valleyrat_s2 | e4c02c94811cd22086c1b1f1204cf8e9986474af829ab6bce4eb55038daf203b

Analysis

user interaction
yes
max time kernel
92s
max time network
246s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winhttp.dll
Size 379KB
Sample260819-kh6css1anh
SHA256 e4c02c94811cd22086c1b1f1204cf8e9986474af829ab6bce4eb55038daf203b
MD5 0eee0cdc6930dcd636277423fda07105
SHA1 afbaf3eb4d6eaa6526a994ac4986c6daaa9b5261
SHA512 5dcf90bb4b0c3f82e85fdaadd457679e3a1d78dd5454410bc3ad887e719f7650a25e64041b15f0041df2d492062d79bf819699bca37ddcc39628d85ea19420ac
SSDEEP 6144:cSj74GcEWPZtjdyrVISuKducwtXm7nq9Mz86uaLWKax:cF5P1+uKdgXm7qsu7
TLSH
T12384F3A71066975EF953C2F46AD4A3E1EF7F7CB02A084A5EC7DAEC2C031654AD6142F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware spyware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

207.56.119.83:6666

Attributes

campaign_date
2026-08-16

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/3640-11-0x0000000003630000-0x000000000368F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4356-77-0x0000000002060000-0x00000000020BF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4356-78-0x0000000002060000-0x00000000020BF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3248-119-0x00000000014E0000-0x000000000153F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4372-161-0x0000000000FB0000-0x000000000100F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3708-203-0x00000000016C0000-0x000000000171F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3924-245-0x0000000000C20000-0x0000000000C7F000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5396	powershell.exe
6784	powershell.exe
5772	powershell.exe
4460	powershell.exe
3056	powershell.exe
1516	powershell.exe
4296	powershell.exe
1544	powershell.exe
1076	powershell.exe
452	powershell.exe
4232	powershell.exe
3080	powershell.exe
6240	powershell.exe
5316	powershell.exe
3080	powershell.exe
6616	powershell.exe
6732	powershell.exe
4616	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3520	5yohisml.exe
5764	oobloq2t.exe
4396	n4qaj9j7.exe
2992	0xfbhjj0.exe
4252	4g5z8t0p.exe
5208	g8gisxmr.exe

Loads dropped DLL 6 IoCs

pid	Process
3520	5yohisml.exe
5764	oobloq2t.exe
4396	n4qaj9j7.exe
2992	0xfbhjj0.exe
4252	4g5z8t0p.exe
5208	g8gisxmr.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6896	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3640	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
5856	rundll32.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3640	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeIncreaseQuotaPrivilege	5772	powershell.exe
Token: SeSecurityPrivilege	5772	powershell.exe
Token: SeTakeOwnershipPrivilege	5772	powershell.exe
Token: SeLoadDriverPrivilege	5772	powershell.exe
Token: SeSystemProfilePrivilege	5772	powershell.exe
Token: SeSystemtimePrivilege	5772	powershell.exe
Token: SeProfSingleProcessPrivilege	5772	powershell.exe
Token: SeIncBasePriorityPrivilege	5772	powershell.exe
Token: SeCreatePagefilePrivilege	5772	powershell.exe
Token: SeBackupPrivilege	5772	powershell.exe
Token: SeRestorePrivilege	5772	powershell.exe
Token: SeShutdownPrivilege	5772	powershell.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeSystemEnvironmentPrivilege	5772	powershell.exe
Token: SeRemoteShutdownPrivilege	5772	powershell.exe
Token: SeUndockPrivilege	5772	powershell.exe
Token: SeManageVolumePrivilege	5772	powershell.exe
Token: 33	5772	powershell.exe
Token: 34	5772	powershell.exe
Token: 35	5772	powershell.exe
Token: 36	5772	powershell.exe
Token: SeIncreaseQuotaPrivilege	5772	powershell.exe
Token: SeSecurityPrivilege	5772	powershell.exe
Token: SeTakeOwnershipPrivilege	5772	powershell.exe
Token: SeLoadDriverPrivilege	5772	powershell.exe
Token: SeSystemProfilePrivilege	5772	powershell.exe
Token: SeSystemtimePrivilege	5772	powershell.exe
Token: SeProfSingleProcessPrivilege	5772	powershell.exe
Token: SeIncBasePriorityPrivilege	5772	powershell.exe
Token: SeCreatePagefilePrivilege	5772	powershell.exe
Token: SeBackupPrivilege	5772	powershell.exe
Token: SeRestorePrivilege	5772	powershell.exe
Token: SeShutdownPrivilege	5772	powershell.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeSystemEnvironmentPrivilege	5772	powershell.exe
Token: SeRemoteShutdownPrivilege	5772	powershell.exe
Token: SeUndockPrivilege	5772	powershell.exe
Token: SeManageVolumePrivilege	5772	powershell.exe
Token: 33	5772	powershell.exe
Token: 34	5772	powershell.exe
Token: 35	5772	powershell.exe
Token: 36	5772	powershell.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeShutdownPrivilege	3640	explorer.exe
Token: SeCreatePagefilePrivilege	3640	explorer.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe
3640	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3640	explorer.exe
4356	explorer.exe
3248	explorer.exe
4372	explorer.exe
3708	explorer.exe
3924	explorer.exe
256	explorer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3640	5856	rundll32.exe	80
PID 3640 wrote to memory of 5912	3640	explorer.exe
PID 3520 wrote to memory of 5772	3520	5yohisml.exe	91
PID 3520 wrote to memory of 4356	3520	5yohisml.exe	94
PID 3520 wrote to memory of 4356	3520	5yohisml.exe	94
PID 3640 wrote to memory of 3564	3640	explorer.exe
PID 5764 wrote to memory of 4296	5764	oobloq2t.exe	98
PID 5764 wrote to memory of 3248	5764	oobloq2t.exe	100
PID 5764 wrote to memory of 3248	5764	oobloq2t.exe	100
PID 3640 wrote to memory of 960	3640	explorer.exe
PID 4396 wrote to memory of 1544	4396	n4qaj9j7.exe	103
PID 4396 wrote to memory of 4372	4396	n4qaj9j7.exe	105
PID 4396 wrote to memory of 4372	4396	n4qaj9j7.exe	105
PID 3640 wrote to memory of 1804	3640	explorer.exe
PID 2992 wrote to memory of 1076	2992	0xfbhjj0.exe	108
PID 2992 wrote to memory of 3708	2992	0xfbhjj0.exe	110
PID 2992 wrote to memory of 3708	2992	0xfbhjj0.exe	110
PID 3640 wrote to memory of 4024	3640	explorer.exe
PID 4252 wrote to memory of 5316	4252	4g5z8t0p.exe	113
PID 4252 wrote to memory of 3924	4252	4g5z8t0p.exe	115
PID 4252 wrote to memory of 3924	4252	4g5z8t0p.exe	115
PID 3640 wrote to memory of 1440	3640	explorer.exe
PID 5208 wrote to memory of 452	5208	g8gisxmr.exe	118
PID 5208 wrote to memory of 256	5208	g8gisxmr.exe	120
PID 5208 wrote to memory of 256	5208	g8gisxmr.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5856
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:6672

C:\ProgramData\EdgeUpdate\9iynvt1x\5yohisml.exe
C:\ProgramData\EdgeUpdate\9iynvt1x\5yohisml.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4356

C:\ProgramData\EdgeUpdate\ijixpfo5\oobloq2t.exe
C:\ProgramData\EdgeUpdate\ijixpfo5\oobloq2t.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3248

C:\ProgramData\EdgeUpdate\5qckmud2\n4qaj9j7.exe
C:\ProgramData\EdgeUpdate\5qckmud2\n4qaj9j7.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1544
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4372

C:\ProgramData\EdgeUpdate\1ur0zcmp\0xfbhjj0.exe
C:\ProgramData\EdgeUpdate\1ur0zcmp\0xfbhjj0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1076
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3708

C:\ProgramData\EdgeUpdate\jfl0bqe6\4g5z8t0p.exe
C:\ProgramData\EdgeUpdate\jfl0bqe6\4g5z8t0p.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5316
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3924

C:\ProgramData\EdgeUpdate\vj5kuuhf\g8gisxmr.exe
C:\ProgramData\EdgeUpdate\vj5kuuhf\g8gisxmr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:452
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:256

C:\ProgramData\EdgeUpdate\5uu3d91t\flpbkx14.exe
C:\ProgramData\EdgeUpdate\5uu3d91t\flpbkx14.exe
1⤵
PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4460
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\ProgramData\EdgeUpdate\qk4oubpi\egv958zp.exe
C:\ProgramData\EdgeUpdate\qk4oubpi\egv958zp.exe
1⤵
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3056
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\winhttp.dll"
  2⤵
  PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\winhttp.dll
    3⤵
    PID:784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {4ac5c9a0-f797-41a1-81fa-9b1a0ed78ad4} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {a582b09f-1fa4-4630-badf-2cc7e83449b4} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27274 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {b5c55725-450d-49e1-af34-e523f45e154a} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      PID:1280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27274 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {ae773d0b-9dd0-416e-a05f-6349878c5e32} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 34773 -prefMapHandle 4572 -prefMapSize 270279 -jsInitHandle 4576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4584 -initialChannelId {5dfadb7d-7e2c-48c3-8794-b62770f8b2f9} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:4324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5188 -prefsLen 34929 -prefMapHandle 5192 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {3eac4829-7cc1-45ac-99ce-af87250a8fbc} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      PID:6552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3312 -prefsLen 32952 -prefMapHandle 4916 -prefMapSize 270279 -jsInitHandle 3300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {0f587a5d-752e-4010-a5a4-ac83ff4eae03} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:6912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {1bd1e543-3164-472a-bc7f-17547b9b1d17} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:6932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 32952 -prefMapHandle 5988 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {63d3f3b9-1308-4a21-a0a3-98ed55e9fbce} -parentPid 784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      PID:6940

C:\ProgramData\EdgeUpdate\ugdju45t\hk4bi4zb.exe
C:\ProgramData\EdgeUpdate\ugdju45t\hk4bi4zb.exe
1⤵
PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3080
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\winhttp.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6896

C:\ProgramData\EdgeUpdate\lcgozt06\2a3p4zt7.exe
C:\ProgramData\EdgeUpdate\lcgozt06\2a3p4zt7.exe
1⤵
PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4232
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5568

C:\ProgramData\EdgeUpdate\xjauova8\v8xf5ka8.exe
C:\ProgramData\EdgeUpdate\xjauova8\v8xf5ka8.exe
1⤵
PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3080
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:476

C:\ProgramData\EdgeUpdate\dk0opizz\xlxgv179.exe
C:\ProgramData\EdgeUpdate\dk0opizz\xlxgv179.exe
1⤵
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6616
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6340

C:\ProgramData\EdgeUpdate\lqurmplz\8mrj7up5.exe
C:\ProgramData\EdgeUpdate\lqurmplz\8mrj7up5.exe
1⤵
PID:6464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6732
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6760

C:\ProgramData\EdgeUpdate\x2u9yw2y\a5xt66zr.exe
C:\ProgramData\EdgeUpdate\x2u9yw2y\a5xt66zr.exe
1⤵
PID:6020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1516
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4488

C:\ProgramData\EdgeUpdate\nlk0hvxp\rn6ansqb.exe
C:\ProgramData\EdgeUpdate\nlk0hvxp\rn6ansqb.exe
1⤵
PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6240
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3932

C:\ProgramData\EdgeUpdate\2zjsbjd9\9oy2j1kd.exe
C:\ProgramData\EdgeUpdate\2zjsbjd9\9oy2j1kd.exe
1⤵
PID:6620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4616
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2916

C:\ProgramData\EdgeUpdate\8zjgyamj\9a6fzoqc.exe
C:\ProgramData\EdgeUpdate\8zjgyamj\9a6fzoqc.exe
1⤵
PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5396
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3260

C:\ProgramData\EdgeUpdate\zfox6y8c\zlio1qqg.exe
C:\ProgramData\EdgeUpdate\zfox6y8c\zlio1qqg.exe
1⤵
PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6784
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webview_support.dll

Path C:\ProgramData\EdgeUpdate\1ur0zcmp\webview_support.dll
Size 160KB
SHA256 0448c82f12cbef6ca07266463e3004012b15cadc5f331feca1705a330168a9d1
MD5 e6c3ac76a71792f6997f19a7beb04f93
SHA1 7d2ccf13be7390131b62a1ecbb20156b672df593
SHA512 dbe886d103051c5f6b0f29d20933f4b2fc1c602f8602d9a591a0386fab20580ee6baf7e1cb4d8ce4cbfc9a03261403cbf6df170c4e720a491cb581c7cd35923c
SSDEEP 3072:h0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:XDLsL1WpCTLe1wZ
TLSH
T161F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\5qckmud2\webview_support.dll
Size 160KB
SHA256 3de5dfbacaa065ff722f478f2e30eb5eb47a7b4b08c5aae9c5a4e64d7f58d436
MD5 b41ccf72855983e2c818ec7a22e86378
SHA1 e0b0c30c0cd15c0fa4c3970e16fd70e4b383fcc6
SHA512 51e8f7b23f1ed5e2753ad04637b5e13b5d4b5af646077537d786ddee4f7d1dd4cb085482c250f78b4503b69316b78e0cfa8a4933901f2b507751719ecd414fe6
SSDEEP 3072:30yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:1DLsL1WpCTLe1wZ
TLSH
T1E2F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\5uu3d91t\webview_support.dll
Size 160KB
SHA256 90059d94f5582483418e67cda776479aa7dae86becb9c03047ad2b6f226dbe84
MD5 4e20ac69324b101041835e8d1864f9b9
SHA1 14745f0aeed9f8445d35a0d839811898b4225bd5
SHA512 cd295b91739cf16c412f38c58696a6c2cd12d4da7bbf95e972d59e79913c8074c29f506855235c15d378a90956897ba37a3fb08d383766d8c8441492c4cf76bc
SSDEEP 3072:i0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:EDLsL1WpCTLe1wZ
TLSH
T19AF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5yohisml.exe

Path C:\ProgramData\EdgeUpdate\9iynvt1x\5yohisml.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.log

Path C:\ProgramData\EdgeUpdate\9iynvt1x\config.log
Size 350KB
SHA256 b71dd8099864e9a3b17ccae293d14f701951ec4717076f8d8deb079e1735638d
MD5 6ecb3a50a8cfeb9d6c2cd16a6bc2e21d
SHA1 e8b6dae0a33fa636aa8fa3741926c3a7987cccc7
SHA512 4db965502c886103dc651de3e01e9eccfe30bff3eb1a2b52abea002bcdc1989c3c1ed742aef21dcae979a1cbe55087903529204c0c994bc34436d5b6778788e1
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORh73iTl:I6ZwvAkHsZI7PK0DZu5g
TLSH
T145746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\9iynvt1x\webview_support.dll
Size 160KB
SHA256 228f7b996b6f39e26bf3dabcd232f3eba06adc9195d8365a05a1154809075858
MD5 ce2533552d7b77373172c321cba887d1
SHA1 45db41e8d7168c33c576a0044cdc1df295e7b71f
SHA512 2d93821f996908b5633021fff688ddb1126b29751d0ad5e42476f7618c2392afc49a9f00a6f77c78ec211e16b2db3c4415070dc6bda282c4952093e0e57b9d91
SSDEEP 3072:k0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:uDLsL1WpCTLe1wZ
TLSH
T163F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\ijixpfo5\webview_support.dll
Size 160KB
SHA256 7d1f5d76b6cc7e82275476816abf397d63ce18961471ad0f9aaeb22c1ec8956c
MD5 7d66e3363cb5a6c09b963546ec2b91ae
SHA1 5091e3a5afe7c95b4ad94c0fb4aeb9eb449872d3
SHA512 bd94c8e8db4ea762005a116e98bacb01738dd1277d61be314fa19e537985b47ccdf8328ea32b1558fa969d04ed0357f74df5974b869450a2d0d225a9d2561dcd
SSDEEP 3072:30yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:1DLsL1WpCTLe1wZ
TLSH
T1BBF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\jfl0bqe6\webview_support.dll
Size 160KB
SHA256 6a86a86ab1d1723590f1d228d6c482c29785bf6641df08bb1ce40dd936fd379b
MD5 4f967c8b4995ddc3c6005823b95a72e8
SHA1 7c92b0f7c3564ad9a8920f000a429621ffdf985a
SHA512 688bbf268554c8e2a76378afd4083d771dd708a492414976a99e52f9dbcc9c43c670a2f3ddb774964aed340ad115c4e990a1afc798dd9e7100e5b23fca5c5e68
SSDEEP 3072:t0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:bDLsL1WpCTLe1wZ
TLSH
T177F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\lcgozt06\webview_support.dll
Size 160KB
SHA256 8a06ca483a35a12ae8c029ce5e1190a88c42176711e4318c43de76ab664baeb9
MD5 bdb6227df1b3190e2324e2670162b3e2
SHA1 bda5694878d0a24de773bf0af760f0298d464314
SHA512 0f111a94952d9356ded7cbc084dd2090923d5fef983565f4436023e9450ea6cd7f35887394fd3ffb7e273fb2cf38ef59bca720accc31914bb42cbbafa29736d4
SSDEEP 3072:k0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:uDLsL1WpCTLe1wZ
TLSH
T102F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\qk4oubpi\webview_support.dll
Size 160KB
SHA256 56ccd01f588ec30c470b5c2e9cb64ecc29b906661a21a703b4fbb74a8204189a
MD5 6c49e725c28c6eb3997920d2f4731184
SHA1 e0f17e6ba2d51c704484b5541beed41f53847356
SHA512 c6b8f819ce05dfc72edc147b6edeaf03c652a825e62540fac3eea8b148d55b551dc313916b94e0504dd278d6fd934ab8cf614901b57cfdf748e4a67d22257654
SSDEEP 3072:q0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:MDLsL1WpCTLe1wZ
TLSH
T134F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\ugdju45t\webview_support.dll
Size 160KB
SHA256 2bc5900459dcc92764aef8827b35e17059c9f9a0f59049580f5946c034fec6cf
MD5 aadb14fe35286f451f1c950bc1788dea
SHA1 9b0f8e71784d2b67318805899a5a666948627401
SHA512 6fae8afda73620f09af9cf6a309ec5b7f362c485f2d9d4d957c82d16e48f4b56691ae2fbeeb543d97474fb96da1aa80df255ba9833cb309647688bc272eac786
SSDEEP 3072:Z0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:PDLsL1WpCTLe1wZ
TLSH
T124F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\vj5kuuhf\webview_support.dll
Size 160KB
SHA256 585338ad4c3dda2d3615ff1726410a50606ddfa2a8b6a06bd0148608cc62eee1
MD5 412eb31ec2ae8df89aa98c298e1979c6
SHA1 16fa23139493e6d3b26de264514cfe1007d04d6e
SHA512 66a3dc8d8049ef82a4313859c66fa70a6c916ec40d07d9bd6935de40098274e03ec762b4bfb70bb0f19c55eea1cc55720c5da6799b868a4949f69a976f45fdaa
SSDEEP 3072:h0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:XDLsL1WpCTLe1wZ
TLSH
T120F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download