hxxp://tinyurl[.]com/epicvmoffline

Analysis

user interaction
yes
max time kernel
106s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tinyurl.com/epicvmoffline
Sample260910-p4ybjaha73

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
56	1592	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1212	EpicVM %28Offline%29.exe
1696	Webview.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	Webview.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	EpicVM %28Offline%29.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Webview.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335184252315899"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{FAB74A57-AA4C-45B5-B5F6-FB621FB6E919}	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
2296	msedgewebview2.exe
4408	msedge.exe
2296	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
2296	msedgewebview2.exe
2296	msedgewebview2.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
2296	msedgewebview2.exe
2296	msedgewebview2.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4148	4408	msedge.exe	84
PID 4408 wrote to memory of 3224	4408	msedge.exe	86
PID 4408 wrote to memory of 1592	4408	msedge.exe	87
PID 4408 wrote to memory of 404	4408	msedge.exe	88
PID 4408 wrote to memory of 3224	4408	msedge.exe	86
PID 4408 wrote to memory of 3224	4408	msedge.exe	86
PID 4408 wrote to memory of 404	4408	msedge.exe	88
PID 4408 wrote to memory of 1876	4408	msedge.exe	89
PID 4408 wrote to memory of 2484	4408	msedge.exe	90
PID 4408 wrote to memory of 1876	4408	msedge.exe	89
PID 4408 wrote to memory of 1876	4408	msedge.exe	89
PID 4408 wrote to memory of 2484	4408	msedge.exe	90
PID 4408 wrote to memory of 2484	4408	msedge.exe	90
PID 4408 wrote to memory of 216	4408	msedge.exe	91
PID 4408 wrote to memory of 216	4408	msedge.exe	91
PID 4408 wrote to memory of 216	4408	msedge.exe	91
PID 4408 wrote to memory of 3284	4408	msedge.exe	92
PID 4408 wrote to memory of 3284	4408	msedge.exe	92
PID 4408 wrote to memory of 3284	4408	msedge.exe	92
PID 4408 wrote to memory of 1556	4408	msedge.exe	97
PID 4408 wrote to memory of 1556	4408	msedge.exe	97
PID 4408 wrote to memory of 1556	4408	msedge.exe	97
PID 4408 wrote to memory of 2112	4408	msedge.exe	98
PID 4408 wrote to memory of 4752	4408	msedge.exe	99
PID 4408 wrote to memory of 2112	4408	msedge.exe	98
PID 4408 wrote to memory of 4752	4408	msedge.exe	99
PID 4408 wrote to memory of 1664	4408	msedge.exe	101
PID 4408 wrote to memory of 1796	4408	msedge.exe	106
PID 4408 wrote to memory of 1796	4408	msedge.exe	106
PID 4408 wrote to memory of 1796	4408	msedge.exe	106
PID 4408 wrote to memory of 3004	4408	msedge.exe	107
PID 4408 wrote to memory of 996	4408	msedge.exe	108
PID 4408 wrote to memory of 3004	4408	msedge.exe	107
PID 4408 wrote to memory of 996	4408	msedge.exe	108
PID 4408 wrote to memory of 996	4408	msedge.exe	108
PID 4408 wrote to memory of 4476	4408	msedge.exe	109
PID 4408 wrote to memory of 4792	4408	msedge.exe	111
PID 4408 wrote to memory of 4792	4408	msedge.exe	111
PID 4408 wrote to memory of 4792	4408	msedge.exe	111
PID 4408 wrote to memory of 1212	4408	msedge.exe	113
PID 1212 wrote to memory of 1696	1212	EpicVM %28Offline%29.exe	117
PID 4408 wrote to memory of 3808	4408	msedge.exe	118
PID 4408 wrote to memory of 1468	4408	msedge.exe	119
PID 4408 wrote to memory of 3944	4408	msedge.exe	120
PID 1696 wrote to memory of 2296	1696	Webview.exe	121
PID 2296 wrote to memory of 3608	2296	msedgewebview2.exe	122
PID 2296 wrote to memory of 4260	2296	msedgewebview2.exe	124
PID 2296 wrote to memory of 4260	2296	msedgewebview2.exe	124
PID 2296 wrote to memory of 4260	2296	msedgewebview2.exe	124
PID 2296 wrote to memory of 3644	2296	msedgewebview2.exe	125
PID 2296 wrote to memory of 5160	2296	msedgewebview2.exe	126
PID 2296 wrote to memory of 5160	2296	msedgewebview2.exe	126
PID 2296 wrote to memory of 5644	2296	msedgewebview2.exe	127
PID 2296 wrote to memory of 5644	2296	msedgewebview2.exe	127
PID 2296 wrote to memory of 5644	2296	msedgewebview2.exe	127
PID 4408 wrote to memory of 5696	4408	msedge.exe	129
PID 4408 wrote to memory of 5696	4408	msedge.exe	129
PID 2296 wrote to memory of 5912	2296	msedgewebview2.exe	130
PID 2296 wrote to memory of 5912	2296	msedgewebview2.exe	130
PID 2296 wrote to memory of 5912	2296	msedgewebview2.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tinyurl.com/epicvmoffline
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff8ab63c188,0x7ff8ab63c194,0x7ff8ab63c1a0
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,17636312178094623492,3861861540017230361,262144 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9247600266580514349,9007211276592104123,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,14206763242920285354,238006708968439231,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10019259686600837042,15435406601694283875,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6033887387269370549,4227845592658812563,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,13304792215845892090,16495076341593334070,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,17233378215976918686,11962032207822171347,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,2520601272088251283,8988735318330071699,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,9836522385240714120,14620383191679298437,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,3743653767339213797,12340532136107663365,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1005955522899598319,1093425553048476861,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1005955522899598319,1093425553048476861,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,11095588367793147163,4834043234684053691,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,4250584725200190791,3182914902458392742,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6460,i,8232428154013346284,13944389060329501258,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,11191475573895509088,6013210984326881488,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6256,i,2265807570872804377,1327579022121417000,2097152 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4792
- C:\Users\Admin\Downloads\EpicVM %28Offline%29.exe
  "C:\Users\Admin\Downloads\EpicVM %28Offline%29.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Webview.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\Webview.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1696.5116.15257826820976212722
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff8a719b078,0x7ff8a719b084,0x7ff8a719b090
        5⤵
        
        PID:3608
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,3761983516581073670,7983652541504008467,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,3761983516581073670,7983652541504008467,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
        5⤵
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1752,i,3761983516581073670,7983652541504008467,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,3761983516581073670,7983652541504008467,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        5⤵
        
        PID:5644
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView" --webview-exe-name=Webview.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4532,i,3761983516581073670,7983652541504008467,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
        5⤵
        
        PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10871182133664268004,17194075801861387541,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,17182108746607832285,12452396695618590774,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10015274623359672944,3688444909529035933,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9190159295115951469,10085485598769902711,524288 --field-trial-handle=2804,i,891834542135058782,11708927131757028438,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6533405ba13793f6d7b5963643c9026ab4fccadf96961e5a5259a1d2152ea51
MD5 4e89bc939c34c781dbe9ce3091ed3e42
SHA1 4a6358e5910a674219cb8379be864d298a57a566
SHA512 06bdd6c015e7029a1f0d13a2e645c445d6a0d53405dfdf7076a78660e3160bf352bf64e9d20ea95fbd982453627647fececc824860874ff205f585dc4017dd37
TLSH
T12571532C52263593F3231174ECD1D2DBF9B2809E45776F1D0548DBFEAA1A711816F80E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5945c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5945c9.TMP
Size 3KB
SHA256 f39e11faba6f5517baa364e1f9c75464b2764775d1e8def9fd95979b7c9f3a41
MD5 78ff6d2c32674d74a4a1f0665ad147cb
SHA1 e557bc4f8b62f044178f51e7c79ccf595f6d11c4
SHA512 ff2716d57edf38ccbdfa519e6aaa1227e6f00c1123574b6b09a4d2b539dcb7c7bb1f98d669ca773d6b1c264fecc98ae2fd80414f863468e6a1afdf847baee64b
TLSH
T15B71300C222A7593F3131134DDD1E6DFB8B2809E44776F1D0088D7FEAA1AB15816F40E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a68f17ed6758bea0d681ac8a782ff66dcc3589ebd9648d3e15a351de277d8d67
MD5 152874ebe8ae4e3f15da582d2edc1326
SHA1 33c234b9e526465d6e1d1b76093cee2123be1817
SHA512 154a6e2ba52fa7e7e7986c8f86d02babf92585d06a0dc5d59dcaaf5fc996a7ba73e2153bed35c949e50ae5d172e1d1a5aeda01d031e71cf2a2ceaf15384854df
TLSH
T16E41ACF2C3F4866EC92267F0AA587D2BCE5C0915826C7C19C5D8EF57A3E3075E10195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 91bab959c0ed3fd421c6cdc20a4f099176acf58cb8203cfe916a4269b434f3ad
MD5 0ba928a9776edecf495d91b52f68dfb1
SHA1 56dd7529e3b6454a1618e0c74dc9f7ac6bccd26c
SHA512 46b427c1fb872fc4837aff4c55224c8c8ee6ef919098fd5e569394bd57bc21661f0864e1e1343f0585e14217522880415eaf1bd301add27ace638687f87197d6
SSDEEP 192:sxZhXRWyM/jK1Ml8Mn0/f3sJNIdp5FHW6+WNOHM/Y4z+jtIgrJ:sxZhXYv0/f3sJuDHbx/O9
TLSH
T16242E811AA346A77CCEBD20DFA557F53D6F9447296900D44A9FCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0ae5daf28bbd714f6dfdacf0b733de7e950a54f03e98ff6f84bdd147391b7ec5
MD5 493185b1aa59d46c84f5cd672d444c46
SHA1 07478838bb598e397d94de7d08f37206d951ca5a
SHA512 966705b170936acfa46367908617ec5ba7dd6131ecb8d0734f4996feb28a23c1e9515bdeadf1860ee365a3bd2a470dfe241875109f493451aa3b0aff6fa7c145
SSDEEP 768:8u8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd7roVkkUnp:8u8iJPNWvx76ru1jahALocdIRUp
TLSH
T107D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee1dcf35503763cc572ba3cff98be912c576b95d1e996cf2d502ed0236ed5918
MD5 6c2aecb32cf84a1ca815cf84cfc5c36e
SHA1 8a3f062bd867edf9b559f2aac53fdecddf79ec69
SHA512 5a90b2717eafe1451d32ce980f57eef412c54340d0638b4bbf3e3bba57db49b3810ce75b5c5385c958d55a8a95152d3966f55d7b8baee7f625de13241945e0b4
SSDEEP 48:KSVFVAVRVlVDVbVrV2dVbVeV9IUVlV2KzVTrV/V2vVNVmOVmVPVFVnyJcIPKFGcR:KMEQKV6uKcAKFGqXaKEUyK
TLSH
T1D6918052717B16023C7D390C9691A72A9B4271733058E5AF7FA904B28E66E2D0EFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dad6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dad6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 46126e00cac033e22f0f934a2244b8dc16ef13976c0605c3e9a950905975f4bf
MD5 277f0775bdb6b479d7ad26db01026935
SHA1 c88c7440ffa86f6291f677c25cf0c75323a1f2d2
SHA512 0692f5171ecfca5e088a12958bf3706f7d1fb0972a3b1a3ebc550f97119f6ebbcdb3d7b79cf593c2065d79e7d91f1e1ed651d03066a8d359e5ae7508f55bd7b0
SSDEEP 384:ciFcZcIGsNY8TUNTUlIlUuk0i3YjEgkD8h/Xt0yRnxuvzxV+Mhdp6B5od:HFKGFwgjk02YIQ5Rn4184p6DC
TLSH
T16DC21AF248D7987AD9AE9743B77D2E034DBCC013BA845A90B7D85A1CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6fc4929a71eaace2b3f940fca8659da2e84570f405cfbe51216345a4ec9f6511
MD5 eee435ba9c03f12b6445111f4b810183
SHA1 e35a0c92fe3a490ccf694df01bf8441a9e4718a8
SHA512 2551a6b1451bdd9b9e09904195fcdd9642416df2d2e2e07eceeeeabfb4d3b0adbc8e6e5a9ffa5b18c4c65a764763a203e209845e198b38e16d1696e202dcf8c4
SSDEEP 384:hZcIMsNoduk0i3RtgkD8h/Xt0VnxuvzxV+Mhdp6B5od:pMYk02DQOn4184p6DC
TLSH
T124826C3198786DAB5CF7A145F44633178EB88027DFCC6F80D9EDAB1C05DA695131EC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ad08054d7692c2277ea1409bce2148b83072100d4423a8fdaf9883c3f3d00c0
MD5 0b637fa645b3acb6a2a7adc65b414141
SHA1 7c621d379e685abc17198a92a3a4d6828f150b98
SHA512 12e2bc24142a729c15ddeee459226fa4fce924bfcd2f7f6e5ffaecceb590ea7b2b9fa815973898e00f51611beb573bb04c1c8204b7c65ad856ff9b2e2014ea0f
SSDEEP 192:gONl6kDfQmiUygUZ903ajzorhfQi9lVVU6:gONl6ghOZ9D8hnnXU6
TLSH
T17402D835A8782CAB9FF3AE49B48637175FA5112BEAD52FC4DAE81B1C00D764C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4bbcbb67f5abc1fb0041e62a967ef29cce07bad1669f68dd6e163a0b2f8c6707
MD5 0f2103a2e3d5d0185178467c533664b7
SHA1 da83995f8664657295b7ebab74cd63f37ac93a37
SHA512 e217dd6c1839c682be564cb6d69e606e8bbf915991eec79b73321b5eb131fe8c0b1e8071292dc832d331c2f1ca67b90a29c881ec293bd5732efa8e632bef50f6
SSDEEP 192:0RONh6ke/QmiUymUVG903ajzorh/XHN0xcRoqJU6:wONh6t0A9D8h/Xt0WnU6
TLSH
T168121A36A4B86C6B5EE3A885B08732175EA58117EFC92FD5D9EC1B1C04DF59C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 03f121cbd19b13f9be0b791f56983b421904122ee42c706ef2f2748d2ba88a1d
MD5 14041c9b41d55dce1d1a29638d6994a9
SHA1 de4793b26ba4733a6d3672fc01d0b8da5f6829d3
SHA512 9b0cfd4a466240b6d0c2d86d54c71b3d09173852f445aa671a4d0cd984723b33c67c7e46b1db388f532761cae660650a1a4906f35537bb5056681a426d58bf8c
SSDEEP 384:qZcIusNoUuk0i3YjtgkD8h/Xt0RFnxuvzxV+Mhdp6B5od:IuNk02YJQsFn4184p6DC
TLSH
T1F1826C31A8786DAB5CF7A145F48633139EB880279FCC6F80D9EDAB1C05DA694131EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 504179c2ec3fd1c3ea8adbdb9c5b7357bfaa910887d9982bfa77a62ebc743148
MD5 9d6bf8389dffd40dd443b085468f93a8
SHA1 a46ec25e84d66cf5dcdb1c262c7452df190ef7cd
SHA512 51522b92f2f41af80696b2d2767318365f5926761aa1b770f14a19aa89aedb124941f259251728d1e2582c9c584f893e0722dbc7a0893b7b9a74ffa9fd0f8a23
SSDEEP 384:xZcIhsNopuk0i35tgkD8h/Xt0VnxuvzxV+Mhdp6B5od:Zhkk02bQOn4184p6DC
TLSH
T1D7827D3198786CBB5DF7A145F48633174EB88027DFCC6B94D9EDAB1C05DA6A4031EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7a562bb-0789-49de-9f90-68e13c399697.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7a562bb-0789-49de-9f90-68e13c399697.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4894a4cd47406adad7a379ddc56e41e0e839f5e0a6c5b841479e02b6c353a3bc
MD5 2be12e9093a14f0912f5b73ae46b98e0
SHA1 7b0e799b3557d7e26fb555c759d3d584ffce8b49
SHA512 2eef32e8d41db82b2e26fdcd2965096387c081c15df6af6e60bd3d33b2f226d9262a5f826565a1634377e1693ee07bbf88499e50081fe463de6c02892a03eb41
TLSH
T12E410958A6F91144B3B7AF5AABF6A86E487BBC762E07C49D10010D4E4663A41CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WebView2Loader.dll
Size 160KB
SHA256 a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90
MD5 96a0434c6a4c91accf292267f0e2fd6a
SHA1 e5ab2a171d8021572cbf695cc868c70547312132
SHA512 b886d96b1a50cb6647a79681762d6d2bfcc5d5a07f735aaf38dfd803faa4c48eeb38607b98a481b35e388fe73376dfabc7c4fdfa3a77473dc2f9463b6e3f9a15
SSDEEP 3072:NXBGnzRbA2eNug2CPrFyg8c/d9U9sPTtno6EtJ7mqRXV:XI95S/1rFyg8e9nfEtJ7j
TLSH
T1E0F35C57B2E500BBE167C274C9B34A55E776B8121B60AAEF0364473A1F237D0AE3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\config.json
Size 331B
SHA256 e62cefaa83798eceb73367bf2635512cac3710f978c651c7bd96f6de9c0c3243
MD5 ab20f95e118bddf86e01ac3f2a7fadaa
SHA1 b93f9115ff4320d7982d0fc7e8688501af6f58d9
SHA512 f000bdfdcf3c88c90993c9325ce3fd623315a4cb5b8c4392fd3fc7ea04cec37be07239a6b86bb4acff080730bf21bde0b4435db071f8f691901edd5c655976ad
TLSH
T124E08C62C23012FD6AB4840C9962E0821F215F08A1351C6BB5FB940830A2B367043F9B
MD5 SHA1 SHA512 TLSH

