e04671f635a93db192888a3dcfa062347d00bee282ce066442f13d7ec5f6141c

Analysis

user interaction
yes
max time kernel
95s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 325KB
Sample260930-klg5datake
SHA256 e04671f635a93db192888a3dcfa062347d00bee282ce066442f13d7ec5f6141c
MD5 8555b9748ea866b79c544075c7713599
SHA1 e59aff20e736300a7ebc2f9a83a239878d5b05c8
SHA512 98654256fa26e027cd16ac770c91e1fd9583087e366b2157808a2ba83da27e18c7ad90dad8d49350cee9c88c57c11cfdba187501b25f7c672cf049c0fbd9db27
SSDEEP 3072:AYTgAkHnjzxQ6KSAiTrHN88aW+LN7uxRLlzglKaf2uIk:PgAkHnjzxQBSAot88CN78Baf2uIk
TLSH
T187643C26E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5D5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
153	3112	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
5524	game.exe
2736	game.exe
5668	game.exe
4368	game.exe
972	game.exe
2576	game.exe

Loads dropped DLL 64 IoCs

pid	Process
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
2736	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe
4368	game.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000024476-328.dat	pyinstaller

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	game.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3112	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{23623DBF-3439-426B-A8F7-50E80666D133}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4968	4340	msedge.exe	88
PID 4340 wrote to memory of 1072	4340	msedge.exe	90
PID 4340 wrote to memory of 3112	4340	msedge.exe	89
PID 4340 wrote to memory of 1072	4340	msedge.exe	90
PID 4340 wrote to memory of 1072	4340	msedge.exe	90
PID 4340 wrote to memory of 2108	4340	msedge.exe	91
PID 4340 wrote to memory of 2108	4340	msedge.exe	91
PID 4340 wrote to memory of 1664	4340	msedge.exe	92
PID 4340 wrote to memory of 1664	4340	msedge.exe	92
PID 4340 wrote to memory of 1664	4340	msedge.exe	92
PID 4340 wrote to memory of 1636	4340	msedge.exe	93
PID 4340 wrote to memory of 1636	4340	msedge.exe	93
PID 4340 wrote to memory of 1636	4340	msedge.exe	93
PID 4340 wrote to memory of 4776	4340	msedge.exe	95
PID 4340 wrote to memory of 3796	4340	msedge.exe	96
PID 4340 wrote to memory of 4776	4340	msedge.exe	95
PID 4340 wrote to memory of 4776	4340	msedge.exe	95
PID 4340 wrote to memory of 3796	4340	msedge.exe	96
PID 4340 wrote to memory of 3796	4340	msedge.exe	96
PID 4340 wrote to memory of 3396	4340	msedge.exe	99
PID 4340 wrote to memory of 3396	4340	msedge.exe	99
PID 4340 wrote to memory of 3396	4340	msedge.exe	99
PID 4340 wrote to memory of 3300	4340	msedge.exe	101
PID 4340 wrote to memory of 3300	4340	msedge.exe	101
PID 4340 wrote to memory of 3300	4340	msedge.exe	101
PID 4340 wrote to memory of 1508	4340	msedge.exe	102
PID 4340 wrote to memory of 4504	4340	msedge.exe	103
PID 4340 wrote to memory of 1508	4340	msedge.exe	102
PID 4340 wrote to memory of 4504	4340	msedge.exe	103
PID 4340 wrote to memory of 1180	4340	msedge.exe	105
PID 4340 wrote to memory of 5256	4340	msedge.exe	113
PID 4340 wrote to memory of 5256	4340	msedge.exe	113
PID 4340 wrote to memory of 5256	4340	msedge.exe	113
PID 4340 wrote to memory of 5264	4340	msedge.exe	114
PID 4340 wrote to memory of 5264	4340	msedge.exe	114
PID 4340 wrote to memory of 5264	4340	msedge.exe	114
PID 4340 wrote to memory of 5428	4340	msedge.exe	115
PID 4340 wrote to memory of 5420	4340	msedge.exe	116
PID 4340 wrote to memory of 5428	4340	msedge.exe	115
PID 4340 wrote to memory of 5428	4340	msedge.exe	115
PID 4340 wrote to memory of 5420	4340	msedge.exe	116
PID 4340 wrote to memory of 5532	4340	msedge.exe	117
PID 4340 wrote to memory of 5532	4340	msedge.exe	117
PID 4340 wrote to memory of 5532	4340	msedge.exe	117
PID 4340 wrote to memory of 5828	4340	msedge.exe	119
PID 4340 wrote to memory of 3412	4340	msedge.exe	122
PID 4340 wrote to memory of 5176	4340	msedge.exe	123
PID 4340 wrote to memory of 2328	4340	msedge.exe	124
PID 5524 wrote to memory of 2736	5524	game.exe	137
PID 5668 wrote to memory of 4368	5668	game.exe	139
PID 972 wrote to memory of 2576	972	game.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa7632c188,0x7ffa7632c194,0x7ffa7632c1a0
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12124229213936946965,263426633258767824,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,9751652947761356648,12344930825976008507,262144 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,1416480842283795590,12985601967154584213,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14282756774239780033,12362547415843913263,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7839231366569885304,9879309441442889137,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,15123636458478031601,6294946203554980078,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16954141496863649139,10627838411315823884,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,1823955980446126017,14460091479184414100,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,11083556367137944920,5694160043266321971,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1558406815118045735,5248486086572739043,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5006317118638804484,8389034954390036182,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,11779174472833053231,14270269415554427325,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,11779174472833053231,14270269415554427325,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6688,i,658091093039881515,7886415615797623525,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6804,i,6227037460466459369,8012875725584161120,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7028,i,8445883317825719700,14581926348972200106,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,17564056477850853574,4704414897305646677,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7500,i,2745875393679875595,8433035176966146377,2097152 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3307322817958808609,275279964395204555,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,9757438891667356727,5136465647091756742,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,2269290445685448989,15487343573508606891,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,15450401353229675821,6488205088169981303,524288 --field-trial-handle=3044,i,17603306303401215532,15164502659462498395,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:412

C:\Users\Admin\Downloads\game.exe
"C:\Users\Admin\Downloads\game.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:2736

C:\Users\Admin\Downloads\game.exe
"C:\Users\Admin\Downloads\game.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:4368

C:\Users\Admin\Downloads\game.exe
"C:\Users\Admin\Downloads\game.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\Downloads\game.exe
  "C:\Users\Admin\Downloads\game.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 33b4f054eb12b6c411e2f4a65bc093877081a011f3d365755e7bc3ebdda32c5f
MD5 f694541514304fde59d5e9485fa2ff2e
SHA1 d8e60cf326965295b0730897a209dc2b33e94bac
SHA512 dca10686ef3e61a6df79fe7375778d54b9cf23ad0307eef999e781ba5e10506bf39543c59eedacb822f94b72d181b44d5e2979644d5a716a37d7a1150ad13152
TLSH
T19771A104A6D4B79CFF68873798D51C8F7B3459F219834F2A0868D5796ACB33650E43A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fc9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fc9b.TMP
Size 3KB
SHA256 9b983124c5174cb291d6deb3b35bc344661cfa993cdab7a901eecdc5c6feae88
MD5 4d45b8afc846a96d7e55ff56ce31cb6a
SHA1 56744a3c3acd2496175baf715424724d2a5f09f5
SHA512 420d4cc9be621eb6a922ceb9aec50af3d138dce832012ccf9f5af3b987a2f36a9642211349669f4dcbc8356d16af7f39c000d3a61df1daf94652e40980480d6a
TLSH
T11F61934465A07B9CFF68873798D42D8B7F344DF319835F690868D87A6ACB37550E03A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f9d175300e20f53a98a250511cad98a2bcbbcf57d13f26ff90e438bc222acb97
MD5 fa34cf5467d2f7a4fc803e8b868af29d
SHA1 d16d582a6412747f1d29aed5624b155c49aa9c77
SHA512 98bf0f8111e14b0833d7e399d14f81b1e3687f763eeec2a2249424d733e4f19e26495aae5fb5b644724329486f673d2890e2ec7c1baa9cd78876655a7abf24ec
SSDEEP 3:MsEllllkEthXllkl2zEkl/b:/M/xT02zn/b
TLSH
T1E74404047FC41505C50410304031D7500371D41045115743745104177CC57C10C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 3c0a7b4be1285700aceaabde844a46cf26746443dcfee5cbcefb524c924697a3
MD5 50204f1075a58d4ab76cf1e287cf2a34
SHA1 6fa84ae275961ebd9e37239c36ebdf018b83e895
SHA512 43b01bd2ef1e2103c24c35923e5931c080101a435dc5261bcacd3f4fcfdbc40705840f6cf35703a139687db036469fc551df11d1ff52f582848757354f4d8671
SSDEEP 192:DcimQsKAee+yerJ3eseZxUqGZm1V1Z+ZKexMhZ+QW2TXQPGBERh7GVBH2A7QdcyZ:DcimQsKAee+yed3eseZxUqGZm1V1Z+ZB
TLSH
T1EA328FB7C3E8433EC81256F09B246E6ACD5E155A832C3C1A89E59F0FA3E2471E24175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 4ed9c8cbd128c756197a4159be3983854594c92f7ac5aa6f8ead14e7468303a1
MD5 f8c124b1c7b3d31a7347fe0eabb3d1bd
SHA1 d003445ae204313b4a42feb0b4dca528bf854b08
SHA512 8827310752bcd60481e08307c12fcb5bb1e18e3e43a3305ca012f894789f8d3bf81b62c162abe73269e5223ea16df7b7bc9d2557d822f0fa77219d0639a21897
SSDEEP 192:sxZwRsWi/f5sLhIdpdRHW6+WNGYRPRY+VIgrJ:sxZw9i/f5sLKvHbGmek9
TLSH
T1CB12B8526E28A57B8CCBE21DBA25BF53D6F9503291D41E48EAFC861C05E76CE130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 302e69aa118d50f5355cb2c4d75087ed3affe1a4dbd0d8092ab5c7b9f9824957
MD5 fde2ff8e364d3c322cb2ca67bc4b3b85
SHA1 34b8ccc93ebce4f183b72e0c00605697a7e5baad
SHA512 7d8a82002212a99be3716e628f6a1cc5003b56838e95e4fe7a600afda0c0c0e62aa9164768dca39a1e721558eed80c45bcb34431cf641b55242a28777638fc1b
SSDEEP 192:sxZwR2Pi/f5sJBWpVA5NIdpjJHXPXyoHW6+WNv+3/h4X/YRvSYibIgboJ:sxZwki/f5s/WvAkFHbb/ml6o
TLSH
T18042B852A974A9BB8CDAD21DFA15BF53E6F9103291D15E48A6FCCA1C04E77DD130380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8cc276fbdeb859193988c35dcca198dc01ac97f8298b0196a18a94fd14140118
MD5 01dfad91d203204f5885c456f7dc6a69
SHA1 5357fdc79b672aff0e2779df6e63dca140fab146
SHA512 1f95707d5bb7beea9d9c69e8573dd11e7097d0f8d67273b3f11d04d409034b8e6c0370e4907fce77d7a1b9238700e61f5d5bf7ec9000a04b23e43e9c7a973a40
SSDEEP 192:sxZwRsPi/f5sJniIdpjJHXPXyoHW6+WNv+3/h4X/YRPtY+VIg5oJ:sxZw+i/f5slLFHbb/mqku
TLSH
T1E432A852AA74A9BB8CCAD21DBA15BB53E6F5503291D11E48BAFCCA1C04E77CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c6da64f58ec82bb9165c997ba9ba2711d1b0d0d9c4bdbce0cfe39e8dbd421b1f
MD5 ffe1cd0388197ffcb951b6bd0aeab205
SHA1 bb058c3837d293fb65f1732be0ab8617f88ade93
SHA512 cef3a2aac7362ee8678ae549c3f59833642b9b196825614741a12eafc773c21a5499a32f3f3633162db37fc67fbb42de0bde1eb8983882378304dac66cc7ab15
SSDEEP 192:sxZwRsPi/f5sJnDIdpVXPXyoHW6+WNv5YRPRY+VIg5CJ:sxZw+i/f5spcBHbRmekE
TLSH
T1C122A652AE74A97B8CCAD21DBA55BF53E6FA503291901E58EAFC861C04E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 523c99a7559e1be99bc3618454c786e4c1446fe41cf75d1768fd9c0e841500e9
MD5 f2b7a3b61696f2ff55f668f2010cde13
SHA1 d0401e38493fd79209f0a32e6f7ac3c93760b398
SHA512 a772c3d2780da8bf75480bdfeb957cd578a04386e8d68c29bba6aadaeb99ba0d1f3044830e60fd77f04ea730ae05cad0db458fb377636bfb88e48599abb671e2
SSDEEP 768:60K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k35roN+BP:60K9uzYWvcQWsu1ja0HL7Q3yN+BP
TLSH
T177C2F93F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 06c9538f513498df210fd8b688b14782320eb49d1101410afeaa54763c6ffaa9
MD5 6fe262bb18b904412c5f27bc4711f43a
SHA1 25f27d4bf0a87da93feea4878401c25937fed514
SHA512 6c0039a896b11297ffe689da9d225f9055bb80ec3594659b375d21520fb506b19d2a1149573b7979ede022b4b721ce5e2fced736c9c47d829663d753d7a4ff60
SSDEEP 96:K0m5owKVmK3/yR1/hBx8VssaNxKC4afxeXvkNIk4KhmR:hr3/yR1/hBeVsRND4afUXvkN1O
TLSH
T132910C11767B1A0079BD691885B58B2F568231733018EB6F3FBC84A14E67F085EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebfc1315-e700-4a10-85dc-309438ce14c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebfc1315-e700-4a10-85dc-309438ce14c8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 03a412b767c9cd156584df8c82b738445826015e8d6376ab40884df66c6d5cc6
MD5 4f591e8a06b6cd7574aa680602369b24
SHA1 32c19586ff71fb73579fa14d537e6d1aa5b2c128
SHA512 6e50ddd2fd7d9cfb624a5e60a3b5fc0216ebae2c1c1bea15bd962e192f0aa0ab92c13cceaaa5b65aff445b0f6a93b7a753810b435fca0acb5dccb9ba9647247f
SSDEEP 384:QZcI3sNmUJwMEM0K3OjTVY9di9rhntgOIwZOyuL2o0:u3oF+nScnXsZyL
TLSH
T124828E31ACB86CBB5DFBA141F58A72034FB8C477DAC5AF5094EC9B1D01D66A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c65f813189fa60ca03bbbbe21c958b85ff9890837a197f1bf6e83214039bb0d8
MD5 175a79747d2df8bffdd3d401f4533c0d
SHA1 16de63aeb435bffc0ee1a085e55ca8aa7f6297b2
SHA512 8585bf1b4b6fed6d5d67b4e827f0c204f1f423868b702070c7668d110da795989f3d0d83cc1bbe09a13ced2dc4846dd10f7ab225feb3d869b1ec82519246d73e
SSDEEP 192:SON06ygpQmiUyIbtOCTVgLi+FdVsLzPrVU6:SON06lH9tOCTVY9diPxU6
TLSH
T1F802C635AC683CB78EF2AE06F48737179FA4117BDA562B84D9E85E0C00D766C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9899e68edc9f0ab45301c24c0d284694eca4a74a300af5ec87bb70b9b72ee8a1
MD5 d8189a11ea5094e223e1db6d58f23800
SHA1 8a06785576f6ad2c353df2ffaabdad75fb0ce1dc
SHA512 b751a880307314f5754ba70959bb66edcb29a238e802295f4c87fcc3bc998b21479d4141214902c8fb39046e5a3c9f40e02d9537adf0c461d1fa5d4c0d5ecc09
SSDEEP 384:3ZcIYsNmU1wMEM0K3OjTVY9di9rhntgOIwZOyuL2o0:/YIF+nScnXsZyL
TLSH
T1D7827E31ACB86CBB5DFB9141F48A72038FB8C477DAC5AF9094EC9B1D01D66A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f5790276d5a448c427a5ef0794e7826824321fc11151a0bca26e025823ac0d54
MD5 e3110260197501ace33bd4d227f06973
SHA1 d8974fb46ac24faa9bbb601b56af11ebbc8d65c5
SHA512 6da74cb1a03fd5d1fbea08e31881349c9814c91fc83a4c2caa9440482a946b00b6450f1468fa237d708037dc9a70eb10acd4a339774f2d94a23e4bd58e235983
SSDEEP 384:xZcIYsNEU1wMEMa93OjTVY9di9rbS2v4ASBVtdoB9aCtgOIwZOyuL2o0:ZY+G+nSGJPScB9aCXsZyL
TLSH
T123B25BB1D8A46CF749A6E0C1B186E2035FB84477C989AA5CD0F8FB3D309F6F81716916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 526dcd976ac1b587727067cfefa587b3a6c2b5e328d0792f3894ec8a417b2333
MD5 66ced68afe04e7dceeab3d6561fb6db1
SHA1 b7ab447ab7425fc3e27cfff813aacbd2ce9dece1
SHA512 23f9ff432ac1a9069ef577d8a03f07fe1fb413a2338fd86b0501b6c7306e96bd65cc6c6fd6cc7b16d9d451b44a9a0b4bdf48c9d769b5ea0f758872685279d997
SSDEEP 384:oZcI3sNmUgwMEMxB3OjTVY9di9rjntgOIwZOyuL2o0:W3bb+nSGnXsZyL
TLSH
T108828E31ACB86CBB5DF79141F48A72034FB8C477DAC5AB50A4FC9B1D01D66A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62b532baac21f5a6993b6661434ab9812ba42f3dc9e7156fd93c7dc127718645
MD5 651975a6c4076103f111c697653a4cf8
SHA1 cc69cb18c8f40bafe270c7844a10eb5c66d846f2
SHA512 5a233768fc6bf31fd70868cb0888e8405a276a9aff21a7246eee9a85382945bb3f83c2d599b46982f4c7bf0d16a8aba87506b8e42d0ae4532f7d0f43e611142c
SSDEEP 192:SONU6yAQmiUykbLOCTVgLi+FdVs9mQNf3Utq6U6:SONU63bLOCTVY9di9rsnU6
TLSH
T11D12E835A8687C7B5EE36541F08732139FA48167DE867F90A5EC5F0C01DB6AC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f34889b781bcb5fd9e1afea8de04874aa798853bfacfb8c3f85903a73b259813
MD5 9773d24adf9a9884cf739484e8d1fab9
SHA1 7b73c1656a2903d046fc0afb2041c40414a8dd00
SHA512 ac419290607f6a962f74a3ceaf64e842eba8c78d9c0af57755b76eff06da748aba60bcc773715bb3d3b10b18b7856428b1696bf9e709ed564171c12d9b9f8991
TLSH
T1D5413658B6F91108B3B76F5A9BF699AD447BBC773E0AD45D00110D4F0663A41C8B2B3B
MD5 SHA1 SHA512 TLSH

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003cc2\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003cc2\_tcl_data\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003cc2\attrs-26.1.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_asyncio.pyd
Size 70KB
SHA256 adaaf0c703641f6dbed30d101a5e23c17cc9454c36303394b9e28a52ea457471
MD5 0693819137d5c98bfae7f06b0d76a8f9
SHA1 d9d92845f0f41a600e3967a1fd05ca69f2147a34
SHA512 ab08c8fc551d96c5f5cfa81b72f2ef8256c852c676cfb2c60a93f06dbfd07577679ddd0cc3356092ac91412e6442572f8af92cc467c4cde0475c4cbb918ae4d2
SSDEEP 1536:wCY0h2ZouTTuqsHQH79Iyvnuyrcz895fIiJ:wCD2rnuqsHG79IyvnKRy
TLSH
T1D3638E87A2A44247DA97B274C5736F56FBB0F6521902534F61E8C28E2F13791C3FE622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
MD5 8401e66257d7a7c03e2783b8adcee482
SHA1 57f6a22162c76964675dfe35e79be229bd6e54e2
SHA512 e868dd99b1a8f1d0d5f84af461573aae35f9e4433dd5710a23fb2f7b3f552405255e7ebd048b206412e80cf327d10f093c510befc335e4dc2461229f9fae36f6
SSDEEP 3072:KBZr0elNwqlDYuhJsPXHDFYHuSQT9wPHeR4quOVstP7eBSTLEKXj25Mf78A+TVq:KTwqd8jFYHuSQxwPHROVQKBSTLrqg78Z
TLSH
T130046C5A329C11B6D5A2917886579B43E3B3B430171197CF01A0C7B62F1BBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_elementtree.pyd
Size 133KB
SHA256 6fcc5528ce81f4514fb11cc7248080fd335a3c60d898e845d3341ee589887da1
MD5 a52f49f8fc408a15e0717c1d7bd1c803
SHA1 45b8ffa6f2e04494c274cb2fb176af60091b1092
SHA512 fb2a5d88f43b2370681de2e46042e7568ccb503568473ceec1c993e9e936b275ee3b4ab968a12740e567604d2490b252104c8a9aa079644ff935693ec8afc745
SSDEEP 3072:Xn4rCCrToRaQi3+al3fJ5LaYLZbpO0brsHL8nf4QWTVIyzf1i1Yic:Xn4r3rToR79al3fJNjbIIf4QWTzh
TLSH
T103D35B4B7165C06BE0A35038D2678F56DBB6F9A20E0087DF2284F29D9F373913E69715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_multiprocessing.pyd
Size 36KB
SHA256 7b21c5b0ebee82b0d85724f245857d65e23f82c6aaf392efcd4f800462025d92
MD5 25fc0102fdb08c54e6bd72c0b11b1a4c
SHA1 2dc0d9a3bbcfef184699c147ac2cfa2fcb40a7b8
SHA512 89640ff838030ca75309184bcf1ad58a8ad3a917564a4185675bc7494630bbfc5b821dfab53081b5a786553aae89958b057c369b4d56af12ccb0fcea983e3d03
SSDEEP 768:L+hu80ZnR2VcZ7Dz2dtIyntAXyrcEOJh2Ip4i6Cxf1mlY6Ce:Khu80Yu7Dz2dtIyntSyrcz89WfIie
TLSH
T122F28D4AA6684053E963A671C5A3DF8AF538F7831B21864F7195D2CD1E33381A36E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_overlapped.pyd
Size 56KB
SHA256 fae5e0e822434da7b1707b9ae4c77b8fa7d1d7b810e7e2f5cacf04449c714086
MD5 4a721637bc0c8b53d13485f5030da7b5
SHA1 7424dde1d136649e68b1f13cd0e738a1d428393a
SHA512 fff4270fd6d759d31ae6784510208ab4d2eb0b454799d393f4d2155a6dad9c8b836233eb3d233002491019bbeba87e9e862c8eee608a51a0f83194a9a5110e13
SSDEEP 1536:dMm7HdS/l5atPzKAdE+DRIyWt9yrcz89WzfIW44zvrdn:ThBzVdEeRIyWtnaW4IDR
TLSH
T1C1437C496B9400DAED63C1B9D5A38E47FB78B3D34601531F61A8D24E1F73392B72E289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_queue.pyd
Size 33KB
SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
MD5 8fc4810cff733e6f17a7530d3fb67d58
SHA1 20163031892c87a67169f4ae25115e4e33845626
SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
TLSH
T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_socket.pyd
Size 84KB
SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
TLSH
T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_ssl.pyd
Size 177KB
SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
MD5 893ee1e905ec5a1f74b10d73a8b94e6a
SHA1 23d6eb756eb48c1632b02a24f53aacf71bdfa409
SHA512 237c9b37f4b44ae37726f3fef750f6eda65b9d8a540f386c5a43e1bcef400dfed0f9f37f2dc4042fe0c4fec0ed9aeb700797396bae2e5f052525851760288b61
SSDEEP 3072:/TzN6X1nguzjfD6C3xPsMn6osf87vOifHZHmzislIyL7rXH:/TzgX5gID6C3mMn+2s/
TLSH
T12B047C47B5842AF7D813E4B9C2234903EBB1F155331257DE48D6EA490F03746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_tkinter.pyd
Size 67KB
SHA256 574549683a4298335bdb8761ec6eaa11d56e366b618b5ab0b701b5fe2dda48aa
MD5 3aa9cd197097575a1cd85c4b60b1489c
SHA1 973644b7c6c66e0c0ac0bb6f82600c1e62669ab8
SHA512 b616be273ac160f3c344fee6506f3f90948aa2fb12ac09da5a02e3ef8292614d7257a91b5607978675905ee377aef0640e75d43b5ed70d3799313a6793f17607
SSDEEP 1536:mxIxVo3bb7sOOkQ48jV3RNEFlU9ow9oVZfd2TkR9IyvSLyrcz893fITZ+7:maerFQfulPdVZF/9IyvSVvk
TLSH
T1AD638E9BA7A4008BEEE3D539C4739B13E575B6924A14924F01E4D34A2F333D3E7AA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_uuid.pyd
Size 27KB
SHA256 6a3e6d89e71a803609e6e765a592011427a5b6e7a4766bbca7790b601bb66dbe
MD5 8cdd2cc12be9491bf150e366e81217be
SHA1 6567dba49c9bac718a1badb504fe83b1d3755c66
SHA512 c573f46295699a7314dde633b04e331f292aeafb36f813055144c95f24bc386ce23704980e3cb6a491d4a05e207cf2517526fd0c602b53cf514a7c2b8d27a338
SSDEEP 768:sty+WlIy0wvXyrcEOJh2Ip4B3Cxf1mlPr50BP:sty+WlIy0w/yrcz89BofIT5+P
TLSH
T1FAC25B899A648043FA539B70D1A2DE83FE7DBBD35A90869B316991850E133C2F31736D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\_wmi.pyd
Size 39KB
SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
MD5 609206d81f38626f1c022d1a0ff1466b
SHA1 cef724eceae7995d425c169912e292ac43572ed7
SHA512 e973f30ee976b580913f3a5c2d762364897054f958fb26236eeccd17832cce0bfa1bc04c0981d221c0536f5c9b1d21551ec12a873cbae64fc6b50634dc9d0166
SSDEEP 768:ZEpKg2a5YDQy1ZuNccibJlIyLiMXyrcEOJh2Ip47YCxf1mlPrY0Bb:ZEkg2KY3UNccitlIyLiWyrcz891fITYW
TLSH
T16C038D89E7644052E663DB75C9A2DE43F875B7D35B11938F326482980F233C1E73A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\base_library.zip
Size 1.3MB
SHA256 f757162f4459a01cbf7073217d5cd7b84f1e32eb205fce61bc4c763504a9e030
MD5 8b48f4f18afae0168bbd98f3ed939d08
SHA1 f870afaf834107b24ba7e7586ddbb3b541b8869d
SHA512 e9ed25d3cde6eee0dd49a175067c2636c4b1904a8c48e99eb243cc330ab38397cb829e8c760c6a019cca3a614b85894bf786d57364d4e5c055a1a101ed1133fe
SSDEEP 12288:eqyCMWfVL+DCiUsW7Wpz/QRUi2cPPdxhY+uOBa80201jwCVRDVoioSYBZrdjdTE6:X7Wpzh5cPPdxhY+zxdZdSeT1FqilH
TLSH
T1E2551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\pyexpat.pyd
Size 199KB
SHA256 567f19a92479e66b652ffaadbddba26b7c5dda43d5e97c67a4a76a076021b736
MD5 feb79984518146b9703d3913d54f2106
SHA1 6a4eb8d7e593f008308f05bf26f7caf7d76a1716
SHA512 4b5a67c38aa149cde71ccc1171cd55af8a12a66d514f63fb543005d9ee8f19226f839d28782187a0e46e0f205e3307e4e0739e1b2bd64c0e99e0af794c1836e8
SSDEEP 6144:xS4jcle1bq6XFdTW4yxB+LjrKHP1XcPump:Fclaq6wT1Xaump
TLSH
T143145C4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\python3.dll
Size 70KB
SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
MD5 c947a886e61ad18d052840e095aaa5fc
SHA1 4a2d0092e50757e0b951565c02dd541ab48da96e
SHA512 d4b3d769fa4c22e914e12ac8b63263bacda72b351bea5bd53ba1d0fd6a6c57c98fc392645170f26e7c84fdf855fbe587615f4f3b1f150285420f5b26bda2da0a
SSDEEP 1536:LotssyKcunV8PT5Iyy00yrcz89YfIZRSjB:MtssyKQ5Iyy0AcZoB
TLSH
T120634CC25B5BF8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\select.pyd
Size 32KB
SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
MD5 e5728d041bfb1841fc460db4027a2952
SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
TLSH
T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\unicodedata.pyd
Size 695KB
SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
TLSH
T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmain.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\vmain.py
Size 4KB
SHA256 1dea06b98a9dd343d6627d95525f82b2fc7206374e35cb28a6f050cfcd276423
MD5 f124ba1a63e352d33a70383ef1e4041c
SHA1 0912dff7bd53bf4913aa45d83eeda0e4f99b9dea
SHA512 3976013064bfb166052a773889558710f132344a36779123ca1c2bb49c410fc3d6322bc8bf64f15a8f134bf0520afa6d1d89d31527c6fe5aa12465cb09927cd8
SSDEEP 96:BiVDwuOW+2m+WuuG+m28vGuO2gXWme2BAVnPmbpMJF3Tc87PRSCTqG:0VDwuOW+2m+WuuG+m28vGuO2gXWme2WX
TLSH
T14581AD5ADC164E5083F2E58C8E32E845F35817EF1649171E7AFC88589F3CCB8A19497E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000015942\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.exe

Path C:\Users\Admin\Downloads\game.exe
Size 28.1MB
SHA256 4c4b9acbe8cb14092db2d7e4148264a1cfbb14ece50899a21ab3589a02668ff8
MD5 0b108cdb146725379ec42fb1ad6c26f7
SHA1 10e3ea71c6e7d5246a2fa8fd526a247d519367fa
SHA512 951df6f2cd2afbe86e68002e299b20a5ee5534e13ca94c8b53203c886375536eb91e38cc1bef951a6b2311b2ce86ad4c5103766148ca34268fbc317ce1e2ea15
SSDEEP 786432:b5vzWpLRvjXoRldWzbW8M60h0bCOvV/M8+4VqdCqxzaDF5BG:b9zWpHWBKbC78+VtaF5
TLSH
T1265733987B5104D9E5C1BA3AD5D60C75A692FB1207B0C4CF1AF448A01AB32D8BF7CF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-3660-0x00007FFA76650000-0x00007FFA76679000-memory.dmp

Download

memory/2736-2044-0x00007FFA72A70000-0x00007FFA72A99000-memory.dmp

Download

memory/4368-2603-0x00007FFA745A0000-0x00007FFA745C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads