hxxps://x-plane[.]joanpc[.]com/plugins/xpgfs-noaa-weather

Resubmissions

10/09/2026, 16:57

260910-vgqaasvxdw7

10/09/2026, 16:47

260910-vavansvwev7

Analysis

user interaction
yes
max time kernel
163s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://x-plane.joanpc.com/plugins/xpgfs-noaa-weather
Sample260910-vavansvwev

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3696	pythonscriptsnetinstaller.exe
2456	pythonscriptsnetinstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonscriptsnetinstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonscriptsnetinstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000400000001e6ae-201.dat	nsis_installer_1
behavioral1/files/0x000400000001e6ae-201.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335324670218714"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{29D6A770-B01D-4B85-81FD-1BC62982126B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	pythonscriptsnetinstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	pythonscriptsnetinstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	pythonscriptsnetinstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	pythonscriptsnetinstaller.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3696	pythonscriptsnetinstaller.exe
2456	pythonscriptsnetinstaller.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3696	pythonscriptsnetinstaller.exe
2456	pythonscriptsnetinstaller.exe
4520	OpenWith.exe
1916	OpenWith.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4848	468	msedge.exe	85
PID 468 wrote to memory of 1988	468	msedge.exe	86
PID 468 wrote to memory of 3672	468	msedge.exe	87
PID 468 wrote to memory of 3672	468	msedge.exe	87
PID 468 wrote to memory of 3672	468	msedge.exe	87
PID 468 wrote to memory of 4272	468	msedge.exe	89
PID 468 wrote to memory of 4272	468	msedge.exe	89
PID 468 wrote to memory of 4940	468	msedge.exe	90
PID 468 wrote to memory of 4940	468	msedge.exe	90
PID 468 wrote to memory of 4940	468	msedge.exe	90
PID 468 wrote to memory of 3928	468	msedge.exe	91
PID 468 wrote to memory of 3928	468	msedge.exe	91
PID 468 wrote to memory of 3928	468	msedge.exe	91
PID 468 wrote to memory of 2148	468	msedge.exe	92
PID 468 wrote to memory of 2148	468	msedge.exe	92
PID 468 wrote to memory of 2148	468	msedge.exe	92
PID 468 wrote to memory of 4728	468	msedge.exe	93
PID 468 wrote to memory of 4728	468	msedge.exe	93
PID 468 wrote to memory of 4728	468	msedge.exe	93
PID 468 wrote to memory of 4860	468	msedge.exe	99
PID 468 wrote to memory of 2612	468	msedge.exe	100
PID 468 wrote to memory of 4860	468	msedge.exe	99
PID 468 wrote to memory of 2612	468	msedge.exe	100
PID 468 wrote to memory of 5048	468	msedge.exe	102
PID 468 wrote to memory of 3440	468	msedge.exe	103
PID 468 wrote to memory of 3440	468	msedge.exe	103
PID 468 wrote to memory of 3440	468	msedge.exe	103
PID 468 wrote to memory of 5004	468	msedge.exe	104
PID 468 wrote to memory of 5004	468	msedge.exe	104
PID 468 wrote to memory of 3160	468	msedge.exe	105
PID 468 wrote to memory of 3160	468	msedge.exe	105
PID 468 wrote to memory of 3160	468	msedge.exe	105
PID 468 wrote to memory of 4452	468	msedge.exe	106
PID 468 wrote to memory of 832	468	msedge.exe	109
PID 468 wrote to memory of 832	468	msedge.exe	109
PID 468 wrote to memory of 832	468	msedge.exe	109
PID 468 wrote to memory of 4140	468	msedge.exe	110
PID 468 wrote to memory of 3696	468	msedge.exe	111
PID 468 wrote to memory of 2016	468	msedge.exe	119
PID 468 wrote to memory of 1704	468	msedge.exe	120
PID 468 wrote to memory of 5068	468	msedge.exe	121
PID 468 wrote to memory of 4700	468	msedge.exe	132
PID 468 wrote to memory of 4700	468	msedge.exe	132
PID 468 wrote to memory of 2456	468	msedge.exe	138
PID 468 wrote to memory of 2672	468	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://x-plane.joanpc.com/plugins/xpgfs-noaa-weather
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8e5c1c188,0x7ff8e5c1c194,0x7ff8e5c1c1a0
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7219718108116368183,17623893589619056734,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,10259890840235358150,10700645487829772633,262144 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,10346841889970047191,12507590703878018397,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10559850026135242548,3236517049496159161,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2470232685511153164,10490852139333692497,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,5877876943771944834,1747007044520317932,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,3204025396641917605,14465058021108581937,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2417272921811912986,15422711673052544062,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,8678721634436482701,208284243126057448,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7187343075942160624,2156285861198809716,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7187343075942160624,2156285861198809716,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6308,i,1780390662080204604,6122145461446143210,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,2259691011845235460,17954657164665257301,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4252,i,9717019453997548520,5044931601092536416,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,3586203973257055242,10437506978221627310,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6584,i,17962775731390046001,8275508673383329614,2097152 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,1862147651970179342,14255390233361468585,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:4140
- C:\Users\Admin\Downloads\pythonscriptsnetinstaller.exe
  "C:\Users\Admin\Downloads\pythonscriptsnetinstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17617228097093695808,942979225867192711,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,12307781055557975492,18445666772070589549,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5152689426414199812,9279397234657526484,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,8189449463492255123,3652155533276251859,524288 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4700
- C:\Users\Admin\Downloads\pythonscriptsnetinstaller.exe
  "C:\Users\Admin\Downloads\pythonscriptsnetinstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5952,i,18418622416632198151,3377910852375529900,262144 --field-trial-handle=2368,i,17038503166328469795,13335601291770423397,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 3.2MB
SHA256 62cb59eda350fabbd10c982c7523b584ee848c0d8bf2f845e81d9dcacbe6b531
MD5 500373e15c8dc74a0125093657b54db3
SHA1 b9078e26b2cf8197c4b4aa808fd0f8ee5f80ac9f
SHA512 7552a5db22d7cedad8836a7eeb2e86828cdfff8787f733eb24985d86ae991e8e22e8618ada0b11b95060d7d80c0f0410af98fcc89aefce7763d688d7876b7866
SSDEEP 49152:7M6s0YWybKH5cIKVLjsZusX0NpPiS48bc1JKhUoCjDV4UPZwEqN7AdGyoagk2nzh:VVeIKxDpPU9KhJCl4URd27Trj168zCpW
TLSH
T16BF533A6413F9200F9CFEB7B6598C87455CA09021D8A1B426D5B38E5076FF23BBD51CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67ad89d970f3311cfe08337291973242bda1d3a1e8c259de5ebe551d9e530e85
MD5 3cd8e813d17b90fb793544f98c7442d7
SHA1 ffe67d614b950a6a5b5e7842fac9f3d37c1d359a
SHA512 fc896f57dd0e983abf8eaa7b506fd122ac31ca2f0b5af47571b2a3006eea5cc403acbb015eaf4aa755a96406ad7d106a6a288f46b11f44c854945063cdf3998d
TLSH
T1B261F974026186F5E3EA123284D30E8CB4B986F6F9077E0B69D4DCF7E7A6F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bf92.TMP
Size 3KB
SHA256 cdd950bde0d9ceef7cc3905039a87aac6bb52bcd003cc332babed3c2a06d21e0
MD5 c62566869da323b8567b4043e347d2f0
SHA1 3e7eea96adb4b2adf7ebd0b8ac74e040a86c6de1
SHA512 77debfc731e72d2b0df595f6a1b4f76210d94620d14ba857bc7a886a7d5ecb5263ce4cee6eea3eb5921cdb6df57b8ed6a4fe3ec07b9078f3265019c26ddc3310
TLSH
T11661E834022186F5D3EA113298D30E8C75B586F6F9077E0B69D4DDF7E7A5F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3bd8ef525019827502d6937e1729257afb86efa4190f1a730676b5209a878cbf
MD5 70ecfebe5fc8ed3446519bb32a54d782
SHA1 6db7889ed22e5174244917f99283d93daebca588
SHA512 825a2fad1a82baae92bbf59667d094198a8538e381f3f2b7f80382857144def5d2f7aeebf0cbe72d64113dacc3e6a314644e5c6116dadb7adef40ead99fcfa88
TLSH
T1B7317AF783E1C26E8A1556F0AA24EE1BCE2C0515471C7C6989D4BF6BD3E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d6c2fa02debb44596b10b821efe580135d82eaaa6d1e05f8b34d632192198e0a
MD5 864b0ca64d3f41790b0f69c8080bb065
SHA1 a0fc53ac452a755265d9646d036b2003d2aa6193
SHA512 5c1a8c6229fc0e9618f9c3c8714fc44a1e15f9cbca303d6230da14c59601bc26bde5e54dba5ef5b3672cf9ddd3d94bfe5abc18a6fc1d47f6baf802867c4fe633
SSDEEP 192:sxZDRPyM/jK1Ml8MW4/fIXs7rSaIdp1WHW6+WNRtbhk/Y9IkKyQFTIgrJ:sxZDBu4/fSs7rgUHb7Vk/s6t9
TLSH
T17942E712AA389977CCDBD209F945BF53D6F54572A2940E44A9FCCA1C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5910c3915633dc481611316e35d0b2849824503c53518e107f0bcfcb4260725
MD5 0e3d8cd19aa4e7cee4cb38bc68cc4313
SHA1 d13612c755dbd594f3529be66ecd601210e6545d
SHA512 2f4d7b8aac5ab0b1fda5b8d97cccbe021cf75098a7e5a097ad9bf40ac20b927402fa4f64d98a463632bb73824c0b9af604fbccee4ae77df5cb04d977c82eb39b
SSDEEP 192:sxZDRPyM/jK1Ml8Mn4/fIXsrrSaIdp1WHW6+WNRDYXY9ITyQFTIg56J:sxZDBv4/fSsrrgUHbmX5tw
TLSH
T18442D816AA38A977CCDBD20DF945BF53D6F54472A2940E44A9FC8A1C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f7a0e222312e2f1af0114ac10304d113e424a2ee63e209f45d0d86d29afdd427
MD5 31749619ffaf4e7c6d79b0ddb838707d
SHA1 e7389b0b2d69634fea98dd758541de75ae9e7357
SHA512 825b4df32b6bc43d6811379d7d1471c9eec2620e67467572c545926e1197c299ce2e6b5f5429a5230d8e265cd1376f76fa93b7fba0ff76b6de5475f478b1a39e
SSDEEP 192:sxZDRPyM/jK1Ml8UQ5n4/fIXsDrSaIdpbWHW6+WNRDYXY9IlrQFTIg5QJ:sxZDBqp4/fSsDrgKHbmXKtK
TLSH
T17052C816AA389977CCDBD20DF955BB53D6F55472A2540E44A9FCCA1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d923a829a12c2318d8813788f1055a0899955185899f2845d160615fc0d4a4a5
MD5 857d478e6040e211238b9bf08bc578d2
SHA1 bc354d586e7a93ab83b96c4345a5b84ac5ad32a4
SHA512 f9605a73f98cc154282898aba2d8132aca81a0a0ae920dece4bfb7e912b674a6ce91957b17fe961bd0cd81e93db59006f9130b81f2bad69bac11e98e9f95cd6d
SSDEEP 768:1xwjcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNwNroAg6Z:1xwjcv21wWvu+Z+u1jaeFLeRNwmAJ
TLSH
T18FD20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82a4ab31-6a29-4345-84df-d0d1f4be9543.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\82a4ab31-6a29-4345-84df-d0d1f4be9543.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74bcc1dd38afba818c5c70c92d64eba94c37b29d9e8f3ef82e9b77c09f8d3975
MD5 824dd09f6912e8dd18c27e97dbd906aa
SHA1 bd9bd315c61b62ce56a6aa7283f3e2cf39ed76a8
SHA512 a5be5c85299aca4b3cb18c140881414d672205f08733c2140e95bbe2bcc454d25184bc68bf3155098c0c875206de911c548f90eed84702dab0a1c625aedf96b5
SSDEEP 384:ygZcIhsNdkCozimwB7hvtFe+C6BRuxMrJrZRi+Ssa+VYJoJ:yehKiN87hvt0i4MrhXithgGy
TLSH
T1DF827C3268685CBB59E7A241F94736135EFC9067A6CD2E90C5DCAF1D01EF6EC2306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 858a9959be54892a0cf031e51dbd39b61f7f17f203f3a739a8d049ed96103e40
MD5 eeb772d286b42d481e8ed5e897831009
SHA1 051dbbf164027d6a408a432f8516200b33f40073
SHA512 6dd9e8c6b2a79178a70f785cea0bd7d34991ee770d8062ee2746fd582290f23f69ff68b83fd1965e8d4701277e6dd238583b510269af08fe4046c9251b23a4fa
SSDEEP 384:KzZcIWgsNdkXozim+B7hvtFe+C6BRuxMrJrZRi+Ssa+VYJoJ:KrhKlNa7hvt0i4MrhXithgGy
TLSH
T120827C7268685DBB49E7A241F94736139EFC8067A6CD2E90C5DCAF1D01DF69C2307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d2f8e01c74a3fe251199d9587d12b45f34ff440d1aabf803be0c40d9d4f6519e
MD5 28ba947384d7489f612dc663f5cc9aa4
SHA1 28affbe6a78826c12593ffd83fc87165c0e1d49c
SHA512 59dd9313d04b96db02cc4c7cb9d642a0aea1c7be8d8c9e7982878c43f190a83da1e588bee7ecbc72a8860c2297499b9de9bf6f80233bb393c0eb4bd2c79edc67
SSDEEP 384:SliF9ZcICgsNds8TUNTUlIlXozim+B4hvtFe+C6BRuxMrJrZCi+Ssa+VYJoJ:SsFl9Kswg+Na4hvt0i4MrhEithgGy
TLSH
T132C219F258D7487AD9AE9743E77E2D134EBCC063B5896950B3C85A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5502260aa7a0487f71605080eac652233d39106b850a332bffcd491974bc827e
MD5 396cb7ed4d1f61f2e835b30dad605b48
SHA1 d1a34e46d7cf0d1623c6ece90fb8fb04462e8416
SHA512 b165df7254e1aef2f2ceae646570995a13eabaf0598871249d88adde279865a493d7fc3586e333bed06c31ebcd3683ad01ec97dd92874fd6c1bc0b0fc335c5a5
SSDEEP 384:SliF5ZcIBsNMs8TUNTUlIlXozimLB4hvtFe+C6BRuxMrJrZji+Ssa+VYJoJ:SsFRBlswg+NV4hvt0i4Mrh9ithgGy
TLSH
T199C219F258D7487AD9AE9743E77E2D034EBCC063B5896A50B3C85A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 03e3c021ae7433994a8f65e98ce523f50075a88d0145e048903e5618082abd21
MD5 d6d618c7ffbd9564110fab9c625ffb02
SHA1 35c5894a75e1747abf8b4b438ed3006a42126fdd
SHA512 03c10f23768fde84e084c3133ce8b568be725e494f5079f64256523cf4190b9656b5150ac75eca7011841b3f2c11dc86d29e323ba7a8da359264e37510ba04c7
SSDEEP 384:yzZcIWgsNdkOozim+B7hvtFe+C6BRuxMrJrZRi+Ssa+VYJoJ:yrhKGNa7hvt0i4MrhXithgGy
TLSH
T17B827C3268685DBA59E7A241F94736139EFC8067A6CD2E90C5DCAF1D01DF69C2306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e397f70772f4e58d65e71dd9a665f8af1c355138f62f8e718aa832299b3f125f
MD5 198a7fe6bdb8e5badfbb318d933cc2ba
SHA1 8cfdeb739d57cf2498d54e9b018f74364a3c872a
SHA512 f528d4c26a1af8801365d3be5982335d98e16573353bca2d89d6fafe99a69d6aa67c230ce9fb064bcb95b35289cc9aacebc856b239bf47587342330df3f15ce7
SSDEEP 384:SliFIZcI8sNMs8TUNTUlIlXozimhB4hvtFe+C6BRuxMrJrZfi+Ssa+VYJoJ:SsF28lswg+NL4hvt0i4MrhhithgGy
TLSH
T1CCC229F258D7487AD9AE9743E77E2D034EBCC063B5896A50B3C85A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0477261b3e5b6268a0d98880f8d293bd472d3d98124e9496df2d429d0da276c1
MD5 11f155e656287e5f6fca4900df7def57
SHA1 f41d671be5f8c1adad1e2109d32e3c3c2a37eada
SHA512 5860a07789400a3381878bf6eca30c4cff9b7dcb2effd83a2de9bdafb121ee9a3e3365c796fa598f04e043ec3289423fe1ff8a0ab0461fd7baedcbdbc8a1d7e8
SSDEEP 384:SliFDZcImsNMs8TUNTUlIlXozimziB4hvtFe+C6BRuxMrJrZKi+Ssa+VYJoJ:SsFbmlswg+Nze4hvt0i4Mrh0ithgGy
TLSH
T185C219F258D7487AD9AE9743E77E2D034EBCC063B5896A50B3C85A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37659ebeaef72d32eef9026b567d9fe9cf6b0f966fdc2ae8ce4594d4af85c83a
MD5 5a2b5c1160d28fad9ccd77c27cfad7e0
SHA1 df78fee7e8cc0bafbd7c9923242ebb55e65b1075
SHA512 543138236d30c45a87b75256ad225d61d3141bf92219b72cfee423db1ce1d32ae807fef2a54b261d6ee2bbd45c3967b4f58f89fd6e5c860539581220c2eec304
SSDEEP 192:JONx6v+YLNQmiUyr0r5Zh+CG66BMAuxYusiMlU6:JONx6vz/KE5Zh+C6BRuxuiQU6
TLSH
T1F802E939B8682C7B9FE2AE05F58737275FE81177F6962F80D9E81E1D00D764C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 717479ccf18434cd883fdb4355395a843ff0524d8f4fdb76c840bbb95e5d54b5
MD5 98c840acf34495e25ba315b20da63c77
SHA1 67de27834bdf3567d1e47d75f5dcaff114c29e07
SHA512 3f24a09e31f4a55400bdc2b70c9de0a0244b8e79ce161537e377e7df9e8d357a15fbd98915bd9a6f4ac825dcc6c390db7d82b79de26f4f27fd193dcde6e0a9d6
SSDEEP 192:t5ONRx6v+YLTSQmiUyrJXr5t3h+CG66BMAuxMcSJrZQQCHi+hqYoU6:t5ONRx6vz3OK55t3h+C6BRuxMrJrZkiz
TLSH
T1AA121A36A8685C7B5EE3A544F48735136EF95137EA8A3F80D5DC2E1D02EF69C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00bc059f-acce-4411-84b9-47df29999f61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00bc059f-acce-4411-84b9-47df29999f61.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a8e51989ba6f31e51e7060e89fcb126d189843d9d227b76abbe9fd1b5268089
MD5 a5dd20696bb8cb0a7915d9ec1488e3db
SHA1 6ec89112cb60891cd854f2a40e2f8106bf0d45aa
SHA512 f91cfca07093353578e9d15b2ac81810efc6df9e03aee3a36e64297f83c9b63efb9ab491672d41f950f25038729f67e63b813505533461a3eda899bb1fb69616
TLSH
T1C2412A49ABFA1118B3777F46AFF6A86D487ABD372E0AD05D10110E4E0663B40CC62B37
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 607e8dc07b7c6aa2609a283ad7d950c66c4e2c738e94a88ecfa06adc0f983cb1
MD5 ba60686e48dabad280e8919f560d9d73
SHA1 b162229840931ccb63fd3b5280a1ecbe8bbbbbc4
SHA512 060e196167425deed374e0fbd1d04574d558692301244953043fcbc6cc4dd4137425403344b00ea1418751adcacac0772a6046274f1fdbf4bd1f2f8b35154c96
SSDEEP 192:ZC/PyRTmgfl9HyPSQSmST9H1WmV0qp8FILD1spjQyRjCr5FwuGOS4Ei:4Jgfl96klH1WmMCQQydCFFXTEi
TLSH
T17F439296B448D606EE0D2C769FEAD6EC6331BD16CE2B061339C2B77F4ABB0C04E55185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonscriptsnetinstaller.exe

Path C:\Users\Admin\Downloads\pythonscriptsnetinstaller.exe
Size 167KB
SHA256 7955a31b100efe5c7c6f67e4ed819e14295de1dc3fbda79a404ed318840cea54
MD5 00bc7020757b2cee6636f1d9acb16055
SHA1 4f965bc2d9dec43482fcbc9dc28619dd2d809e9e
SHA512 0271a1687c8dbd13cdaafcf4880aa1f7686301eaf0077f7f680cbff7787c023ecf21562f9b7cdd8b379459b90d3b3ad3d2575540840ac2d748f96f38dbfc03ba
SSDEEP 3072:8YrClLswbDkrcN450gt2hxJ0ybjrYEOnEjbWicBGIgPjzgw0XIu0I/2jAj:87eK3gt4bjrkJiUgPH/ubXj
TLSH
T1DFF302037B72E4B7CA320A700D7B7AB6DF95CAAC06A5E24747446E26BC735420E0F6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download