hxxps://cdn[.]discordapp[.]com/attachments/1547648614355042426/1547649071785967692/fuckvgc2[.]exe?ex=6aa43004&is=6aa2de84&hm=c98ce443449c2afb41c04daa751e1d5f310d37110bda06c28275e97f0afac5c1& | Triage™

Resubmissions

10/09/2026, 16:55

260910-vfjq5asfmf8

10/09/2026, 16:52

260910-vdgtrasfla8

Analysis

user interaction
yes
max time kernel
73s
max time network
75s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1547648614355042426/1547649071785967692/fuckvgc2.exe?ex=6aa43004&is=6aa2de84&hm=c98ce443449c2afb41c04daa751e1d5f310d37110bda06c28275e97f0afac5c1&
Sample260910-vdgtrasfla

Score

8^/10

discovery execution persistence pyinstaller ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	4512	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
3720	fuckvgc2.exe
5716	fuckvgc2.exe
4364	fuckvgc2.exe
5388	fuckvgc2.exe

Loads dropped DLL 16 IoCs

pid	Process
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

pid	Process
5700	tasklist.exe
3324	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000006977-76.dat	pyinstaller

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4652	cmd.exe
2188	cmd.exe
1744	cmd.exe
4620	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
4512	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335327489733437"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{3AB1A0B0-42EC-4D7E-A423-5D02BF090162}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5716	fuckvgc2.exe
5716	fuckvgc2.exe
5388	fuckvgc2.exe
5388	fuckvgc2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5700	tasklist.exe
Token: SeDebugPrivilege	3324	tasklist.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2996	1312	msedge.exe	88
PID 1312 wrote to memory of 4512	1312	msedge.exe	90
PID 1312 wrote to memory of 3576	1312	msedge.exe	91
PID 1312 wrote to memory of 3576	1312	msedge.exe	91
PID 1312 wrote to memory of 5024	1312	msedge.exe	92
PID 1312 wrote to memory of 5024	1312	msedge.exe	92
PID 1312 wrote to memory of 5024	1312	msedge.exe	92
PID 1312 wrote to memory of 4988	1312	msedge.exe	93
PID 1312 wrote to memory of 4988	1312	msedge.exe	93
PID 1312 wrote to memory of 4988	1312	msedge.exe	93
PID 1312 wrote to memory of 2044	1312	msedge.exe	94
PID 1312 wrote to memory of 2044	1312	msedge.exe	94
PID 1312 wrote to memory of 2044	1312	msedge.exe	94
PID 1312 wrote to memory of 4712	1312	msedge.exe	95
PID 1312 wrote to memory of 4712	1312	msedge.exe	95
PID 1312 wrote to memory of 4712	1312	msedge.exe	95
PID 1312 wrote to memory of 5900	1312	msedge.exe	96
PID 1312 wrote to memory of 5900	1312	msedge.exe	96
PID 1312 wrote to memory of 5900	1312	msedge.exe	96
PID 1312 wrote to memory of 3112	1312	msedge.exe	98
PID 1312 wrote to memory of 1564	1312	msedge.exe	99
PID 1312 wrote to memory of 3112	1312	msedge.exe	98
PID 1312 wrote to memory of 1564	1312	msedge.exe	99
PID 1312 wrote to memory of 1376	1312	msedge.exe	100
PID 1312 wrote to memory of 1376	1312	msedge.exe	100
PID 1312 wrote to memory of 2804	1312	msedge.exe	101
PID 1312 wrote to memory of 2804	1312	msedge.exe	101
PID 1312 wrote to memory of 2804	1312	msedge.exe	101
PID 1312 wrote to memory of 1648	1312	msedge.exe	103
PID 1312 wrote to memory of 2716	1312	msedge.exe	104
PID 1312 wrote to memory of 2716	1312	msedge.exe	104
PID 1312 wrote to memory of 1436	1312	msedge.exe	106
PID 1312 wrote to memory of 4848	1312	msedge.exe	112
PID 1312 wrote to memory of 2188	1312	msedge.exe	119
PID 1312 wrote to memory of 3696	1312	msedge.exe	114
PID 3720 wrote to memory of 5716	3720	fuckvgc2.exe	117
PID 5716 wrote to memory of 4652	5716	fuckvgc2.exe	118
PID 5716 wrote to memory of 2188	5716	fuckvgc2.exe	119
PID 5716 wrote to memory of 5700	5716	fuckvgc2.exe	120
PID 4364 wrote to memory of 5388	4364	fuckvgc2.exe	124
PID 5388 wrote to memory of 1744	5388	fuckvgc2.exe	125
PID 1312 wrote to memory of 5244	1312	msedge.exe	126
PID 1312 wrote to memory of 5244	1312	msedge.exe	126
PID 5388 wrote to memory of 4620	5388	fuckvgc2.exe	128
PID 5388 wrote to memory of 3324	5388	fuckvgc2.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1547648614355042426/1547649071785967692/fuckvgc2.exe?ex=6aa43004&is=6aa2de84&hm=c98ce443449c2afb41c04daa751e1d5f310d37110bda06c28275e97f0afac5c1&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff897e4c188,0x7ff897e4c194,0x7ff897e4c1a0
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,5988471505626829614,2966948710735425926,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,2478611639616777134,10325495356006501996,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,3356946803731336017,8085203221256864461,262144 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,14181998199852590791,14225654327755904134,2097152 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,8279472112192035179,14680853893191705254,2097152 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,3115473635855349786,11431777839379655426,2097152 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3438439669705090779,13531450790723365689,2097152 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,3189659242468255451,4561621813895380458,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3905583148902283122,6731869156786283169,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12289471062541884104,13346082815512227439,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5764,i,15725960613073568741,17850344756099971637,2097152 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,9627132412358152478,12284738582918138471,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,13880095292177261843,12427980215245220182,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,13761742432352118957,5039354881919599977,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,13761742432352118957,5039354881919599977,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,1099723174804740309,8988953096383892231,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,9192772165728474465,6536429068569358383,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,8586462403429825064,7916022843651115382,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,14050883765321991832,1884135419906634606,524288 --field-trial-handle=2360,i,10479436519381666455,5270618514939631456,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:14
  2⤵
  PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2512

C:\Users\Admin\Downloads\fuckvgc2.exe
"C:\Users\Admin\Downloads\fuckvgc2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\Downloads\fuckvgc2.exe
  "C:\Users\Admin\Downloads\fuckvgc2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2188
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5700

C:\Users\Admin\Downloads\fuckvgc2.exe
"C:\Users\Admin\Downloads\fuckvgc2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\Downloads\fuckvgc2.exe
  "C:\Users\Admin\Downloads\fuckvgc2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4620
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d1e564a3ef626bd2dee4cdaa2742eec17bc82b8e556461adabdaf8cdd7c249e0
MD5 eb3ceb58a6c5d5eeb826895a49df32a0
SHA1 323b503c6bb901e1492541b653794bb250c140cd
SHA512 422cb1734e26b78e62c3d75b37bf7815e29c3bd444f1f35436c830c459e8840d4f5263a336c09e3022bcc4723f50be06719dcb969649d19671d78916fd559432
TLSH
T1E751B5B133263EF2DBFA497132E1225832FDC40902BB1E24B0906D345C2AF99E9D1063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596383.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596383.TMP
Size 2KB
SHA256 2a9ba4588fc5aba5a45ab7d45bea03e065451b4d42ef61b1a10f3f787d31cb13
MD5 b8d84982acdbe7c35a37393f6bdede55
SHA1 ce7f8aad37033acec8d8b785402cbcb15196cbcd
SHA512 c420ad3f43228b1e6f91315c97874bdf48f884394aa8ce84a9166e5f5d6e26284f12de1849a794ac689ecb103692e008c489d9adf0dcebcf569501b5731e25fc
TLSH
T1C85195B133263EF2DBFA497132E1625832FDC44901BB1E25B0906D345C6AF99EDD5063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58eecd07-3b2b-41c1-9f27-d2dcde0baee4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58eecd07-3b2b-41c1-9f27-d2dcde0baee4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d67e239a0c9f1d326083cc38531194531815564d070d75d2a777769b75ed0792
MD5 e76a1d0ae6f887f5027db04437fa7346
SHA1 16272798a5fb014ee8248ef67ff56ef0577c1d63
SHA512 9c0032e9b5e733e4f9b64046e29b7647be4652978df2f4aa155d49ebca198510a1a05bc54c4f8e35c9d90cfc28ecde6d976f6dea6eba982d901ed915285e4965
TLSH
T17D41AFF387B4857E8A1186F0AA146E1FCE2D0515436C7C6A85D0AE2B93E3472E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 228c192d2908d52672717c96ec21f3da88d9c4b85d5813f37b1fecf97dc61fef
MD5 7c03a3ea253372e9b6a235a8dd434d71
SHA1 5b2f9f079ec54d1d94db33ed4a5a8f4bacc555b2
SHA512 5ee7e3f66ad91d3462a92a636e632561b1c6822d36257e19f3bd7191c36a20782eeaf1495642ce8a73aacae639e3f419382f2c8b2f9df46babd3559f6c3474e4
SSDEEP 192:sxRJR1O//fVsGDde5lSuzoD8pi/g6+WNIYCnRuO8+GYIgIJ:sxRJm//fVsGc5lfi/5Ih8ys
TLSH
T11532A8166E28A93B8CC7E21DFB55BF93D6F95032A1D41E58E6FC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9013b1a426be5b084831cf5a725ec417c75355e9fc72b24c508684923ccfa559
MD5 ae4e2b6d5b470e034b22f6c145882639
SHA1 87fc1c60991af984a68da0a841263dad207bb95c
SHA512 429b62c58e7a496110c0d89b2bb0cd1f1712a87fa8b28a15f960174c7ae56904c926160c18597f0cc7bab56229d915876acc4486697450ae660f4ba454bd3141
SSDEEP 192:sxRWR1O//fVsfDde5lSuzoD8pi/g6+WNIYCncuO8+GYIgDFJ:sxRWm//fVsfc5lfi/5Ia8yb
TLSH
T1CA32B816AE28A93B8CCBD20DFB65BF93D6F9503261D41E58E7FC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 49980b2dd56f843cefe2300d140448a80fcd871034f215ce3fb40e9f477fd5b3
MD5 6c9e0763f980dfcf6e1bd96b4299e7c3
SHA1 59177c4589d6d4baef1cd22963f3358ef4e6c6a5
SHA512 e2a3f422fa77e8c7153e2f9910d9b20a0e201e5d6a4b5b83f47cc12587d9b11e2320906c10f3b6360b8a742e7990d4cf3a020ad21851d9af03c8867e247c36c2
SSDEEP 192:sxRWR1O//fVsaDde5lSuzoD8pi/g6+WNIYCzsuO8+GYIgDLJ:sxRWm//fVsac5lfi/5Im8yJ
TLSH
T1F642B716AA28A93B8CCBE20DFB557F93D7F9503261D41E58A7FC861C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1d890b531e85cd237dc472d6ac5a373993101c075b904ca9e93e6a549ea419ea
MD5 16162d6a28ec876360da8bd31d1aaa3a
SHA1 c7f1077b275183fffa3bf02aba7a89555a97b76c
SHA512 2210e447ecf54b0aa36e3c2a4668b8e9435dfa4b6bbd2a0809ef3866ddfa7bfab97b4d419c6acc56016d88b913b0ea1b75a265ea2dc8cf3681989c0aa862d3f2
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRviroZSH:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VH
TLSH
T168B2EA2B600DCB7F4F800AADAC597FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cee0669a-0a11-42d2-9797-f51d523465a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cee0669a-0a11-42d2-9797-f51d523465a4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ec37dafd3ac259312efac56186b31e94036b09add76fe4d7d19f2a8be9572d11
MD5 284d94cb3bb7c8098694b19e2c7ddc90
SHA1 219e37fcad4bc719002036bd42c5ff479d765f02
SHA512 9a45a056dd876dbd0182db2848b0d9d57b8e7d9d13c8420a3f7bf149bc6dcbed8874e46e4b8b1e9550e14865127ae08d0ef8ccd1a778129c14e23b37ebd647ad
SSDEEP 768:wrv+4UNbdD349jFCtQWNp8+p3bd66j+4BRv86aLITo2bwCl1:wbsbp3xL8+p3Z6n4yR0ww
TLSH
T14703BE73E86C99339DF2C684B18A76437FF8919396C10AD4E9DD2B4E015A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 013c27495f8ff516c2d12a049f3d9d7a7eefd371c59da844792555d13d59c299
MD5 0096e38596e7a89e334e73431f78b753
SHA1 7f5b83d0277d9ce0fed73837d7a99eb392b59ba3
SHA512 15bd0812b35ec74ba2d46a7fcf2f7aba48fee2777ee01ac50a903aa5560a4ba806a3a11268a73ac51668531bf62ae2a1e1326eee62fa60723de8155ead3e7e32
SSDEEP 768:9FZ93DwgqzBJFCtQOp8+p3bd66j+4BRv86aLIWoD184p+YD:N93j8+p3Z6n4y6WrYD
TLSH
T141F29EB39898DD779CF6C784F64A3243AEF5806395C85A94DADDAB0D015729D030AC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8babb4b61c5a41b23bc23c8f1b31085a9f33fdabbc8379cca04671d86688a821
MD5 dfa2cbab8ebf08d5434304dd5dd41d1b
SHA1 e1f23f5c5f37d54829149abf69ee4d45c3306cb3
SHA512 9752cee6ff3536857b108030b3eb24526218d951e2ce72ce90de28e37e7f3003791f51e3bd9478ee078b4db4d0210cd1c5bb85219f815469d5c802904193c592
SSDEEP 768:Gj3JzBJFCtQWsp8+p3bd66j+4BRv86aLIWoD184p+YD:Gj3oK8+p3Z6n4y6WrYD
TLSH
T1C7F2AFB2E8A99D739CF6D284B1463343AFF4905396C81ED4D9DD6B0E01472AE070EC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 20e094ee129760d1e64881852ce04af1bfb7d4f93ac315976cb275f6d75b68bf
MD5 0b11a39baa8ce3224e330de418937ed3
SHA1 58b7450b3189aa987ba79e25b5b4e3ce9f1025ca
SHA512 2b5746840c79fcf0fc450f9c4223f62b410d08d234f27128c6ab2e6c8c52845bc7bcc7ec52e885513e80d2e634ff3513c8106d0fca671332cc5ea39ef5972929
SSDEEP 768:523JnBJFCtQWsp8+p3bd66j+4BRv86aLIWoD184p+YD:523AK8+p3Z6n4y6WrYD
TLSH
T158F2BFB2E8699D739CF6D284B5463743AFF4906396C81ED4D9DD6B0E01472AE070EC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 69e9f6829d371e3ce99cde2e4d2281647a4aed00b27f1c566072a86882f0524f
MD5 2bfc21dd46f5d4cf67e3384cf5ca021c
SHA1 addbed6faaedd2d563f12d5053bb8e51f50a5a9c
SHA512 7c08b3175fa90fc360973f4f5ba1d72a1c59a1d4662bc907b08f96b155b3172d4c8a7994077b571030ba2e1a042db888173b7ed9edc6aba9e67b96a7e5e04d33
SSDEEP 768:Irv+4UNbdD3lcFCtkNp8+p3bd66j+4BRv86aLIiK2bwCl1:Ibsbp30L8+p3Z6n4y00ww
TLSH
T11003BE73F96899339CF6C648B2467A837FF851A396C10AC4D5DD2B4E015A29E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2dd33bdd86fe7279111fb19ddd90572677fa3444c3c40996e487a256ae36cfb3
MD5 f5a0d7d8b54289d74462665ded159223
SHA1 dce99cf35f1682b1629260d8e5ceceaee9bc81c9
SHA512 80f67cd05c5a0905ef6dfd031cea511d07cdc8138ac4d0b368708560e8348d2fb0d4942e5e11d0e69da01bd23b5abacc008d96770cc467d10b36866b019806a0
SSDEEP 768:dj3OzBJFCtQWsp8+p3bd66j+4BRv86aLIWoD184p+YD:dj3fK8+p3Z6n4y6WrYD
TLSH
T108F2AFB2E8A99D739CF6D284B5463343AFF4905396C81E94D9DD6F0E01472AE170EC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9920051-079f-4273-9149-90d0ba194841.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d9920051-079f-4273-9149-90d0ba194841.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_bz2.pyd
Size 82KB
SHA256 1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b
MD5 37eace4b806b32f829de08db3803b707
SHA1 8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9
SHA512 1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d
SSDEEP 1536:xqgz7lGeu595+NHRGYWlnswz108Lh3uwtIbCVW7Syqx7T:AgzxAbl3nLhJtIbCVW8T
TLSH
T135839DA3A76166B5F4AB82B999C14363E330FD45075083DFE384835A2F12F917D743AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_ctypes.pyd
Size 121KB
SHA256 3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac
MD5 a25cdcf630c024047a47a53728dc87cd
SHA1 8555ae488e0226a272fd7db9f9bdbb7853e61a21
SHA512 f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af
SSDEEP 3072:bZMeF788mzTWJMNufLI2qV6phIzRIbLPMV:bmeGWWNufLI2ichyZ
TLSH
T141C34A5B23541099EAA780BCC5B35F07C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_decimal.pyd
Size 247KB
SHA256 23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c
MD5 e4e032221aca4033f9d730f19dc3b21a
SHA1 584a3b4bc26a323ce268a64aad90c746731f9a48
SHA512 4a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c
SSDEEP 6144:F4aNJPKHCXqKEyKOxVpclJeMvfrZNxKl9qWM53pLW1A+6teJCxc:O2JyHCXqKIMpgeMnr5K4lRxc
TLSH
T1C8445A56A2490CA4DE778074989B4B47FBB278840350D3CF43A4CAA76F577A327BE784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_hashlib.pyd
Size 63KB
SHA256 2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd
MD5 ba682dfcdd600a4bb43a51a0d696a64c
SHA1 df85ad909e9641f8fcaa0f8f5622c88d904e9e20
SHA512 79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636
SSDEEP 1536:0WuY1lTorKnYzF9G0pLOjWNBgFIbOIp7Sy0Vxu:tuYc9GIOjiBgFIbOIpqC
TLSH
T1CA537C46A28144A4D96781B9C9A34E57FAF2F1001720ABDF4368C18D2F237D397F6766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_lzma.pyd
Size 155KB
SHA256 663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948
MD5 3273720ddf2c5b75b072a1fb13476751
SHA1 5fe0a4f98e471eb801a57b8c987f0feb1781ca8b
SHA512 919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e
SSDEEP 3072:OJlBQV6AniiMeSznf09mNogMKNA/ZttIbZ1bW/9:OJlozifF8YOgbihtL
TLSH
T1C7F34B92A394F4D5F7628C78D6624F53E7F678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_queue.pyd
Size 31KB
SHA256 ac3b144d7d7c8ee39f29d8749c5a35c4314b5365198821605c883fd11807e766
MD5 284fbc1b32f0282fc968045b922a4ee2
SHA1 7ccea7a48084f2c8463ba30ddae8af771538ae82
SHA512 baa75f7553cf595ad78c84cbb0f2a50917c93596ece1ff6221e64272adc6facdd8376e00918c6c3246451211d9dfc66442d31759bd52c26985c7f133cf011065
SSDEEP 768:c+yFY6rbXmxU1RIbQU+5YiSyvzZAMxkEC:c+wJbXWU1RIbQU07SyLBxu
TLSH
T137E29E83AA546C96D533C87194E25E39F875BB52570083EF2218C25D1F333837BBA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_socket.pyd
Size 77KB
SHA256 8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76
MD5 485d998a2de412206f04fa028fe6ba90
SHA1 286e29d4f91a46171ba1e3c8229e6de94b499f1d
SHA512 68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f
SSDEEP 1536:sEbflgPFXTcf3uj79/s+S+pzpp+iTFVf7JRIbLw87Sy8Ckxt:smG1U3uj79/sT+pzH+YFVTJRIbLw8eCg
TLSH
T13B736B11A29050A9E273C07AC5635E27FB70F4C117D4A7CF5264CA6E5F23782EE7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_sqlite3.pyd
Size 117KB
SHA256 d077e236b709b5242d62ce4923feddbfcc719ec26612ed474ed3b25ee290d0ac
MD5 8c9f7beeeeb75816cc0c1f8474023029
SHA1 96a49c164bdfce7a0d90d87074e0c9b5f8077610
SHA512 aba229c8b843c07ea8d59ac901d06263a3eefe6824e71c4b4beb47d5071be34068f13ce13a962b0a8583c834c3dc4d045185c47fb8b2922e853fdb78bf4f6f77
SSDEEP 3072:w2nLU/Nk3qkD0ii3CLl147ZvV9NdrRvdO5ylAuCoVMJtcMYqsJFIbOQ5e:XLU/NgqkVD5ZJtOP
TLSH
T18CC34B6B631810AAE8B741BCC4630A06EB75F461437053DF92A0C6891F777C36F7AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\_ssl.pyd
Size 172KB
SHA256 591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b
MD5 e5b1a076e9828985ea8ea07d22c6abd0
SHA1 2a2827938a490cd847ea4e67e945deb4eef8cbb1
SHA512 0afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f
SSDEEP 3072:UZIQQj5DC1z/39/2uX36XjRylB9d43Olh59YL48PMrN/WgAlNiVtIbC7N7d:rj5mRPxb36Xj44TLiVn
TLSH
T1D8047B47B1446DB7E813E4BAC2334912DBB5F055231147CE49D6DA4A0F07B06AEBABB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\base_library.zip
Size 1.4MB
SHA256 0e50397b57d9bb12f06ad6ee84e1441d92a676aeb50128e6d888ef186d1d0ffb
MD5 ef98fb21b899d5adea27ccaba543326b
SHA1 0f1d25c745ba626cfbebd1c80a611719f98cb387
SHA512 512717c371e241b3c481d2db3b96a9ffc8a575f2654704bc99a75560285616844df7108c6d9691a0cfed1594fb29ff29f3938d24efdec26ca7f57c169cf27fc4
SSDEEP 24576:7TGRK3cnz/bucEvUFiyafPpdmzFQR5pK/RIHH5V0iwhx:mQR5pK/ReNg
TLSH
T1CD6509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\python311.dll
Size 5.5MB
SHA256 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1
MD5 d06da79bfd21bb355dc3e20e17d3776c
SHA1 610712e77f80d2507ffe85129bfeb1ff72fa38bf
SHA512 e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a
SSDEEP 49152:7KUvq5S8qfFIbGoSieBCZjze3eWVWhQNkGDiUWmtAoaOvi26g2je7wkUB3AO1Fp6:7KUvq1quUqjTPGzuvihAs2oH9M8I9URf
TLSH
T164467C2672609461C87B8472EA2F924BD7B67C501F20CB0B51A4B7AA2F73B531EDF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\select.pyd
Size 29KB
SHA256 fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c
MD5 e07ae2f7f28305b81adfd256716ae8c6
SHA1 9222cd34c14a116e7b9b70a82f72fc523ef2b2f6
SHA512 acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4
SSDEEP 768:jeUeWEHqTG+RIbQGC5YiSyvkki+AMxkEGu:jeUeWEKTG+RIbQGg7Sy/rxyu
TLSH
T125D29FA76F545885D823C5B2A8E34E16EA35B6558B10C2CF3368C16D4F323C27BB73A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\sqlite3.dll
Size 1.4MB
SHA256 ff950af2dad140377a55da6f3c242327ced0cf498db50e028abe1ed023f19b90
MD5 346f6150977371cdc424ec9275a9b47c
SHA1 986096738808eb6ed364c4ac5b3500b5b35bec10
SHA512 03cb04e356a8a2d9b871d3365cab01da4220df7687be38572ae37fa833b924f8c7c5a4606b33ad717d50e5d3d8929f885f38ef5ad582a579c4ee7093f302ee9f
SSDEEP 24576:zTqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFJ++E:Sk0jwv4tP5kf8ar/74EF2/An4acrVUcl
TLSH
T123658C4BF2B800ADC1A7D1BAC61B5707EBB2B405177097DB5594CA692F13FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e882\unicodedata.pyd
Size 1.1MB
SHA256 f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20
MD5 5cc36a5de45a2c16035ade016b4348eb
SHA1 35b159110e284b83b7065d2cff0b5ef4ccfa7bf1
SHA512 9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1
SSDEEP 12288:iYPYbfjwR6nb8onRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDq97:iaYbM90IDJcjEwPgPOG6Xyd46q97
TLSH
T1DD355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fuckvgc2.exe.crdownload

Path C:\Users\Admin\Downloads\fuckvgc2.exe.crdownload
Size 9.3MB
SHA256 ed3244b46298262c1dc0f1703f235d72de9e6b9dce04706ca87d54c2b152834a
MD5 6ac72b6b2828f036c4aac4586c5113a1
SHA1 d6274c84f1e689dcaf4f2fe750eed801e09cd8b8
SHA512 28c2e24081944d606dffc1f19ed669ee097fea83c7973ce4fd60b5e86ce6d07bd2db9cce190c728ddb5b20d6b64a3de15c0260afa5172f76395d35c78b247f2d
SSDEEP 196608:asUZvf2A1HeT39IigwWc0/aaTbBOWqVF+SCwmBq:zUZvfv1+TtIiFm/nc8S+B
TLSH
T1F3A62332AE9524ACD0D591789AAEDEAF75322FC11753D0CB0B503E661F3369388E7B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download