hxxps://cdn[.]discordapp[.]com/attachments/1534915055605387284/1534923776318373918/Anarchy[.]exe?ex=6a75e4a9&is=6a749329&hm=4ea820f6edb047e7d901387d4c6d61f0262c5a066cd2b1f31507b801c95e9f4d&

Analysis

user interaction
yes
max time kernel
58s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1534915055605387284/1534923776318373918/Anarchy.exe?ex=6a75e4a9&is=6a749329&hm=4ea820f6edb047e7d901387d4c6d61f0262c5a066cd2b1f31507b801c95e9f4d&
Sample260806-raphmscr31

Score

8^/10

discovery execution injector pyinstaller

Malware Config

Signatures

Detected 'nefarius' open source injector. 1 IoCs

injector

resource	yara_rule
behavioral1/files/0x0007000000024610-199.dat	nefarius_injector

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	3980	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2480	Anarchy.exe
632	Anarchy.exe

Loads dropped DLL 10 IoCs

pid	Process
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe
632	Anarchy.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0005000000022b11-77.dat	pyinstaller

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3980	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304983857812552"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{79CE8D25-5EC2-4D82-9028-6569C2ECAFDA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	taskmgr.exe
Token: SeSystemProfilePrivilege	552	taskmgr.exe
Token: SeCreateGlobalPrivilege	552	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe
552	taskmgr.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1712	784	msedge.exe	86
PID 784 wrote to memory of 3980	784	msedge.exe	88
PID 784 wrote to memory of 2264	784	msedge.exe	89
PID 784 wrote to memory of 4384	784	msedge.exe	90
PID 784 wrote to memory of 2264	784	msedge.exe	89
PID 784 wrote to memory of 4384	784	msedge.exe	90
PID 784 wrote to memory of 4384	784	msedge.exe	90
PID 784 wrote to memory of 4016	784	msedge.exe	91
PID 784 wrote to memory of 4016	784	msedge.exe	91
PID 784 wrote to memory of 4016	784	msedge.exe	91
PID 784 wrote to memory of 1680	784	msedge.exe	92
PID 784 wrote to memory of 1680	784	msedge.exe	92
PID 784 wrote to memory of 1680	784	msedge.exe	92
PID 784 wrote to memory of 2988	784	msedge.exe	93
PID 784 wrote to memory of 2988	784	msedge.exe	93
PID 784 wrote to memory of 2988	784	msedge.exe	93
PID 784 wrote to memory of 2252	784	msedge.exe	94
PID 784 wrote to memory of 2252	784	msedge.exe	94
PID 784 wrote to memory of 2252	784	msedge.exe	94
PID 784 wrote to memory of 1740	784	msedge.exe	97
PID 784 wrote to memory of 1740	784	msedge.exe	97
PID 784 wrote to memory of 4656	784	msedge.exe	98
PID 784 wrote to memory of 4656	784	msedge.exe	98
PID 784 wrote to memory of 2856	784	msedge.exe	99
PID 784 wrote to memory of 4212	784	msedge.exe	100
PID 784 wrote to memory of 2856	784	msedge.exe	99
PID 784 wrote to memory of 2856	784	msedge.exe	99
PID 784 wrote to memory of 4212	784	msedge.exe	100
PID 784 wrote to memory of 4944	784	msedge.exe	102
PID 784 wrote to memory of 3304	784	msedge.exe	104
PID 784 wrote to memory of 3304	784	msedge.exe	104
PID 784 wrote to memory of 4204	784	msedge.exe	105
PID 784 wrote to memory of 2480	784	msedge.exe	106
PID 2480 wrote to memory of 632	2480	Anarchy.exe	109
PID 632 wrote to memory of 4732	632	Anarchy.exe	110
PID 784 wrote to memory of 4196	784	msedge.exe	120
PID 784 wrote to memory of 2204	784	msedge.exe	121
PID 784 wrote to memory of 700	784	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1534915055605387284/1534923776318373918/Anarchy.exe?ex=6a75e4a9&is=6a749329&hm=4ea820f6edb047e7d901387d4c6d61f0262c5a066cd2b1f31507b801c95e9f4d&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,14352899860027039104,1330799273741513272,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,17204893326206821632,4609262285539088305,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9329851868906583293,4350101067183447542,262144 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16906257684208786595,8967134640162967831,2097152 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3274012681944118932,6143293950681522261,2097152 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14021585202421369645,6203054546083278397,2097152 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,857758742848257767,4648379852361960704,2097152 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,8823183911689214288,15795434224241752969,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,6266360649003965667,5059573924263762788,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5628,i,202964313474818520,639811394138705207,2097152 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10133293795875963135,2525717369824235915,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,10089143803836821277,7740591230875028812,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,15148526025483522595,14651167654182007402,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,4605029226080598651,5441730258170490322,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,15148526025483522595,14651167654182007402,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4204
- C:\Users\Admin\Downloads\Anarchy.exe
  "C:\Users\Admin\Downloads\Anarchy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\Downloads\Anarchy.exe
    "C:\Users\Admin\Downloads\Anarchy.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,129138525651981046,6790292273050180262,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,14605380135292197128,6570954565187376652,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,10613096066715513900,345331009993205368,524288 --field-trial-handle=2484,i,11536877465873560270,15721526048995191905,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1872

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f23fde02e6abf8cd0305ab90615b1755e3aeb27a3f4cbd6fc54416037b890ff8
MD5 42fe604ca282400d99acb30f8f51653e
SHA1 ea07b07170437486730789c12fb044630364f6ad
SHA512 de6687cffc0a3ae239a365ca7f115bbc800ea83070e3f1c55911729ae71c368496445425b66b4454610a9ed74d059d8923c9a71b3600664e73bcbe86717c2657
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T107B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca622ffe0257b7942b0ca75b8c4efba1b9fdba10e7d9c2fa83d9b2ebb4471a55
MD5 3256f46e88495337912758dc87d6890c
SHA1 6b4e15a9ee2dd7260098bece15770e2628aaba48
SHA512 098feca65ebe11d6556b01a5ef867f77b10f641438a381340b2139bd0f03d0d51181cd7db8cb21726df9184a3cadb93f2acefffbce4c8bec6277279b420fe3ce
TLSH
T104715CB05EDB0663FB61803268E333667731B7FAFC175E9902E24B342795762F05A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5875b8.TMP
Size 3KB
SHA256 22d281f53a92880f484bb6271487c69acfd6cba417dde4c21b18bab0dcff7c62
MD5 6cb4b5528e4728deab7bd137dd1a21bc
SHA1 48f3c570d381ad8722ab1446343992635d1cba81
SHA512 c97d51bce54c1478c77119109948f197bb550832bad14041fe4aa01b1597a276260ed100245a4a101eaf30ab4c3cb9d2099414ad632c9a37febb65656c03a420
TLSH
T17F715DB04EDB0563FB608032A8E333667731B7FAFC175E9902E24B302795762F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eeceac5aa8147048cc8c91d933e07c6121315b2a632363c6540b79b5597fa075
MD5 109bbc9b36c461bc2e66c05ae654800c
SHA1 f7164ddc94efa6d33a0d098a37ed192fcdfeefb9
SHA512 a076dfee380b4b5e491ecedbcbdb18fe5eb2e9b2055d4d2e3080a23774d1d76d6880b39c1ad780082b4d5ca491729c7e4d173ff037a9eefe242e58d700d15407
SSDEEP 192:sxZZERmyM/jK1Ml8M9J/fBscs0TIdpJHW6+WNGYIw2RM8IgrJ:sxZZEA1J/fBscVMJHbGh9
TLSH
T1D942F811AB34A97BCCDBD20DFA557F53D6F91472A2900E44A9FCDA1C04E6AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a620e9db3924b2a862d33ab9b2ae61d20d756c627c112dae375aedbf9c092b76
MD5 7c76647dc31713bd735a73f9fd064e05
SHA1 35987eaf66173d8c550b0a88547b888a06f39dfd
SHA512 0b4345e6cd2d8db5527a4e97ed67ab7d092ff5af6ccf3bb094e26029126d6d92aef6d6f93e763b95dc0cdde1361cc0e1c0d479ac3d9e3c8df10b462c26ddc869
SSDEEP 192:sxZZERmyM/jK1Ml8MjJ/fBsza0TIdpJHW6+WNGYIi2/M8Ig5rJJ:sxZZEAbJ/fBsz/MJHbGZ9z
TLSH
T1CB520711AA346977CCDBD20DFA457F53D6F81573A2900E44AAFCDA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9e733a697c4a9d17452078c3e2601dd3532776adbb4856b0ec4022764e7d279f
MD5 031c0adb9a141abc5852ed4ca4903218
SHA1 34087409a5e3a0c9d829c15eba17feb9f9a60d56
SHA512 96f4df89b4f9de582165f2d6346cd4ff9b55be46c91aa04a7de4d074739b862c108e68e0a132790fb3c2edfc0dc2e847eb424ee3239425437d69ccca82d438b3
SSDEEP 768:9psqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9nroK16:9psqxXlWvJD6Tu1ja54LAs90Ko
TLSH
T12CD20B3B694CC77E4F840E5DEC26AFD76ED801CB66988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 985a8f6293e0f4a10bf56a3a15f590e56208288b4776236f8039e65e00cf90da
MD5 501e0b5533685a9bca8597a8d9ff3755
SHA1 b62e5721f6e9f8ce20822bcca04b7d82891f8bff
SHA512 b4d1c95b9f39530f4c995ae7f028e69a3c517fb133d843c716c1443c7b469e0660fab23fed7dea4af0860fe57ed427c65f91bddd95fe505d8cab876003ee3760
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2m5Sd5v33OJHIVvZOKH7vjOl:ExZBdPxzd5Sd5v33EHIJZ57vjK
TLSH
T136F15A06713B820238BE690CA27695374E8373B77518A56F7F7860B60D66E114EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d7c829c0747c3cddfbe6b697b9d081c98dfc4c7d474b0031a0c461479d2620e1
MD5 f9d56124389165b758d51d8d3802b076
SHA1 87c721deeded4a758baae42a3fee796e27164f19
SHA512 619dd49b0112af98e8736180a1680028297a2eea61b513f1d438f113d5517a4210c386c80ad0650bac9cb237486656453e9945d7976b5c33234a4d1a05a25ae6
SSDEEP 384:bZcI0ZsN2E8erybrnGVRNVOK+t9FptrnTKwBODNZOCVg3:D0Z1dkHVOKs9LZnewBKZO/3
TLSH
T1B7927D716C385C778DE6A549F84B31178EF8A127F9C42F94D5EDAB1C01DA698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 82ed22399bea2eca665ed9ce90711d059a4fcbf1a4922180d390230971943d4a
MD5 c1edeec0bede37356dfac428e4549c12
SHA1 024c8ec024251239d9fece3cad6f0a902ccbbd42
SHA512 4e90513dc39d6aef798810495707bb6cd46ee0cac045162401fada4614af248ac6f4873a4f5247a5f8628f928c1e9d2f98cc6e17b28a4adeeeb1f31690c3c075
SSDEEP 384:LZcI7sN2b8erybfinGVRNVOK+t9FItrnTKwBODNZOCVg3:T7+pEkHVOKs9SZnewBKZO/3
TLSH
T1D1927C716C385C778DF6A549F84B31178EF8A127FAC42F94D5EDAB1C01DA698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c103f1d7d2f9e947e25ee922b7ecbce5145d094da3b9dfc3be48d3612971cafe
MD5 c74cf5fe8fd95fa85e99523122257488
SHA1 42940f76c7257b33567ff9559726feb721fdd2af
SHA512 11088c00034071d447a8aae60fbe72d50d975422f87754200c667084ab12b51fed4e7b5701249c9668579e6020ee0f92acf01df87de3d44b67c323e4e9742860
SSDEEP 384:aZcIysN2b8erybwnGVRNVOK+t9FQtrnTKwBODNZOCVg3:Yy+4kHVOKs9uZnewBKZO/3
TLSH
T196927C716C385C779DE6A549F84B31178EF8A127FAC42F94D1EDAB1C01DA698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b954d5fcd9b992a343043eac8199ff3c6a0b2856313ecb92cabf008726ac6ca1
MD5 c8c5f23f8ffbdbf02c067c219f4cdd4c
SHA1 bb75cf13d9bd370611741eb4d85c8d40cb66c1fc
SHA512 f35be558a18fbefa137b5995be84802c294eeebefa59f60366f7e85695b20c0fedae78fc7bb015302bd27e78f464e86c2e5540befbb8b81eaa397e72b8cc9c52
SSDEEP 192:tONc6JkRtQmiUy8gW+RNVOmSY+y9h3t8ReU6:tONc6UrsW+RNVOK+GtFU6
TLSH
T18702D9356D381C7B8EF26E0AB48B27175FA9203BE9856F94D6D81F1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdb185b26bc0773562a3244a32a328f6db3d6ba8267bf813f99be79614518525
MD5 6113241b8d3f31b511778b43eea3f4cf
SHA1 1b7e5ad3b60feab66e6cd1558592e3ab86ce34a9
SHA512 68c4d7dbaf588d83e686afa315a945430198d10c55c258947f5179f5c2d257c1d671ad52de951b02e89a1a0b3249f3b86431f4a4aa5f66d6f758ad64ee70cffc
SSDEEP 192:OONn6JkRfQmiUykgS+RNVOmSY+y6l9nFmVctDqCxU6:OONn6UhKS+RNVOK+t9FBtrU6
TLSH
T1B7121B32AC385C775EE26945F48B35174EA9513BEA897FD0D1DC2E1C01DF99C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bb165bb23aa17dbfb4057d82afe7dee21197a88799931303b625423354b130c
MD5 34bab86aef853c69be14c3488431ba8d
SHA1 1cee5b6ba2b7ea73e1c0bd0cea8d2f78f4443dcf
SHA512 1b7b4250f4e2eb29555f9d232585e573bfe15ac05dfc8d415c4b8580c3fcb0f10ef1c83c66d6aaa1241674556cc6cae956aa4801fcc0c30303b75320a13a8c70
TLSH
T1FE412A59B7E91148B3B26F56AFF7A86D847AB9772F06D45E00110D4F0636A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\MSVCP140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_decimal.pyd
Size 247KB
SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
MD5 21c73e7e0d7dad7a1fe728e3b80ce073
SHA1 7b363af01e83c05d0ea75299b39c31d948bbfe01
SHA512 0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
SSDEEP 6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
TLSH
T19B346B57A2490CA4DE73807499979B57FBB278850320D2CF43A48AA73F577A327BD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\_ssl.pyd
Size 173KB
SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
MD5 9b4e74fd1de0f8a197e4aa1e16749186
SHA1 833179b49eb27c9474b5189f59ed7ecf0e6dc9ea
SHA512 ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4
SSDEEP 3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
TLSH
T1F4046C47B6942DB7D813E4BAC1230913DBF1F015331247DE49D6D6490F17B0AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\base_library.zip
Size 1.3MB
SHA256 dc4f693258a35695c5ac83ccd628dc6b89d8ddff6f17d05de8d9c9364f2b3aaa
MD5 1d94561a3b5b13046f712ee9c2169b3b
SHA1 d9fb6103cf9fdb62ce515de01ba21f42b1c23208
SHA512 03662d10189cd8f22cc974cb479641812401569d9a4b14333c8d36e4cd96e9901f239ee0a11e900abc47ae4ed3037ac74f6a8d53cd7538782c1ce4707fb3f2d1
SSDEEP 12288:PwDguWD9GgCTMNLHtzJYTq+zYgEkA1qJuAtOmgRbttcY+bSw0P6dY4aYcLVQU:Pl9MWtJgHCbttcY+T0P6dY4aYcxQU
TLSH
T16755D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tool.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\tool.exe
Size 399KB
SHA256 b435df9799736f5c8c7fa3a5d2f34f94efd587efe8b505df4b2e948a53c8a4af
MD5 7e7eaa38728e439ae8b292c372d0cada
SHA1 c53443e2215a183d351339870a6d12d845830a55
SHA512 7660e6f35dd8043e2d6f748738ae182539f13ed81b3351028dc64f3303ee2b2e7f83b49c86e8acfd5bd9f9c6ab8127b37f73e67d6f0bff8b4b04e10ff8e21a8f
SSDEEP 6144:XytUW7F0F8d6XGv4V03XNGLfAZPP1B8cu6w6Zk/Dr7olem99TWRSTE:XytFuSUypNB5PdZAe95TE
TLSH
T18D946C16F6A800F5D1A7F1F8C8524502DA727C8A436096CB23B07A961F376E3DE3E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\unicodedata.pyd
Size 1.1MB
SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
MD5 a1388676824ce6347d31d6c6a7a1d1b5
SHA1 27dd45a5c9b7e61bb894f13193212c6d5668085b
SHA512 26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89
SSDEEP 12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
TLSH
T1BF354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velocity.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24802\velocity.dll
Size 4.7MB
SHA256 4683fbf97c008f8d08d72dbe8233018f24b9d35ce65761facf854d1fe0de950a
MD5 244e17cd89df94f00de8991cd9b51835
SHA1 feb9bded593937256cf09aceab1b51d6dc5278de
SHA512 0a3f78f8057bddf9d3d0bd90db0c352d95d1af01e6464d31371aa09669fcb2a63abedaa093e3465cd635cf87323c31704f3bd028c4b85651a9eb98f2aacaa444
SSDEEP 98304:5p/+iTzTRn3XXMKi17WUuBXOyPtyTjg83j/:1XXMKiYbO6tKjLz/
TLSH
T10A36BE13F74151AEC52AD43886AB93227331B8465B2257CB76482F35ADD73E02F3ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anarchy.exe.crdownload

Path C:\Users\Admin\Downloads\Anarchy.exe.crdownload
Size 9.9MB
SHA256 886affa346a88f5589f0d9f8bcdd2a83cde43a000acd7dba3c6e4471934a2798
MD5 03c5b7d33d4b091cd89c68d3360103cb
SHA1 d75ab2929f99696887291e5105051c2d4bc49663
SHA512 7321ee1ca6e3825c964da85c38a436d478512aa123fed76d907603604b10645ba7cfcf7584edfa5fbe7ce6afeb0ead80f9816d6c7f6bf06a67944149ce6c5e37
SSDEEP 196608:hsQk41W903eV4QJItpDjIIAcwDNRPsVgpeavk97Ii:HkuW+eGQJg9joNOVgpEU
TLSH
T1F8B63388E2E959F5E4B3C53E8ED14147E632B9225F3DCAD70394D2922E733C54A3A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-261-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-271-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-270-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-269-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-268-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-267-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-272-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-273-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-262-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download

memory/552-263-0x00000216F1190000-0x00000216F1191000-memory.dmp

Download