveD4r
TLSH
T19D754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSysKdrv.exe

Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
Size 147KB
SHA256 be495b5cd25cba230cc88aa99d34f2f7b70201b7047ae7a605950756acce215c
MD5 e57325406173324144960bbafbad6a11
SHA1 f9fde8480bb883016207f154dd473e56d629b36f
SHA512 fd0ed85d29948c512cb072f13d2046677318dc4af588a1b7507adb538cc0227bb00634204feacb7840f0e3fc21b26074b6dda61d1737156e38ea41f918719686
SSDEEP 3072:zEM70gfA56h/elpYxyB+yLgFeOWX+LIbnZz8EN9lDt:/xf7rxyBNdOfUHJ
TLSH
T10CE35A4363E920E5F1778638C9A58646EB71B8320720ABEF07A0465A5F237D1ED3DB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cqmtb7sn.exe

Path C:\Users\Admin\AppData\Local\Temp\cqmtb7sn.exe
Size 265KB
SHA256 a09b8f3482137394a421f6a96eaa3664f468ddfbcdf01651dae8fc0898e9a13e
MD5 b31e9f2479f734538e6a378656f05ceb
SHA1 1a716ea4ead1f0bb4110689494fa6fef7dc3cfad
SHA512 32ea8aae9f44b49511ab02abfce662fd7eebb0c5d9ceb6f2ec652279f3185d1403e189d98f6502ec0780372b704c1a6401d6cc6f9a6ea490fc5534b75006250f
SSDEEP 6144:FJHTrrdy4gptRY/6l6Zaoxf7rxyBNdOfUHJF:FJf5c2SlI5xfMBNA
TLSH
T1F3447C4663E524F9E0B78238C9A54B46E771F8621330ABDF07A0865E1F233D1AD39B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j0tev7jb.exe

Path C:\Users\Admin\AppData\Local\Temp\j0tev7jb.exe
Size 174KB
SHA256 8340ae2ef074b5a1ddfeb096b40c2f077df463724a8ec3b43048054ce445b7f9
MD5 7d19cd47b52d03386575c4c0c51a7aec
SHA1 4f71d4f15b834cfe1c8480e8deae6727f9a6a5e0
SHA512 87cd92af583576efca9b1a9a0bd21a87d00f1c4c00c5fda4bc5150d239708e73923baeae53cb36f0e04fff5410a98244b4555b2a56c683b8803f399fa27ced8f
SSDEEP 3072:qxXhl4Hv1IkdSE+yAGz5xIeGPg40eSxhSuB7kJ+peatJhp7Kk0gFtn:IMyxGF+eGPg490zB2+peatJ3agFt
TLSH
T11404395BD4D551EDE819CA38895AE233A4B3FC5A1935BA4F1BA0DF121F90B30B71AF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
TLSH
T11E839D93E76665B5F46B82BA99C10323E730FD150350939FB384831B2F22F927D6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
TLSH
T142F33A92A394F4D5F7628C78D6624F17E7F678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_queue.pyd
Size 31KB
SHA256 d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
MD5 5aa4b057ba2331eed6b4b30f4b3e0d52
SHA1 6b9db113c2882743984c3d8b70ec49fc4a136c23
SHA512 aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
SSDEEP 768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
TLSH
T13DE28E83AA946C9AC423C47194D66E35F971B7525700C7EF3318C25E1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_ssl.pyd
Size 173KB
SHA256 2b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
MD5 6774d6fb8b9e7025254148dc32c49f47
SHA1 212e232da95ec8473eb0304cf89a5baf29020137
SHA512 5d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
SSDEEP 3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
TLSH
T116047C47B6942DB7D813E4FAC1230913DBB1F015331257DE49D5D64A0F07B0AADAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_tkinter.pyd
Size 64KB
SHA256 2cad195ba200cd94702403559323c7abf3772a20203a11beae03770a04437de2
MD5 ed2305190284e384a31337094c9f5239
SHA1 eb8faebf9fe9438541ca65b9892badc2233a405d
SHA512 139c83ebf748720e64c7a6a8f00f45755d17cd8f754cadc0804ece5753c02e5c95210a8b96a92fff89148ba34568f8b1bd6c33d1d3ba7a75f881446956876893
SSDEEP 1536:uRvfc/1Zb3YuY7S81CG6O6mdIvOSz7SysxLR:Qvuz3hKSpG6O6mdIvOSzs
TLSH
T177536D9BA7A0009ACDA7C479D4B35B23DA7575110A10938F0298D35E2F337E3A7FA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\_wmi.pyd
Size 35KB
SHA256 0342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
MD5 cb0564bc74258cb1320c606917ce5a71
SHA1 5b2bfc0d997cc5b7d985bfadddbfc180cb01f7cf
SHA512 43f3afa9801fcf5574a30f4d3e7ae6aff65c7716462f9aba5bc8055887a44bf38fba121639d8b31427e738752fe3b085d1d924de2633f4c042433e1960023f38
SSDEEP 768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
TLSH
T109F27E56E7641844ED37C6B998D64E1FE672B6468710C3CF3358C25A0F223C2BEBA364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\charset_normalizer\md.pyd
Size 10KB
SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
MD5 52726cc0c88dd2c0b528dcf1e936ea88
SHA1 edb91fa3ba8f1a128b581c297621c495e5b90f1e
SHA512 48d432cb6e3f6ed76be4ab2079f00b44b4ad9022f9f6c66ba925b4c5dddc8a4a851c3aed901b694b7bd658d98ee32df8a6bf8bf65b5f13c9a6df8642a7b46c97
SSDEEP 192:M6dxGrmoX+sMl/++Ch9p8mBd1pcVL58A0JH6:7dx4m446BDXcj8Ae
TLSH
T1A022085CFF6458EAD9268134C9375E4AB132BB22170277CF8770906A2FA37F26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\charset_normalizer\md__mypyc.pyd
Size 124KB
SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
MD5 1bb4e612320cc2aca375db74384ed88a
SHA1 c706ab2e599a656b9f9dd2344b890215a41cec49
SHA512 beac2a1628d5fbe7e2f7a17e41afeb7c5e84fe5fde9de6a87a19dbf42a022e8ca6fb5d49e38d9bc0d5e2949cd86f63207ab6fbbcb710701a33b585cfb2385597
SSDEEP 1536:Yn/j8rmzdfRYc0L/JBffqUpMJ4pNuk6G4JdeqBSQxwg1uZ1geLusbq63a:Yn/Irwqci/JBHqUpJuFPeeer9Lusbq
TLSH
T1F6C3192762950077CA634279CDB7A512D7E1F5510B3263CF04A4C6A95F03BEABEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\main.dll
Size 33.5MB
SHA256 694d204819fc0cccb749ec33ee9255fd9f144b0892d7b7d812689bcee5cd5675
MD5 b29c49122ddc005fb163c536df8ca095
SHA1 a2f79a947ad3fddebe7bb61dcc5525fec0c4ec89
SHA512 fed91b9737996fb5e352d9e26e149dad0f432108867b564c280ad2d523ca20c1c1f79afc9362bfcf101c4cb3cd13f325f6e1c6a0ff82eed54557ad58dc4d684c
SSDEEP 196608:dyPCjpxLostBfjAUGey5QclYYVsQu7D6IYz2:IaFx/fhGJSkYe0D6v2
TLSH
T1D8772C03E23230BBDA56E0B14F5AA5736A34F82D5130BDFB75D88A352B16C719F2C658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\python312.dll
Size 6.7MB
SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
MD5 48ebfefa21b480a9b0dbfc3364e1d066
SHA1 b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA512 4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
SSDEEP 98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
TLSH
T1C5665B127258C0AAD967A0B4CC23C6CEE7B1BC51BF50530B30AAB35E2F73796465E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
TLSH
T154D28E576B642C49D823C9B2A4D28E26E931B6565710C2CF3368C15D1F327C37BBB369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
TLSH
T1E6354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1708_134294992798420296\zstandard\backend_c.pyd
Size 513KB
SHA256 2ce792041f2bf7d8a8f514f0fb5adfc7778e56e988491e6ac7f3438c2e8cb3d3
MD5 0ce2701c3145f661a16df26f4bb6a4aa
SHA1 03a0caefa981b23e222641453aa29cdf6c03cbec
SHA512 45cdc5b6f0eee08ca78d2b59c1af0e49bc5244b6412fd011e5b42830f496fba672d9f0363483d64f3762a8ad6a8773e2c926c66bab30e1164cb91fb2df809f77
SSDEEP 12288:vF3JV2JW18NV66XiHRP5evBftoKcUJmWWaC:vYU196XiHRPMvBfbq
TLSH
T18BB48C83F29953EDD13BC478C66A9617FBB27409132466EF82D4DB653F13BA0963A700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjgjudqn.exe

Path C:\Users\Admin\AppData\Local\Temp\qjgjudqn.exe
Size 357KB
SHA256 776d0938c28d05163fa083ed1455b462b1266c22b81506071981af1b368764af
MD5 5c679871fa1161cdf87b4dbd05dbd19d
SHA1 00f1213b9cc91f8d14d42c79bd5a006fe4a08e78
SHA512 5edfabaf1aed9e0be9e3d40d1ccd2fcd95bdc48d9348459bbe16a77a7050ad8a4a1794d29a6463c021ee14223a78dd5aebc67338faedf7786089f8ba4a1d95bf
SSDEEP 6144:DLjOMiQPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVM+5:DAQgDjoOktsORmQf07iSvN0hs
TLSH
T19074F147FAF432E9E1264678C4750E06A73AF4BD0A348D6F035C42696F366E19D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1164_769755213\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tkpcladi.exe

Path C:\Users\Admin\AppData\Local\Temp\tkpcladi.exe
Size 771KB
SHA256 2e76d6a4c45848c9a1bbe5ffdf3b6a17050789b50b27584b8b2ca850ee022987
MD5 51281be022faea9c9a00e0b324a11ecc
SHA1 28528684dc899c00f00a95541d767da2fe5bda55
SHA512 d277bf12f8b6b8a07bc874023eb50913b2b666760e81158e24b5de61943676a934df6de7a79b1102ee71eac30506463596788356cfb9c5eb392058b92d097aa1
SSDEEP 12288:fJmtSx7mW7LciwFZnlMf6r60dMIGyxBlDetAqxSvSc:RZ7n74iwFZlC6+6MIGybq
TLSH
T199F49D1AF7A502FCD07BC175CA524952EB72B8565330A78F03E14AA61F376A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 ef57f56c51105a3b792e82819402e6c52ebe741509191ba8602a4e13102dffb3
MD5 72aab0c0aa18fc8c7378f70d444f1701
SHA1 c7534c6c2ebfa06d8a3b24543f8db736b094be16
SHA512 4fdbf7fd5ea66604d50b1bab8ce84ea6e4be60ca2159e95ddd9c55ad8b2ecac1cbd20210464c02aced8eb741b67b0e71e1041c08de8bb3681166f4f1223076a5
TLSH
T10A81BA54DBE64E9BF2F3EAB244B367206B3BF80956088A0D048942440C63A5596EDBA7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-1994-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2053-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2117-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-1538-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-1352-0x00007FFD41EB0000-0x00007FFD41EDA000-memory.dmp

Download

memory/1068-1350-0x00007FF72F0E0000-0x00007FF73049B000-memory.dmp

Download

memory/1068-2082-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2078-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2073-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-1942-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2069-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2065-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2058-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-1351-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-2048-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1068-1999-0x00007FFD3BB10000-0x00007FFD3DD14000-memory.dmp

Download

memory/1264-227-0x0000000003530000-0x0000000003531000-memory.dmp

Download

memory/1264-2033-0x0000000003BC0000-0x0000000003C05000-memory.dmp

Download

memory/1264-2032-0x00000000012B0000-0x00000000012F0000-memory.dmp

Download

memory/1264-2036-0x0000000001290000-0x0000000001291000-memory.dmp

Download

memory/1264-193-0x0000000003500000-0x0000000003507000-memory.dmp

Download

memory/1264-2039-0x00000000053C0000-0x0000000005405000-memory.dmp

Download

memory/1264-2044-0x0000000005490000-0x00000000054D5000-memory.dmp

Download

memory/1264-225-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/1708-1347-0x00007FF72F0E0000-0x00007FF73049B000-memory.dmp

Download

memory/4352-189-0x0000018B60F30000-0x0000018B60F33000-memory.dmp

Download

memory/4352-205-0x0000018B647B0000-0x0000018B647B7000-memory.dmp

Download

memory/4408-207-0x00000295BFAF0000-0x00000295BFAF7000-memory.dmp

Download

memory/4416-209-0x000001F5A9F70000-0x000001F5A9F77000-memory.dmp

Download

memory/5028-1991-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-2050-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-2061-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-2060-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-1346-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-2037-0x00000000006A0000-0x000000000071C000-memory.dmp

Download

memory/5028-1515-0x00000000006A0000-0x000000000071C000-memory.dmp

Download