Submit Download

webfiles.zip

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\webfiles.zip
Size 157KB
SHA256 26c00589f133a2aeecef8f7994f7381935ea6eb7582b97bbd8eaa84b0b299a79
MD5 ba779484f2103de883d16e6849e3272a
SHA1 092af33425bfafa4678918e18abce12f922b6a4c
SHA512 c027751ef44029f57ca68bf8681bd1cd5697fd80b557facc9ce1be077c34af1e906d713f7e0c1c23d35742fe2a94b34a9a61fdcff0b3e9b791aff2fdce90893b
SSDEEP 3072:C6bM/38HDXH6anap/M6mMTudzLLdl0pKsfOwpTwXE8XfO4OyyllEOfylGc:dbM/38HDXH6a9MTOzPn0piwpT2WM4EOG
TLSH
T1FCF312B64C1C1C47E824B2F1557EAB48B245CF77E4FA128C2D10BC9FB29D5E516C8A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.css

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\webfiles\css\main.css
Size 10KB
SHA256 1c55f8869a15a9adff3dcfd898e83b0ee1a93f5d9ef6d370750ff415dcad55d7
MD5 9e339a86d287858d82ae8b046184e736
SHA1 7d170359967a4aa1856d507626afb20d4ab3fb41
SHA512 9a6ea2b8fd7b79353528981f0b6aebf966094d7671ddc2d0158d7202861fd8bae1f5ee5c281c357c85501be3ccb188fc8d7700b8382d415d861743d86ae1582c
SSDEEP 192:RrWt0t6AGGx7HRjHZIISqIFIiq7UDGDQWD5DPmzFnMj7StlxA7tHEq+YKp5/stt7:NG0QNGx7HpU5y0GDslB4hXN6FpR8sbEN
TLSH
T19B32A96012DF0CC8EC17C64857D86631733A40138E1AFDE9FBCE60DC4F859B592AA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\webfiles\html\index.html
Size 7KB
SHA256 9e6c8140ff03ee6f6f346df179dfddf4c4447a793c2b503c495e2df5c376414f
MD5 52c9f4caaec520072bfcffabe2fffb66
SHA1 66b4d1ddfc59631a290596da8bfabd546ea0679e
SHA512 95f75ed618673d55ac3e688f13d9ce3708ee38b38c6ca3b6efdd4327d582b025eba71db7892b72b240b535fb4339f683b7aa379fe9f22209de63492591bfaaa9
SSDEEP 192:tRel5Z8OKef9RXAVSHySkXkjFIWuaJZycOHXdUBU0AcSzviHUvIuwJOjzwJ8jRaT:tRel5Z4e1eAHySkXs/Zyc8d/0AcS7iHb
TLSH
T155F1643051AD2E77120142DA20A55B8A30CFCE36DB476867FEFB57F213CBC99608A163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epic-vm-local.js

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\webfiles\js\epic-vm-local.js
Size 16KB
SHA256 355d03a4a7fb71386efa44d06d380bf0e71816a3c92c4e47c12551fc0d19f594
MD5 9d386e530504d4a943c2853da00143a9
SHA1 acaedb8d745cde89d92b98ac6137584f5da6c51e
SHA512 a91ea8bcf302d71efb26d558bccfaa703f59ba0839e328381eb820d37c1a8a544e4b0359e9ee7b6b8cf671fa2a48cd9a3cc1c69f0e6c0e32e9ea0a4d1693707e
SSDEEP 384:Cr2ZNbB8eFiPixik4FiFibiyimi8s3xiZiQiH40sxjiUiIiFibiXiQixi+BpTvEw:YhK4Q0+b38sogtYDIJl0+St4+BlB2zmj
TLSH
T12C7209A5E36C172883BC815E153D3ACDB1BC814A6A450CE5FCBC847860E9EDEC5ECE56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d16048172de087f846e37bdcd292a43c7bcd450dccdc2cac663df523ae9a53b2
MD5 be04c4b5d4d3855831d7e0def43edaae
SHA1 a4ceb53d2ad60d46a131fde6328c5974e72d5745
SHA512 5d300de50b0ff4030486c1dcf39b7440f668f2aecb802d7bcc275e30d8fa69854302d21ac1311407b1bd964014c31e351cdc40b3d23ac3f7a5cf58bba56ae692
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2b647655bc67612dd9e6433514508869c745a9a528deee8b65dc0d7c6810e4ae
MD5 1e2ea4279c7ec59f2049303f55c9ffb5
SHA1 cdb505f388bbbabdfcbf1da98b1b1f59a7f90f55
SHA512 64206511380adfc29d23894b6b93452cee9c1c3e7d8c7cd42bcac95209aafd2d17c05f28ea0e10355000e5ad421e3d4c2ff64f01aa210a7d78a18a0879804b97
TLSH
T1BFD0121BB601413CC4202033101369091444C10B400B40419C2CC62E5F040501903455
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 e856c204c8b13bdec18558e747458960cbee9dd420bf87dd543d0ab668e8f18c
MD5 d170b24f2f8934730ff8dbf18207eecb
SHA1 dac61a6fedcd4a49829209df84c6ea0d297e58ea
SHA512 854812d9e09be18b71d5643da9f8af245b4e9699d53ca135014fb158cce70bfbb7c00a43b00370b4c8ad6d707abf372b1a0e2b2feafd1a6a6e123152898701c8
TLSH
T199B01230049795F4DE0313B870CB0CD334310871C50B0E324390F9725992B4203C0C05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0a38c67d0b55dea128cd2f144d284dfe9ee78c2ffd40243a7cf354f333aedeb4
MD5 c32f701c10af770072d7c0514c6f7069
SHA1 ed3d951dbe40a37d7d2173e5561fd3b0fc946f73
SHA512 b8fa6d2348991efa4e9019df26e7f696a1ac53f74914a76a22df3f702ef6b851b04dcd93c3cd21651797d3d55948830b7ca48f87b27f7c29a3073257d3ed3014
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Network\TransportSecurity
Size 352B
SHA256 a54f566dc793325b92cf882fa45e076cd2ce307724f815da2014217e390d7c2c
MD5 24fb3d76207b62015fbd34c069f5e8f4
SHA1 48813eebed3bd0a890bf810dccc5b11f944ce5b7
SHA512 f58b9c2a9765a6cc4a129b2ff6a3ced497ff0ab575432ff1bd62c4c8bd7b1e71e8927a6fa3ddd9658d9933261bb3f5d6b9461badec058b153438cd23d250fe34
TLSH
T19EE0269380AEA5A7203905621E847A5A7F35F8784AC264F4C6A7426EA0611EA6623033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Network\TransportSecurity
Size 352B
SHA256 dd0a05ca0ed6c02495e94ce55d4d6c34f53f97995f5c3663281a4579a8db44f8
MD5 be1656b492369cd365a3ab49e21fd4a1
SHA1 052e6b24f80c781a9099d499492a1f966545faa3
SHA512 1f9fb84c933f7db459141a84eb2264fd12b5753f327312244300865bbe6104777733e2303b3dfda0c1567c9d6b7a7a365a068921d921f8f347fab4f9b1c87ed7
TLSH
T154E020D340AFA5AB103805721D407D5AAF35F87445D154F8C692427D60501E67613037
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Network\TransportSecurity
Size 352B
SHA256 3686610f8f97e25edeb83c391280819b539b3b6730e3ef37762f72783d564387
MD5 d58b1dbf124dd09ffd397e7abaa09bb7
SHA1 5c26d2896800dca85d75de354d39cd276dc105f5
SHA512 fc1ec5c999adf35606f0a5ad7d8430f1a245e411e67e4e8e8508bc3790e62ab24bfe81367e5935495c9c97af066158269996f1fe418bd240c0ed91cecdc807b3
TLSH
T171E02693807EA567107905621D847A9A7F35F834428364F5CAE7466EA0910EA6923033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59d509.TMP

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Network\TransportSecurity~RFe59d509.TMP
Size 186B
SHA256 daf3ff449140329d8ff3def262d9a862f228a96b1ddd86f68770bee7e574993c
MD5 941745eb5cd8db912dd2d4931a6da55c
SHA1 f86645bfe7c1150198babea5ec585c07a27a9aa0
SHA512 b2e7abca4ef0bea86fc5a06d36de121c63ef53f8567b606481bc33750520e7a9ce7075ed915d7a36169103366cc7aa6bd148b3673dcd592ada40a1bbdef9005c
TLSH
T1F2C0C0F240BEE033107806210980FF417F36F030004058FCC283037D51611B6550F023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Preferences
Size 6KB
SHA256 76c4c235c08f19e7a10f29e857943651fb368fecb33d53699513a6b45518d575
MD5 fc2a5cad5ab3938dd9bc1afd30e75599
SHA1 cea4c30dfd4a15ba20025528ab58420de7595a1d
SHA512 aad1e2832ebf505ccc37f504c95e4d2a6e1a22aae7166049d9641d25550377e6380679c5cd8c41cbb6a35b10becd0570f2bb4860eb3eac7150c419cb4bf2ba88
SSDEEP 96:st405cpYQ+ULb9W2ffqlZ8i0vhE+kmIm/7qx+WVHMSm+uecaxgiQjy+gaQ+MOB:st40hIfcZ8pauh/S+Wi8xgiDUQ+MC
TLSH
T1BDE1C8029E2869775CC7F21D7A25BF52E6F650222AD40E58EBFC861C04E7ACD530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Preferences
Size 6KB
SHA256 8a894e43557744e6d98c2449f2650cfe23361a254cd1495bd563322367936991
MD5 ed8e9c8a28e3c2e5732d15469fbbdb9c
SHA1 7322aa2ba73923cde5a8c35670abe3d7c322b88a
SHA512 9993810510554fcddb70e623590ffa7b23ce7ccec742db6b1fc997602f83c151302361f139709e1e21d09cb2f358223c26ab99713f2108f5fe2d33a5ed173672
SSDEEP 96:st405mYQ+ULb9TffqlZ8i0vhE+kmIm/7qx+WVHMSm+uecaxgiQjy+gkQ+MEB:st403+fcZ8pauh/S+Wi8xgiDiQ+M8
TLSH
T1BED1C8029E38A9774CC7E21D7A35BF52D6FA503226D41E98EBFD851C08DA6DC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59ce43.TMP

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Preferences~RFe59ce43.TMP
Size 6KB
SHA256 1cafcca67871b83f12b83c733f3625c70003acbba12dec0c54ca59cbb0101a05
MD5 d8cc488b7ca1d6f601fc2759892f171f
SHA1 075d5ef85efe155fe36494a4467a36b66dbc1e2b
SHA512 b063548f0076c8db5305ffeecb1152aa2941a308aa7f389fc8ae48c6de1e5ac8ad45a40c5cbfbcded5353c341243da182af69633605ffa287453e4ed3068447e
SSDEEP 96:st405VQ+ULb9TffbZ8i0vhE+kmzm/7qx+WVHMSm+uecadQjy+gkQ+MEB:st40T+fjZ8pauC/S+Wi8dDiQ+M8
TLSH
T1F8D1A8129F2869774CC7E21D7A35BB42D6F9503126D40E98EBFD851C08DAACD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State
Size 16KB
SHA256 7b62d85a8cca1b28076d185efe87fc98e27665ce4b2bb8b5711027321e5e06c5
MD5 fd810f6f5be21b3b9b9b2fa34b47113f
SHA1 b19b17d221bb4de0f80cc80133f1d9475e99d842
SHA512 af6615925bf301576d1ab827523346afcb3f37ef918b292784b1cb61f09424b56e993e30539196ddeef897e1ef70a8d7192bc5c5a1b70cfc04d1b1bd57b9d802
SSDEEP 384:zt+aQikB+z/xvxjg/qhEwNbU3Am02UUg9zB:0/UxvxjgC+hT02UlFB
TLSH
T19C729D3B94692E3398F3A905799C0B8BDB75946295C12FB88AEE2F0906DB7D40342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State
Size 1KB
SHA256 ff373f610ef8422ac86956ae772208412293d89500280aa5d14174376a0d0871
MD5 e0ac02fd3a16edf7033832895ea5c94b
SHA1 6d5c7d92023473ca9f0348dfd32e7125d29f8b39
SHA512 29b50e542422aa9a409defaf4cc603c164afed18679fb83a4364d426a9b2169bee6776a323022b499f4e6411d0e90ed923476ea287fcc49d68fbdc8dd2c7a476
TLSH
T1B43185B3E4A427329CD3224971C927D76D216036D5545F44B2CE4B1D01EBDCCE2BAC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State
Size 2KB
SHA256 8980cda637805e74d239172be4df7fa2b66b8a43955c12b1c101635321859716
MD5 6724c39f579fb24ef521241d82f4ad73
SHA1 0326c3235a4573f5da36ef9d193e24f411a106fd
SHA512 23656a826e78c2bd0425f68f1c6f54413652198b614bb597ad3207275837a74a940053fefafcbec606330c1d7eec98a67dc08ba526ff78af18c31a63280f0751
TLSH
T1D5519473E85467368CE35A48B98D2B93AE369031DE912F50A6DD0B1C01DFE986392C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State
Size 3KB
SHA256 2b057fa4e015f1b4b36ddb2b741ce8943c0227fc7bcfb084091499721f5e6460
MD5 6f6e920d7f5d1383576a8135ba5ddcd8
SHA1 d3b2c9c051f11d93027a667561a63a237727ddb6
SHA512 38ffcee188f71bb520f0765859d12f78594abb894dc8594754a3d1e70a3f5a2cf1949a146d2ccea33dc8721007b7f84ad16c5e54a897ebfd3726c3f3b268fd26
TLSH
T11A719472A864A6374DF39A04B8C92B57BA659132E9D43F94D6ED0F0D01DBBC82392C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State
Size 17KB
SHA256 5d8b304bb094dc36f92ede19360df6c1704d31e0d95e74b27cd7f72568fe1d74
MD5 4960765beb08821c5415e0d6f270fc0f
SHA1 cc8a511846b486a42027446a0fdd89556f2a3498
SHA512 68f64a37ab611adf0e1496d44a0de3b35559de5108055d2e6439741192e45787205c907567e0c3dc56468255f7282e5e5dbd34be87a4d1287b7aa3422e37190a
SSDEEP 384:zk+aQikB+z/xvxjg/qhETNbJ3Ar+L5r02UUg9zB:n/UxvxjgC+n/5r02UlFB
TLSH
T1B7828E36D469AB3398F3A645764D1B8BDBB1846255C52EE88EED2F0D06CB7DC0307C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596a59.TMP

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\Local State~RFe596a59.TMP
Size 1KB
SHA256 a5e8d6f88c302237961d336ba3064b1c9bc620eb4dbd71ebc9b7bb277df80882
MD5 3298871d0e4a3602352a82b54be95f97
SHA1 5091921baeffff264c2730265d2e1f6d31b618ee
SHA512 d182fdac044a94386e574fe31d418f1c815ad0cec482600486947c20714a10fa9b1cb7cc76a1a09e0588407e675e4c05b718b08b184f90fdb89643548dc9d9b0
TLSH
T1A72162B3D4A52672AC921549B18967CB2D21A036EA585F08F2CD061D01EB9D8A3B7C32
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\RevisitationBloomfilter
Size 392B
SHA256 6d8c7f9840803722107261a763bfb6068f7244866603c67710251eb01a2e70fb
MD5 55338cb3dcb19d46212b3511545c2f39
SHA1 bf009d7aadfe75107820914b522eb7713d9dee8b
SHA512 fa86eeb91d2f3bd2c98ece069356517581d3ad56210d9909b4cc87c6e3e393965658eeb5c5339448add6477e726e621529879534c3595123a5d8c3327f011ca8
TLSH
T1FCE00202530151E6C468563000835B502B52C420018103476B3002941C743003D20981
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59ef58.TMP

Path C:\Users\Admin\AppData\Roaming\HTML2EXE\EpicVM (Offline)\EBWebView\RevisitationBloomfilter~RFe59ef58.TMP
Size 392B
SHA256 81e6ab0c684e394e5d4e1e698f9e2a9ad658cb8f84aeeeba364e692253cdc35a
MD5 29b8562973c555005442ebfef68af32d
SHA1 cd14b5e24f21906a5eee702e3bc5e80b000b623f
SHA512 845578a17823c412385b5c97ccde6b5bb28cad6b7daa254504ddc183d59dc60cf03d10d45bc91141f81e7a507619945954c467150ac39a9a9b78e9bfadd34574
MD5 SHA1 SHA512

Submit Download

EpicVM %28Offline%29.exe

Path C:\Users\Admin\Downloads\EpicVM %28Offline%29.exe
Size 48.0MB
SHA256 9c4620080a228a7309fabc319c09c1d2585938a6e182de48f5df8c0b035bc476
MD5 37cdb1ca17e91259dc0511cccde83cb8
SHA1 951e992815e104b884b7cfc633aad73541cd7e97
SHA512 4c135c0ee2120f58caee185d22e4069991844f4605f7d710dc00f242c46dd2fcf43811e4aece5e205e2e88f70107e77cd1829dfc0bd52c391c47e8c1d53627be
SSDEEP 786432:bqwLTVKnVsSXzHTwNdb9qOUYa9LxMhCLAlNBh4bJhHkA5+tct6W+B0Zg:bDTVKVB7TwNdwOUYaL4Ce8bJFstct7+Y
TLSH
T102B7330116F52252D93386FD8ADA2D2C87207466F30DD0AF6222FA715691FCEEE74736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-335-0x00007FF8C6AC0000-0x00007FF8C6AC1000-memory.dmp

Download

memory/4260-728-0x0000028CAAA70000-0x0000028CAAB1C000-memory.dmp

Download

memory/4260-533-0x0000028CAAA70000-0x0000028CAAB1C000-memory.dmp

Download

memory/5160-385-0x00007FF8C5910000-0x00007FF8C5911000-memory.dmp

Download

memory/5160-386-0x00007FF8C6980000-0x00007FF8C6981000-memory.dmp

Download

memory/5644-451-0x00007FF8C6AC0000-0x00007FF8C6AC1000-memory.dmp

Download

memory/5644-551-0x0000019F37810000-0x0000019F378BC000-memory.dmp

Download

memory/5912-708-0x000001BCC1940000-0x000001BCC19EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads