24c871f2e8501ae697ba567adc9cc89329806d3cb1e46fe8db7c83a2a304c6ba

Resubmissions

29/09/2026, 13:04

260929-qa9cdahc737

29/09/2026, 12:55

260929-p5z7hsst8l7

Analysis

max time kernel
88s
max time network
89s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/09/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RetroBarInstaller.exe
Size 7.3MB
Sample260929-qa9cdahc73
SHA256 24c871f2e8501ae697ba567adc9cc89329806d3cb1e46fe8db7c83a2a304c6ba
MD5 18935ce0ae1eaf7e9c7b574a63982a40
SHA1 5e1a74ce4fd61a7ad4c9aac321fe9d9c66f8392b
SHA512 9ca87ed45886f43c39fff4dd8e7732b669b5722d68d0a04e7b1bb7737ddd7449634ff0328d6baec545bb1bbf844a184f1124d6b8ec6f3c2a1cfccd6976115bea
SSDEEP 196608:ODbxhnHvhnQ0OZJxs5MVM1LDk00KI4/x54Pu:ODfHvTOZJxCsM1v2Gx54G
TLSH
T196762327B64E633EE47A4A3649779A14543FBA60641F8CA7C6F40E4CCE290601E7FE47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5096	RetroBarInstaller.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RetroBarInstaller.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RetroBarInstaller.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetroBarInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetroBarInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/3828-0-0x0000000000710000-0x00000000007E9000-memory.dmp	innosetup
behavioral3/memory/3828-10-0x0000000000710000-0x00000000007E9000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584227348-426884507-1572084426-1000\{6AA48583-58E7-41A3-A5EC-4BDEF4D8DAD2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5312	msedge.exe
5312	msedge.exe
5312	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5312	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 5096	3828	RetroBarInstaller.exe	82
PID 5096 wrote to memory of 5312	5096	RetroBarInstaller.tmp	90
PID 5312 wrote to memory of 4280	5312	msedge.exe	91
PID 5312 wrote to memory of 3052	5312	msedge.exe	92
PID 5312 wrote to memory of 4300	5312	msedge.exe	93
PID 5312 wrote to memory of 4300	5312	msedge.exe	93
PID 5312 wrote to memory of 4300	5312	msedge.exe	93
PID 5312 wrote to memory of 5220	5312	msedge.exe	94
PID 5312 wrote to memory of 5220	5312	msedge.exe	94
PID 5312 wrote to memory of 5984	5312	msedge.exe	96
PID 5312 wrote to memory of 5984	5312	msedge.exe	96
PID 5312 wrote to memory of 5984	5312	msedge.exe	96
PID 5312 wrote to memory of 4912	5312	msedge.exe	97
PID 5312 wrote to memory of 4912	5312	msedge.exe	97
PID 5312 wrote to memory of 4912	5312	msedge.exe	97
PID 5312 wrote to memory of 5772	5312	msedge.exe	100
PID 5312 wrote to memory of 5772	5312	msedge.exe	100
PID 5312 wrote to memory of 548	5312	msedge.exe	101
PID 5312 wrote to memory of 548	5312	msedge.exe	101
PID 5312 wrote to memory of 5372	5312	msedge.exe	103
PID 5312 wrote to memory of 3724	5312	msedge.exe	107
PID 5312 wrote to memory of 5896	5312	msedge.exe	108
PID 5312 wrote to memory of 2900	5312	msedge.exe	109
PID 5312 wrote to memory of 1452	5312	msedge.exe	110
PID 5312 wrote to memory of 1452	5312	msedge.exe	110
PID 5312 wrote to memory of 828	5312	msedge.exe	112
PID 5312 wrote to memory of 828	5312	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\RetroBarInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RetroBarInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\is-4NQ5K.tmp\RetroBarInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4NQ5K.tmp\RetroBarInstaller.tmp" /SL5="$70170,6534365,827392,C:\Users\Admin\AppData\Local\Temp\RetroBarInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/dremin/RetroBar/releases
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffaaef3c188,0x7ffaaef3c194,0x7ffaaef3c1a0
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,5636657419372721110,10303982902359209112,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      System Time Discovery
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,5249850086621032084,13934184233053337641,262144 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,2300689243226856267,14447606474099033172,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,15507365272882701099,3746167551561544590,2097152 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,3753257633367415392,158637644996450450,2097152 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16301490587218612431,3720532527839368579,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,7761245921023855170,593420160179102330,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9365701174802126199,11681124859118248123,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9365701174802126199,11681124859118248123,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,12340555143013256318,7650248885266369355,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,6606269966820563223,14925085527428684270,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12901942581565725016,7122611191737177570,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3777818646430443545,9470320658475299974,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,7538677271407991444,17902709923097024986,524288 --field-trial-handle=2260,i,10882601772404631374,493677922456952878,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b93d445877ce247432e151dbbfc8e224be7ca98c35c9737a3918d2cf5d1c6eaa
MD5 007e73abff7225f1a9336fb12f869942
SHA1 1f751c146870b83e4301efd18d3a47da6734bd64
SHA512 9abb1c774e6a064108332f8933a511fb1f60f2417bee0fd75633b1f32945c3c23d9448b5c47cf389e7b0c3b65a19866a23ac59bcf46f239f87ddce061f657b28
TLSH
T1A7D02B248E4C45D0D05218350C65428931AC9810B84E001494D301B60CCB2B244A0070
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98408bb8026fb16bc1e6d6fa002061ab6c45c5ca808aaaaef9139be0eefefc37
MD5 fd3ba47c8aa46eaeece09d419e5a194b
SHA1 d56e5f8e571faa0c003ac93bed53041842788761
SHA512 2b2a8e11d2151f8cb4676bc1b7bad6ee90a4ad697d9451b559a6d4280ad3906a9671866d4d471627bc9558d1b5152410bbee884e59e8c73a0606e83ac97158e7
TLSH
T1D0D02B288A4C55D0D06218350C254289309C9C10B84E0014949301B60C8B2B240A0070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0aed386f9df8a9a4431e603473fd2decb3dbda8a4c0d82712ac55456084570df
MD5 cdcb88847a9cb1a3da93e97f5b9983e2
SHA1 cd88fad22a1c5c8f45e8338f163d5dc88939f6bc
SHA512 9f102720efefaa665b5828071ade95d9493eb399683c100b5fa264f64b0b58fdf9bc1ffd306b47c2a9816e4b195c14bd70459f7fbedf11941a1915d46da9419b
TLSH
T13AF028B9CE21FC3718FC1B1D60954746EB5123272A81944F3B3C850C8FB2A3B529691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 187a847e625a6454aed110e103735e47e9528c3fc5b9dbc746517ddbe5f8e5c2
MD5 b3c6828b49b8c169ddc719b5fe9dac8e
SHA1 c5babf1a4b5a078e82dcc544113894bd97e164d8
SHA512 77f61fb61ecbdf57abb066c7c455b991a41f632179ff3f6e741441bf5773677a61a86f77e788f8d97f28ee4bcdb116c3438a2fbc5842a590a242616bc9c450f8
SSDEEP 96:/F+JS4A0q1ViMnEl7EDgK+dOfjICHD8lPq4T6cN2nuq6:N+lA/1ViMEl7EDZ2+vwucca
TLSH
T15DF151F01B780C23DBF1103B56D3A957B2F89941D20B1E1D238ADCBCEF66796A19B458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590f58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590f58.TMP
Size 5KB
SHA256 f39c876ba065f88d688607fd800d6feeafca7c73d7c9909a2cfb098ace3311bb
MD5 83e14913f9743db4eca2ca296be0bcc5
SHA1 d706b0197e6789930b806ce0f0706441602c1fdb
SHA512 1d497159a5d0af77cd6fb3468be175d460167928c5ea51a447886473c788592ace6271e8509493448f5e765410db26ef8bcab49f6ff5429e34be7edb437e28f0
SSDEEP 96:UFfRSwENc6nEGCgN+3bmDICVDalg6Zp2nufQ:ifhENc6EGCawo90ZYl
TLSH
T10DC15DF11AB84C63DBD5603756D38AA73678CD82E25F1E5C22D8DCBC0F467D6A29B480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebfb953d-1637-439e-aea2-aeeecabf6ba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ebfb953d-1637-439e-aea2-aeeecabf6ba9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7166c332-44ac-4ef5-b206-016750dda4e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7166c332-44ac-4ef5-b206-016750dda4e8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 920398e7a663c3fbc630e2e5f619298252998603dd7dceced6222d7a235b649d
MD5 ddfddb40d2ec75a25b8589c47c427365
SHA1 03741241ec5ee877782f50aae29a755ccc3f86ce
SHA512 43e8833ec16d223b30cfcf9e1581f6e2597dcd1d8e448cce62d82ebb2918e3e95bf9c09213a274ba6331833664d43ea1c50269b78d1a027118a8b1d2d42a3441
TLSH
T1B131D1F7C3E4866E8A0196F0A618BE2BCE2D0514432C3D5BC5E4AF2B93E34B1D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4128fcceebf7f5cb1a53610524de6985e354a43c18d165b138170ceb5086ac99
MD5 498575573b9baf1cba8f1bb8a0ffacf8
SHA1 30aedc473bd3f96dfc1aeccfb1fa50970af97860
SHA512 55bc5486f96b5aea030ac056b6310b7a258090ef6c4a4bcacd92e299702b020f359790d99091a35f9cd7970eac6467065b5958f53cd9d460e15a3e2557080fa0
TLSH
T17A519DF787F5866D8A0155F0AA18AE1BCE2C0514832D7D6AC8E4AE17D3E3871D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cd673d865d502176a0d274773611a1402168986d3f8a0c6a1fbf3305895f6964
MD5 e33cca4b00930cd20f266ace7c083303
SHA1 a25279247b76f80fd9ba9e85af75ffd6c0632320
SHA512 449bc18fb8f9c2d644fb4880ad5dcb4d0c298684c83cf1f205d31bb442e7ea419776a368d9963d5ed14b72f7b24164064d978e3bb6ff9782bd288831dadad4b6
SSDEEP 192:sxZ6R0jR/f9sHdIfpBzXX1ZkzodpvlqHW6+WNYXL/YS2Sw3CuIg5IuBGHJ:sxZ6qR/f9sHdgpBzlpQHbc/xgWp
TLSH
T1A552E955AD24A87B9CC7E219FA597B53E7F91032A0C01E48EAFC8A1C05E76DD730740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d16419e372df5b5f6027aa77f3d96d4a1f44f58d19ff31835ffba28aaeed3bc4
MD5 07b07a72159793d240e029f762fb2525
SHA1 3811c5ae227cc49cbe1f8474a100f195c596c9bb
SHA512 dcb0b932d544ee3426f70b8b26e365fc25364b1360e0e3eead95153a8fb84e26e8f8c1c5e74e89a948d8f94e283b330bfe2feb1bbbb21c090ebc9cf43f74f25a
SSDEEP 192:sxZ6R0jR/f9s4dIfpBzXX1ZkzodpvlqHW6+WNYXL/YSGSw3CuIgjxJ:sxZ6qR/f9s4dgpBzlpQHbc/hgj7
TLSH
T10152D955AD24A87F9CC7E219FA597B53E7F91032E0C41E48EAFC8A1C11E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e92b4089a4b8d69c97096345173ee014fab519eb26b8c52ac89623ff3eccc9cf
MD5 30e162af559a71ab1c71eeca0cb74de1
SHA1 beb866c89f75e415a029b1a159f283cb0e891a9e
SHA512 edaaa88fae69e6ef64d88c2f710bd316f97ee4d22e00ab5ffd697798f981628ca3604f9f935e049250c5d42d4d33b7d3190e151a0d6b9b64d715fd1db5852cce
SSDEEP 192:sxZ6R0jR/f9s3dIfpBzXX1ZkzodpvlqHW6+WNYXL/YSGSw3CuIg5ISxJ:sxZ6qR/f9s3dgpBzlpQHbc/hgT7
TLSH
T17552E955AD24A87F9CC7E219FA59BB53E7F91032E0C41E48EAFC8A1C01E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 95ecae44f096d52be6fe66f1cd09d3fb54163fafcf58e1c4e382e164b1eb43e7
MD5 445297c6f5d9461b1907b9f58b1bca5a
SHA1 55629d66e2fed4f5bf452aa29952af403abdf81a
SHA512 85de45c93128cfb14a7cfd02e20634d4b02f073e6e51cdede86da9f20ca57c411747a811830585e4fd8b9828733cacfc97ac2c88ab1613f5f8d13990a4929702
SSDEEP 768:sN6MRLY7pLuLbn/WvDppV8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFFLuLlIa7PXroB:sN6MRLEEbn/WvDppVu1ja8FLuLisPEKs
TLSH
T17EE2EB3F780CCA7E4FC00A9DED1A7F9B6DA802DB6698C94047F9945C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 b457d28dbbe96360118ef6de7c8482fc80e903b077c4db65ee11083618be1a49
MD5 a02ecbbd330a4a796b28d589cb9cdb4e
SHA1 dc947434a215f82300cfdb758fd0661527b8564d
SHA512 87a8bbd393b5be13253bc30879c966fe709c366816c5e02e68c3a7e6058e34c0a42659fdf2a3418b0e54d4d4a968f42e7739847fb7a4855f17f466df5a8e5f07
SSDEEP 384:khvZrCdTLGhSv3vYnE5lXVRQJ219f2WT6vH+5Boxqz/p77uHs7X9sWp0hpEn+:khvZrCdTLGhSv3vOjF
TLSH
T154A2165171BB1351383E2D1C81B1976F9A4275A33028E66B7FBD10A68F6BE085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a9c25b270118715a04d16e90fad2262b462c9888625f728c5db3eb31f11c4e4b
MD5 05ad383d8767a5e653ad47b551f65f24
SHA1 5625607b69ec224c0bb812d1f52e669c0d1515fe
SHA512 2578f2fae283ad266b9838e23b2236500009cf284386cb0108d360a894366dc96007998862b267f46888ade2156a7f7c23fcd36a8fed3ccd8b5c8d3a0f7bef0c
SSDEEP 384:n5iFiZcI63sN98TUNTUlImkrWXTTVJsVzWfZBdWkfwPcsa+VYkl/gL/7IzRon:QFQ630wgGVGRaBdachg7k
TLSH
T17CC24932EC54D9ABECEB4FDAAB4A7A03DEE40163919C5AD8D9D85D1D00872DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 90a26d42cd8012ec7398e2322678d41dfc60f5ec77768d5fa1a532693fa55bfb
MD5 6198362820eb5a7642c9d08596c1fcf7
SHA1 00d0c715e3a497339aeab878300267c8b3894e0e
SHA512 5912acf9ba6bd11e27284fc165a5230698186d652d975a271109b0ef38aa2a5edae94bcf35500176658c6cb1a39aeae6cbdada2c5c0eeaa2944133488afd6edb
SSDEEP 384:nLiFiZcIfw3sNB8TUNTUlI4kqWXTq+usVzWfZBdWkfwCVTNtgOIwZOyGscgL/7Ib:mFQY3Ywg9TdRaBdlVTNXstz
TLSH
T161E290F198D789B7E8AE4B87677D6E029EBCC063B4985584B7D40D1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5cea25cdfe70efce61922c80e5f6d579d6cdd990fa77f90b71e349a09dec75dc
MD5 b8c958344734c28bb070092e50a397f1
SHA1 348632757c58eca1d5e84f2e42704613510c35f9
SHA512 f31f6ccef90904fdf5157f2e0d998a9330491ab55ad085b7d230d18d349b983f8901d269f51d2c550f2fb578a05080504be1194057e7d176a8b3bb8571920b76
SSDEEP 384:nTiFiZcI+3sNB8TUNTUlI4kqWXTqDusVzWfZBdWkfwCsNtgOIwZOyGscgL/7Izzz:+FQ+3Ywg9ydRaBdlsNXstz
TLSH
T1A5C23932DC64DAFBECEB5E89A74A7603DEE40163C59C9AD8D9D91D1C00971DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b38c44d896f226097bf5c874312094a56e11d862f89596e1314b6bfe5eb79458
MD5 34f83c35bceca2e1d3fdedb5dab1c3d1
SHA1 7fd43bcdf98835ac80c4694e2f71a136086f9b22
SHA512 bc957d675173f359cb47dec22f6a122433e3984ad06668e7814a4c539abab29746365ccda4f0faed388d37a6088d6ffdd8fa8253d516bd41e2ff3878b0f2c268
SSDEEP 384:n4iFiZcI+3sNB8TUNTUlI4kqWXTDDusVzWfZBdWkfwCsNtgOIwZOyGscgL/7Izzz:DFQ+3Ywg9DdRaBdlsNXstz
TLSH
T196C23932DCA4DAFBECEB5E89A74A7603DEE40163C59C9AD8D9D90D1C00971DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bac05fd20d12ad4e5f51744ef0fc9ca4b998c40a257eb33d483d4882900babf3
MD5 b8476ec2a7dd17bfc2edd11a4b4bb2c3
SHA1 e3c7a7868d82a6502602aa6985e71193e4365f65
SHA512 b4a74a7582e22e1d1b7368b5ac3312349173f99ff96d4ef2d4e2ed73031cd0b38fb60ddc1d06af6c670b82972b43e7f83b950a073fdb56554a5ba2a75bed1702
TLSH
T1D3410958AAE9114DB3B76F569BF7A86D487BB8772E06D05E10010E4F0667F00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

RetroBarInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4NQ5K.tmp\RetroBarInstaller.tmp
Size 3.5MB
SHA256 1aa083c03c2234b5d181aee9fe27aa154b409b82e6718c2a17eef7a7f4922bb0
MD5 d94142037a0cbaa85244d7028b43b63d
SHA1 ad2c1b7bb2bf424f6076298b50fb4a34ad57f9f4
SHA512 9b3d28c95b71544d0174f25af750b567545cac878e0d1dd5c37435e992df7c14e6cbb8301ce9a490b827b27728a3452f18424bd2491ef72df881b11bd67167a7
SSDEEP 49152:U44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkff3334R:7IPp70wijepoGzgbAf333M
TLSH
T132066C13F389653ED06B1A3B683F9254583F767029138C579BEC3A4C8E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3828-0-0x0000000000710000-0x00000000007E9000-memory.dmp

Download

memory/3828-10-0x0000000000710000-0x00000000007E9000-memory.dmp

Download

memory/5096-12-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/5096-11-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-315-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-318-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-5-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/5096-345-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-347-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-349-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-288-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5096-175-0x0000000000B80000-0x0000000000F19000-memory.dmp

Download

memory/5372-289-0x0000025880000000-0x0000025881000000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads