a0078e54f5b79d17bcdd7fe2291099c5ada5904750f2554c7d3465175a9e141e

Analysis

max time kernel
23s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeMod-Setup.exe
Size 155KB
Sample260727-1ws8dseq3y
SHA256 a0078e54f5b79d17bcdd7fe2291099c5ada5904750f2554c7d3465175a9e141e
MD5 a99d309a683c64fde4d101f00a286aee
SHA1 1e795dbb1f98d1ea83170abbfda3a496e80a885d
SHA512 ca55b39837f541903f9758f86713fcc4929ce398d170f9c2665ed0553766e67f84356504d049500fda2f4baf9c7d503385f46c8594de8264050d85ebc20e5a80
SSDEEP 3072:w0x45QyUyhaEtHZeO/deV4ILlCI+40OHHBpF:145rUwaEtHUx4SF
TLSH
T160F3AED9E3E815BEE6BB8DBA4C351DB005B7AC421CD5ED5A1D8070A84A33354243BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4060	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4344	WeMod-Setup.exe
4344	WeMod-Setup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4888	4344	WeMod-Setup.exe	89
PID 4888 wrote to memory of 2068	4888	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download?osVersion=10.0.26100.0&brand=wemod
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ff88f84c188,0x7ff88f84c194,0x7ff88f84c1a0
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,13500227100812076345,1006729810024561000,262144 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,2008323133676837146,1229862820345837016,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,9039661274069556226,5571304365848120392,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,10260564900058011966,6614045217337512730,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,17505517361487560543,14245047545982488408,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,8764081037931556662,8911062037509015091,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,10750622325320222977,2375494409114004018,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,8170217273710906348,10636868911197278993,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,13934685316760939471,6313011720893906419,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,8937966909312732094,4790035371133921286,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5948,i,6671994147233980878,5195117887127364714,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,2200996655146320377,3912304198875848967,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,9024115682556499526,6666992812285386660,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,13672555147446644311,17744505345237056852,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,14201283499810013155,17528245554129190514,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,13672555147446644311,17744505345237056852,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,12183998220310778222,1110114476600040801,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,2269417854380959270,16903934383419499537,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,4610998266355426976,1257537298955442677,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,886334659115156703,1026695136747126180,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6407523956833267990,8348709180950723769,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13056561842518831430,11945922031974202314,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5640,i,6272014623497494261,6087782805832303124,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4680,i,449934923759677304,15193662008056265070,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,15353382474803554009,12488811573761160964,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7748,i,8122454933227034268,80495950791864512,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,14358846308309569624,10514316631003585709,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5032,i,11164832179839790455,7377146098623077086,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,5634176775228801423,17827346029354566182,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,7448026380292654040,17969199595546874252,262144 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:10
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6220,i,6295082239431050442,12479852329762549903,2097152 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,218831684353780898,12194662370455298113,524288 --field-trial-handle=2500,i,14358758726917657148,9759377585527661417,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download?osVersion=10.0.26100.0&brand=wemod
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download?osVersion=10.0.26100.0&brand=wemod
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download?osVersion=10.0.26100.0&brand=wemod
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.wemod.com/client/download?osVersion=10.0.26100.0&brand=wemod
  2⤵
  PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d5d0986890f89d455560491dc9d43350b8b00e9c6b3dfbb7ad4052fa7c02942e
MD5 303b0f0e7a8e0d4aca96b4f931dd89e5
SHA1 98c3667d240ed06cd462b5147c58d388c2153915
SHA512 3997ad6e51d3c44e2a1062b6b789e8694061350d7234a1046aac327fed38543011f660cc14387123f048498cb6538c1d10dbfaacea067309a01839dcf8e5b7b4
TLSH
T16451B57133263EF2DBFA497132E1625832FDC44902BB1E25B0A06D345C2AF99E9D1063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bc61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bc61.TMP
Size 2KB
SHA256 83856be85daa4449e851dcbb2a85ea42cfc2abbce6ae240b04877a9895d6a6e8
MD5 bd846af9f3431d6ec4dc34480a27815b
SHA1 4c1c8d4df18c0debf95cc077ef92c527a746988c
SHA512 7d6632e8cae9030aeb531fc9805645cfe0a44d9cf3ab0eb905397190cf3a01c28a986911a736cfe93e8a98b263f25cbb0870d8992109630eed427803f3a768f8
TLSH
T1C75184B133267EE2DBFA497132E1625832FDC44901BB1E25B0906D345C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d5659922400bf2b25034b0bab62f8215bec9dfc6024a11e7a8036d8628d3a585
MD5 b19be137f1b2b6660b6744ce986941d3
SHA1 20250ce1fadcdc68a4e5d7d7cb03d4c65e586671
SHA512 2843dab891e7741f04ee42ee92315472da2066a60286f132fd3263cc428f386dde7c8b95b2f0dd656d8b55ae765f289f21bab09473bc987402933267cd689f47
TLSH
T1B471AEF3C2E8862DC91556F0EB147E2BCE2D0914832C3D5AC9E4AF5B93E3471D281A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8b70aa29a1b387d9c2c542b5466b58aba0bcd7d5e6c361bbf6206bbbefe2e5c8
MD5 5f01d37ba657db9b56c00ca092d8f42a
SHA1 d2dc73a6df0794379d62569db452de2a2c6ccd9a
SHA512 16fc9941a0a8aac470f3bbab37bf231957f19dc7d232aa79fe25675b8f1db1535af7d72c7474fcc9977b50fc653efcbec2cf3dd0c26ec71bcdb44b4b25b61257
SSDEEP 192:sxR7RQTw/fyskDDde5lSyzoD8pi/g6+WNIYCsuOHGcIgVhJ:sxR7kw/fyskDc5lPi/5IeJJ
TLSH
T10632B6166E28993B8CCBE20DBB55BF53D6F96032A1D01E58E7FC860C14EA6DD230750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0e2522329220c71644fc32a76e64a4a7a71b9071cae11be6485008db363fc60e
MD5 0c998484ba31b885c2729bd6d008b542
SHA1 cd981a1d89d8945831eeafa9b2fa3d842b38b2cc
SHA512 29e564983cb8ae699392bdc740f6c4184558ed3a1ceaf94d5b83a21d6a1a0dba3fddd82ecf7afd39b85c7ede8d04cf3f6d29918396d252041989799c639b586d
SSDEEP 192:sxR8RQTw/fys3DDde5lSyzoD8pi/g6+WNIYCsuOHGcIgDkpJ:sxR8kw/fys3Dc5lPi/5IeJi
TLSH
T18D42B7166E28993B8CCBD20DBB55BF53D6F96032A2901E58E7FC870C14EA6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 52fd39fc13c2ab5b7f4ca962f36e9af5707df3a343050e731cb5197d6691310b
MD5 e29d2606eb00803dbcf2d7e33b5ae8f7
SHA1 539b1e9f0dd76cb6c6caea779688d322ead2dfc9
SHA512 aa8785719af1f84c67bbf4785fe7cdd38a66a9da0410523da8ddb4cdc80f1d6d52a4fbb264cbf9fa3d2be92602f314047b2304f544c9551a17a453110e30274d
SSDEEP 192:sxR8RQTw/fys3FqZY2ETzoD8pi/g6+WNIYCkuOHGcIgDGiaPJ:sxR8kw/fys3F86i/5IOJM
TLSH
T15342C8166928993B9CCBE21DBB55BF53D6F96033A1905F48A7FC870C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 af98eede31a4aefe5cdb0316c707c7c3b1869242d8f9e646e988e6f710fa1244
MD5 77c6a7385cc6ebd7f32818df1a435159
SHA1 02938f11319e51c3dbca1dd054196ee8ff5cfc4a
SHA512 0aa737ca1aea7300515a942639fd40eca8c05ffd8c4e6acd87b31166ecdfc37bae07f6ba29d824a8b11ac3d24770da03cecf6d1a6ad08e00f9755a06fd6203b7
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtQqcCroZl:jC+vA7E7JQWgQ+f4+u1jaGVcZH
TLSH
T17DC2EA7B640DCB7F4F800ADDED197E9B6DA802CB5698CD8047FE941C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b97cf90-376c-40cd-a33a-b10e80153ba3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0b97cf90-376c-40cd-a33a-b10e80153ba3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 08099b6a0f72b00b785369fa00dab564c2e8e4e1afc39fc71861935b67b40818
MD5 2cc22181ae83397c952a479caac818e2
SHA1 e986d76ea750ffcac383e478acaa7481c55c3df8
SHA512 ff6ecd82df0a35604a50268bf49dc74ab67e60b57cd3a2cb9722ee31c1ecd83b53a8ffd14666514b1cedf668ac9b7a3a25b87d51591b18047939fb2ff3fd8491
SSDEEP 768:LX34ZHPgFCtQIgp8+p3bd66j+4BRv86aLIW4b9Mh:LX34ZJ+8+p3Z6n4yGb+h
TLSH
T11CF2AEB2EC69CD338CF5D755B29637836EF46173D6C00E88E5D9AB0D055229E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ba31d563f2a1392e3d2a12bc8d82034a7b2356fa3f36edaedc272b5268d0528
MD5 824bd97f478e322d6fe58380de26979f
SHA1 de4697595c3d29ab1b20bc21f02da51d36b9563e
SHA512 eec40d35653dedcb85bdf31d56ddc56c3842453e26e4e145ff9cd96fa57ed8d638567c6d840e9ce301dcf75c7e905580c598155a7542e22b38db1ff6eecbda85
SSDEEP 768:zFQq30wg3ZHP3YCtQk0p8+p3bd66j+4BRv86aLIW4b9Mh:Wq3KZZC8+p3Z6n4yGb+h
TLSH
T1FD037D77D869CE27ACF68B85B7857643AEF051A3C6C85DD8E9D95F0D008319E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 78611b0bccc2bb5e752b5ffe0b3835126c7685fdab1a3132e4faa417c1011ca1
MD5 75de6fa48fdfa841edd4738f22ad9a9d
SHA1 9df67e3d3f25da963857a57bca4d8879646f6d9a
SHA512 66246614535591f9e15327a633d79f882e20b4b82337ed01c101f022452de968b6d97aa78523520d48fb3943995465e873069c34db94b305e7eaeead42e2a2a3
SSDEEP 768:yX34Z24FCtQIcp8+p3bd66j+4BRv86aLIW4b9Mh:yX34Zu68+p3Z6n4yGb+h
TLSH
T165F2AEB2EC69CD338CF5D645B29637836EF46173D6C00E88E5D9AB0D055229E1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4d8327487c7d52b892834e84f917028fdd84df9f5cd12e6e5872177d32193691
MD5 4cc400b467152314f1eaeb5dd8e4d704
SHA1 59b85cbea8a677f8096c6561fe92ae686611c845
SHA512 407d45fbb53cffe786cc6c3d6aa670b5eb31b18e20229b47955ed10d28e1d35d88a24f245789a14e36807a5d4949ee3aca049a49e494625e04977d97a166f0d9
SSDEEP 768:Irv+4UNbdD3vcFCtkNp8+p3bd66j+4BRv86aLIip2bwCl1:Ibsbp3+L8+p3Z6n4yL0ww
TLSH
T1F003BE73E96899339CF6C644B2467A437FF860A396C00AC4E5DD2B4E015A29E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 21124efdb9f332ce58a471e796ceb24f610ecc47ef43ef5aef7cd179c3d991f3
MD5 62940f2b06edae05b44efb169a598455
SHA1 f2eda7fa7073769dc2583a3f3aeaafdac422e1f0
SHA512 b5eb8996e529754c82d96fa030f15bf6abe926e47731e584c7ade9ce47c7dc38897dbb02b9eccff9fc7f6934f1dee5024f3e9aef39c12a4e58357c714e1ca19b
SSDEEP 768:4rv+4UNbdD3dZY4FCtQITp8+p3bd66j+4BRv86aLIW4b9MI:4bsbp3dZ8l8+p3Z6n4yGb+I
TLSH
T1C313BF72E86DDD338CF6C644B1867B933FF421A395C00E98E9D96B4D059719E2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5e96274620f4a9fb32523793f4fb250a8e7b318292c59e7ccfff8ab0cee7cb8e
MD5 4cf2f3f3f0ca25c955680a3f03f62230
SHA1 7c3d7f1dead9fe9344f61d4e3cc4c61ce7c492f2
SHA512 f2b9a6acf7d202fc00571804927c04e7e3bdf1422b70ffbaca498ba10f089d71341e00e2c9d4afa06cbd9ab4a72f273e55c809b8a27eee58d7f82d5a8d6d4b8b
SSDEEP 768:UX3BZ24FCtQInp8+p3bd66j+4BRv86aLIW4b9Mh:UX3BZup8+p3Z6n4yGb+h
TLSH
T13DF2AEB2EC69CD338CF5D655B29637836EF46173D6C00E88E5D9AB0D055329E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f5b471fe-2fc6-48e0-8f3b-843a001001a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\f5b471fe-2fc6-48e0-8f3b-843a001001a3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1733245305\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4344-9-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-7-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-12-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-11-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-0-0x00007FF89765F000-0x00007FF897660000-memory.dmp

Download

memory/4344-10-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-28-0x000001A0007B0000-0x000001A000F56000-memory.dmp

Download

memory/4344-8-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-29-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-13-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-353-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-6-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-5-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-4-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-3-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-2-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-1-0x00000197E1750000-0x00000197E177A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads