hxxps://github[.]com/lmntltools/meteor-client/releases/download/26[.]2/meteor-client-26[.]2[.]jar

Analysis

user interaction
yes
max time kernel
46s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/lmntltools/meteor-client/releases/download/26.2/meteor-client-26.2.jar
Sample260825-dpslysstcw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321010947123300"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B6A78A42-D9B8-4FA0-8E44-938E73B757B5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2828	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4308	javaw.exe
4308	javaw.exe
4308	javaw.exe
4308	javaw.exe
2828	vlc.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3512	2532	msedge.exe	86
PID 2532 wrote to memory of 4164	2532	msedge.exe	87
PID 2532 wrote to memory of 3392	2532	msedge.exe	88
PID 2532 wrote to memory of 3392	2532	msedge.exe	88
PID 2532 wrote to memory of 3392	2532	msedge.exe	88
PID 2532 wrote to memory of 3032	2532	msedge.exe	89
PID 2532 wrote to memory of 3032	2532	msedge.exe	89
PID 2532 wrote to memory of 4052	2532	msedge.exe	90
PID 2532 wrote to memory of 4072	2532	msedge.exe	91
PID 2532 wrote to memory of 4052	2532	msedge.exe	90
PID 2532 wrote to memory of 4052	2532	msedge.exe	90
PID 2532 wrote to memory of 4072	2532	msedge.exe	91
PID 2532 wrote to memory of 4072	2532	msedge.exe	91
PID 2532 wrote to memory of 1884	2532	msedge.exe	92
PID 2532 wrote to memory of 1884	2532	msedge.exe	92
PID 2532 wrote to memory of 1884	2532	msedge.exe	92
PID 2532 wrote to memory of 2808	2532	msedge.exe	93
PID 2532 wrote to memory of 2808	2532	msedge.exe	93
PID 2532 wrote to memory of 2808	2532	msedge.exe	93
PID 2532 wrote to memory of 4704	2532	msedge.exe	97
PID 2532 wrote to memory of 4704	2532	msedge.exe	97
PID 2532 wrote to memory of 2564	2532	msedge.exe	98
PID 2532 wrote to memory of 2564	2532	msedge.exe	98
PID 2532 wrote to memory of 4108	2532	msedge.exe	100
PID 2532 wrote to memory of 4108	2532	msedge.exe	100
PID 2532 wrote to memory of 3108	2532	msedge.exe	101
PID 2532 wrote to memory of 3108	2532	msedge.exe	101
PID 2532 wrote to memory of 3108	2532	msedge.exe	101
PID 2532 wrote to memory of 2380	2532	msedge.exe	102
PID 2532 wrote to memory of 1120	2532	msedge.exe	104
PID 2532 wrote to memory of 4308	2532	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/lmntltools/meteor-client/releases/download/26.2/meteor-client-26.2.jar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7fff4ed6c188,0x7fff4ed6c194,0x7fff4ed6c1a0
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6095411526206115940,562752078327405424,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,303566988974112072,8336810164750502522,262144 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,16636725754643958849,9484608362664200496,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1096952146218735258,16886984017255354375,2097152 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8806036460546868870,169013298426504405,2097152 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,7337328216769153672,14768854954220775651,2097152 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4210662354991103606,5722463909289066937,2097152 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9699123315034646513,3586887259343497459,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,10596928587737011917,3606948660691840912,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,5173696902303856586,5402900096269868511,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,8614963046515089747,15263376829322582853,2097152 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,13621220293108973087,9971416536915747964,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,6536502181288920460,11307792588101050850,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,6536502181288920460,11307792588101050850,524288 --field-trial-handle=2448,i,16826452743285129787,16081386185338252878,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\meteor-client-26.2.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:828

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\GrantProtect.mov"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22df140cf27633bb5a5cfb41856accaa97390f0e68ea50ce283a05244e70c75e
MD5 8309d4388bf9ad61f64efb2cff858a46
SHA1 5d506ca1d6f3121b4913ac8dd94595ef742deb8f
SHA512 c96144f89130652cb71678e2400de8c4bfd6104eb4607c508a56a32ccdaf7e724e084d306bf7a01138b4da19f98f2e33e355a539958acc257501ad3d4835f6fd
TLSH
T1F0D023207E7DB5D1E1271038E513474032DD55F63547520BF550451E5D7A4C393DE9D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 4.6MB
SHA256 af4fa71d92fb22e98b2a6ab13a0c78bee0e9d8cbf481766e1e88fc8af74c8ee5
MD5 f51d4402c5d24bf38a57e09ffe267a5c
SHA1 b722c13c51c4e0d6b46d3e608780474005055176
SHA512 e9cb17049ef49b2c207c2356d302496cb67724e1b09e80494e58c192c369058d709fd335ebcbed8f9c8d0a928de6c5a93198473a17c979eb631318742699f674
SSDEEP 98304:DyaLty0/TfdIIA1QfMZY+GxLdSPRO82SKrb1RPM0kpXA8kd:D/h/TOIASWBRO82zFbkNE
TLSH
T1D826F125BB9D8472E433EF328142F0A164BBEE5D520BF0673A69054E48F8E51C73ED96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac3fbf352984b77d79a47b37c5670679f8b2d1f5971417cef3db0ee69c6f5657
MD5 6250ec43d149d651ff8cbd874d0b102c
SHA1 4155d1531a93aff1dd9e0cd3eaef6863b3564797
SHA512 1b9d3eae9ef315dda5fdf4bba7f5f924a508a8787fe3dbe8b688a40a80d2ef8f1373ba55502093656c9708f6abb11b3b0d0ba99a7fbfe8ee876898022a21c322
TLSH
T1BB711B34C69604E8C7A649FD63C1834039F0C5E9FD872E61A2AC6AF86D567DC83DD538
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ef27cefe527862d38e8fdb3ee4efc4fef3f796d7a27a8dfbe8fb201c8a45ceee
MD5 f7c71e82b228ce924c7817c9a83c1423
SHA1 9b657530a750592b9b5a8be4b8b79cf2e447041b
SHA512 216cb6a11e803bfe13355c014017b54c685465e9a80e8bac4c2b871e7827e4aa289eb6f0a8551fead748ab4040209a3ede01c2f6939ca64fdde50f990d945b2e
TLSH
T16B21D2F7C3E1956E8E1116F0AA18AE1BCE2C0511831C7C2985E0BF27D3E3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0b7515883ddcfd7f8a635a17900ef89074599334b12987e182dd49135144b89d
MD5 b8525621e5df4fb95d48a76f247a4f0c
SHA1 d8d828b45b2f07712f5347ed4aa7349d635ef387
SHA512 5d94c6d4ac50cbda78083992766bdd21323f469a193d4b0fb8193658935149818e470c71382ef55dc3fe5697130f1e49617b8d24202f57b26a36d3b72a5abb30
SSDEEP 192:sxZzRD9yW/fLspYx6LoqiIdpJHW6+WNGYzcTZ5hbIgrJ:sxZzryW/fLsjU+JHbG/9
TLSH
T19822A7526E38A57B8CC7D21DBB25BF53E6F95032A1941E48E6FC861C05E7ADD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a94e852a0f57bc82bb2a6eb095eb6e673f1a133cb9f526db8b90fed183a8e1bf
MD5 fae0a16315dcfce9ef76d60f2fbe8a2a
SHA1 ae6eb95ef9fc7d15f6ce44232bc1054a7f8097fa
SHA512 dbf6d8af0eccb6c09f2e366c2c7b5993d852545eb49a0363a7e94989b8bddbc08aa48b7729cb1ef2b57300a5e3eef5309deb6b51c94aec2df60caba65365621e
SSDEEP 192:sxZzRD9yW/fLsuYx6LoqiIdpJHW6+WNGYzc+Z5hbIg5WJ:sxZzryW/fLsUU+JHbGCg
TLSH
T1D822A6526E38A57B8CCBD21DBB25BF53E6F95032A1941E48A6FC861C05E6BDD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c1fa0a026cb28de7be6fcf07ed266bef6bbaa991e63a962f0f8971f489fd6a33
MD5 f864d8a3ad05456fc94cc6224e1da4ca
SHA1 0c79d20ebaf4c1e37d82cbf11b66ed6a2541eb0e
SHA512 345cdec021bc0fbc27493a37c56c0406c2bc56fe97d29e638c748b68f1210d35bc2768044b545854086022e8a901fd06e4253d6cf2a34e15f3ec87c870dec468
SSDEEP 192:sxZzRD9yW/fLsuYtWpVG6LoqiIdpJHW6+WNGYzmZtfhbIgbWJ:sxZz7yW/fLsxWvjU+JHbGRW
TLSH
T1E432B7126E28A57B8CC7D21DFB25BF13E6F9503691951E48A6FC861C05E7BDD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4f3f1614189eed6f448edb7e36e8d7f3e05d01b02202fa447ee1a981c8172d85
MD5 88e7c33848da6a8bf3d08fdda0d1f8a2
SHA1 5a61b42606031ba7c7fff507e7036659177a1550
SHA512 f398809933b2b4f0caaed35df95bd3212faf9adea819c3c66c523abb4f8060e4e93769b8de8bd05d206342c9b3646dea4fa5e8589260ee84057239db8bd6c6ec
SSDEEP 768:MWk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBrroyNYbh:MWk7u70WvqiEau1jai5LA3BYJbh
TLSH
T1EEC2E93B740CCB7E4F801E9DAC566F977E9802C7A6948D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a90cc2172912d8b27ab67a803249e915202377285b5cd2a852a3736699f53068
MD5 f5067612adba4e1a9c8ecc3b78fd4b2e
SHA1 add43b48fa0e075d3f56e30bdef61d01e0d2de16
SHA512 804529cd472a4fc60eecf28d6425b147c8ff5912c28c5847efe12c3fb1354d721ccb96ad52cb8a3ed95a4405a8b2eb0687c1b33cf00966f8544e517cc6607309
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfrIRKsY8HydfIFKEcAogIjKdH:KIbCKcfruKsY+WfmKEcvggKdH
TLSH
T1E3914A8A31774A5238BF29489396853BAF4231637424E86F7BB810A11F67E510EFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ffa26422e36c2e21947cc662f98edd166dffafac89697b5163cbee6ca8bfb8a0
MD5 7a67951d10c066c074ad7ffd1c353a2e
SHA1 c425540f0d3ddf9d666fe05bcb55c1da690877ce
SHA512 b617970d4865434e0b73dc1d9d737de3d36d6164a3ab13792c9c4459caed1cb76e3166481047b72d7cf4907d7e087613b6a0a62650b8093504892efe1e62f962
SSDEEP 192:uKLsNM3QZuiSqBbqfQmiU1HcM4aGBPKm2+FdGr5VkERdNKaqqU8:zsNM3IZbeODtdMbNKiU8
TLSH
T144321A316C746D6B5EE2A141F1473613AFB4413BEA886F84A6EDAB1C05DE3EC130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 55951d18ae11d458cb6eae0fbfbe8b5f11a39cf0de9b13bed1450c9c7969c40a
MD5 05aae353f68c55920dc2c402d9eda13a
SHA1 e95a49265b104e29b0200466b821acdcafe29b4f
SHA512 3adc94bb0a0bb6d411162277d268246a7011b6c4de0130108771367e56ecb1d9d2c9eb95a547ee3465a2ead4d1440111655df473b0bccd7c97728993567f36c4
SSDEEP 384:hZcIbsNMxIZb5FDtdMbPpGvFA8BvtdoWRKJXMPyivIuDoa:pb6XRkPu68OaKJXMPyiguDR
TLSH
T13EA24AB09CA56CE704A5E1C1E582E6076EB81077D68D5E4CA6F9FB3C308F6F81727816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c0c7020cc1e202c51714d2eb6abb587c271f551959d6ee1d51bcef5901550e53
MD5 2ba5b77ba194bba3f744f74fe9db10b8
SHA1 9a28cd450e1100b044e0976e5cfa19ea5e824127
SHA512 d20e12ae49d8b3f47ff336476f7ea431a95eae293415221edc6e8ceecb8482c4ec3afdf3d3620cd33539685df9a433da2d562c20dfbd2fab9d21101216b99c6d
SSDEEP 192:tONl64BSQmiUyWqR5GBPKm2+FdGr5VkEhWwKaqqU6:tONl6eOqRidMbFKiU6
TLSH
T154120931ACB87C6B5EA26541F08736035EB4523BEA856F44E6ED6B1C05EF7EC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2bf3dae8ba62662b08e5747b74aef8911bbd7039715fb20de029a9cf05c7bf4a
MD5 91035dff44cc736fa3561ca7f6e4729c
SHA1 54b77c33392a3a93b8cb5f070c52f8bba48cc661
SHA512 e0d537489f58d922b966d65f2912812592856203934a419fb6abae4dae437898d319af21c54d6eece2c9bf2ca4ed54608a051b16cb7a6895b8c712fa891da1eb
SSDEEP 192:MONG64BAQmiUyX1qW5GBPKm2+FdGr55aDKDZU6:MONG6eA0AWidMcKdU6
TLSH
T1F002F9396C796C6B9EB2AE45F58737175FA8113BE6956F44EAE85B0C00D728C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5bd142b498042361cbaf43727a1b66393c867d7e53fe3f7166f61a6dd3d2f26d
MD5 2563720f74da5f3add76412e6aac32b9
SHA1 7eca05b1566bf5c59f94c7af1a12d833e6c28fb5
SHA512 a0731251b69ae918dede744699f7b47230826e8b6a2030a92f472a04868a45336983ead186201362b8a23ed5038d9650006a7e1b64fa9bb71b35986d2d8a1f31
TLSH
T1B541F658B6E91148B3B77F1AABF7A86E487FBD732E06D46D10110E4E0622A00CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 78B
SHA256 434be14348efda1b2b18fd9cbbebf7f31d09b514ebd767c2e7546c9749297bed
MD5 37ee50bb7ea327c5ae1270031feab510
SHA1 2cc4b260360f18e5241844d013818073fabcae8a
SHA512 bc3f917312997e65d5e721c7488f92c9c61fb8a85f12441de49ea80230279f3e66e60c48c2ed21025e1b718c49126142fb9b2281affc494ee9f3843f9f578d4e
TLSH
T187A012400106001B82C040A74198600A6122E80C545830519780600110449A301C08B1
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 77B
SHA256 11bb049834baf5c89043a55c3fb75b2a2e91914cc4122689fa119548e811ed66
MD5 7b0d99a6fb979d5f7095557029306f5a
SHA1 5b1514d13e7cdeb89c500af1d2d533dde8682afd
SHA512 a9dd9aeefbbf04ee8d805d8f97e541eb7da5ea4dc0f86e80ef3bd21e5302d44ddc94df4534a02a5850198c0c785efd56255da0d7ea27b6a8413cda2aa10774ab
TLSH
T1E8A012400106000782C040A741A8610A6162D80C545430519380240115449A201C08B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2828-334-0x00007FFF5ADF0000-0x00007FFF5AE24000-memory.dmp

Download

memory/2828-333-0x00007FF703280000-0x00007FF703378000-memory.dmp

Download

memory/2828-335-0x00007FFF4DAA0000-0x00007FFF4DD56000-memory.dmp

Download

memory/4308-209-0x000001FC72D80000-0x000001FC72D81000-memory.dmp

Download

memory/4308-193-0x000001FC72D80000-0x000001FC72D81000-memory.dmp

Download

memory/4308-192-0x000001FC72D80000-0x000001FC72D81000-memory.dmp

Download

memory/4308-189-0x000001FC72D80000-0x000001FC72D81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads