valleyrat_s2 | hxxps://1drv[.]ms/u/c/143b196a69c8f929/IQCTJbumIsuySqov_aUrSiUWAV6f1yVDukPzMp339EZsjlU

Analysis

user interaction
yes
max time kernel
88s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://1drv.ms/u/c/143b196a69c8f929/IQCTJbumIsuySqov_aUrSiUWAV6f1yVDukPzMp339EZsjlU
Sample260930-l97klscd63

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 link pdf persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

206.238.42.237:443
127.0.0.1:80

Attributes

campaign_date
2026. 9. 5

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
149	5620	WScript.exe
162	1100	WScript.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
162	1100	WScript.exe
149	5620	WScript.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Windows_system_deponcom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 5 IoCs

pid	Process
5100	safetest.exe
4892	Windows_system_deponcom.exe
5624	Battle.net.exe
4912	safetest.exe
5472	safetest.exe

Loads dropped DLL 4 IoCs

pid	Process
5100	safetest.exe
5624	Battle.net.exe
4912	safetest.exe
5472	safetest.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1100	WScript.exe
1904	WScript.exe
5620	WScript.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x00060000000239f5-2634.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	safetest.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	safetest.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows_system_deponcom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{241868D9-DD7C-4806-8A2C-4F89059DB2A9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1396	7zG.exe
Token: 35	1396	7zG.exe
Token: SeSecurityPrivilege	1396	7zG.exe
Token: SeSecurityPrivilege	1396	7zG.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1396	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 5656	1548	msedge.exe	90
PID 1548 wrote to memory of 4604	1548	msedge.exe	91
PID 1548 wrote to memory of 5508	1548	msedge.exe	92
PID 1548 wrote to memory of 5508	1548	msedge.exe	92
PID 1548 wrote to memory of 5508	1548	msedge.exe	92
PID 1548 wrote to memory of 5196	1548	msedge.exe	93
PID 1548 wrote to memory of 5196	1548	msedge.exe	93
PID 1548 wrote to memory of 4140	1548	msedge.exe	94
PID 1548 wrote to memory of 4916	1548	msedge.exe	95
PID 1548 wrote to memory of 4140	1548	msedge.exe	94
PID 1548 wrote to memory of 4140	1548	msedge.exe	94
PID 1548 wrote to memory of 4916	1548	msedge.exe	95
PID 1548 wrote to memory of 4916	1548	msedge.exe	95
PID 1548 wrote to memory of 6088	1548	msedge.exe	99
PID 1548 wrote to memory of 6088	1548	msedge.exe	99
PID 1548 wrote to memory of 6088	1548	msedge.exe	99
PID 1548 wrote to memory of 5232	1548	msedge.exe	105
PID 1548 wrote to memory of 5232	1548	msedge.exe	105
PID 1548 wrote to memory of 5960	1548	msedge.exe	106
PID 1548 wrote to memory of 5960	1548	msedge.exe	106
PID 1548 wrote to memory of 3024	1548	msedge.exe	110
PID 1548 wrote to memory of 4316	1548	msedge.exe	116
PID 1548 wrote to memory of 916	1548	msedge.exe	117
PID 1548 wrote to memory of 3460	1548	msedge.exe	118
PID 1548 wrote to memory of 1824	1548	msedge.exe	120
PID 1548 wrote to memory of 592	1548	msedge.exe	121
PID 1548 wrote to memory of 1824	1548	msedge.exe	120
PID 1548 wrote to memory of 592	1548	msedge.exe	121
PID 1548 wrote to memory of 592	1548	msedge.exe	121
PID 1548 wrote to memory of 3128	1548	msedge.exe	122
PID 5620 wrote to memory of 1720	5620	WScript.exe	133
PID 1548 wrote to memory of 5824	1548	msedge.exe	135
PID 1548 wrote to memory of 5824	1548	msedge.exe	135
PID 1100 wrote to memory of 932	1100	WScript.exe	137
PID 5620 wrote to memory of 5100	5620	WScript.exe	139
PID 4892 wrote to memory of 5624	4892	Windows_system_deponcom.exe	143
PID 1548 wrote to memory of 4640	1548	msedge.exe	147
PID 1548 wrote to memory of 4640	1548	msedge.exe	147
PID 1100 wrote to memory of 4912	1100	WScript.exe	148
PID 1904 wrote to memory of 4872	1904	WScript.exe	153
PID 1904 wrote to memory of 5472	1904	WScript.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://1drv.ms/u/c/143b196a69c8f929/IQCTJbumIsuySqov_aUrSiUWAV6f1yVDukPzMp339EZsjlU
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x298,0x7ffcb164c188,0x7ffcb164c194,0x7ffcb164c1a0
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,7685545815167926418,1984343172142928750,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3000388985439550723,16235924708260016067,262144 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,6505806199230496218,9148095672780991136,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17714602476006997805,9509420166290714265,2097152 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,13023069798780393626,15071974049803700897,2097152 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,9833385415345786418,189587203079161996,2097152 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,16357925354948252920,7778725835994034639,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,187441482521659618,16515201822215023332,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,13435379728107054497,12967561302409049164,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,13435379728107054497,12967561302409049164,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10038632177855628425,12141054636119982580,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,5482236752713379451,7054631106219995476,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,13574847537785797072,3481296735652226598,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,14630338220947805952,5533053573651477888,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7096,i,515301256211712372,14086547892968937951,2097152 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,9225815095682753596,15355815868109022329,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,14052989679484261468,10550423508440830432,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16766197543867623693,7538309550996946961,524288 --field-trial-handle=2120,i,5739967704690786931,1737358753237921956,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_IT‑SCN‑2026‑0145 1.zip\IT‑SCN‑2026‑0145.vbs"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\Temp1_IT‑SCN‑2026‑0145 1.zip\IT‑SCN‑2026‑0145.vbs
  2⤵
  PID:1720
- C:\config\safetest.exe
  "C:\config\safetest.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:5100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_IT‑SCN‑2026‑0145 1.zip\IT‑SCN‑2026‑0145.vbs"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\Temp1_IT‑SCN‑2026‑0145 1.zip\IT‑SCN‑2026‑0145.vbs
  2⤵
  PID:932
- C:\config\safetest.exe
  "C:\config\safetest.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4912

C:\config\Windows_system_deponcom.exe
C:\config\Windows_system_deponcom.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\config\Battle.net.exe
  "C:\config\Battle.net.exe" --from-launcher
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7113:98:7zEvent7454
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1396

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\IT‑SCN‑2026‑0145.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\Downloads\IT‑SCN‑2026‑0145.vbs
  2⤵
  PID:4872
- C:\config\safetest.exe
  "C:\config\safetest.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ba6d2154e0cf839ed5772d3b6d71aaccac1a00903931e4648d91d76fd8c4a07b
MD5 82014996a7f88684fa8de90dff395feb
SHA1 8d8bb1a541f5d6aec61359e82478df5e6d86fd52
SHA512 c352509d7393fac7286cd12aca7c4aba536e9d7a60956bed327036a00908cd1a5e5f5930d018433080dceff45676f0844c4840b72dfdc507dd26dbc4ed2efdc4
TLSH
T1BFF0F9B5C926BC3B08FC1B2950941646EB51135B2680888F3B3D811D8FB163B858685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 20KB
SHA256 b13e8ef0eb9e535575e68dd47f6dc61109ac5fd3a4d6db3cbf0c3d978b8e981a
MD5 7106bb96f9ac2a0ca024a6fd01757368
SHA1 81e7dcf9263359182ff8b82da384187b27bba82b
SHA512 bcdeb53a918358eb16c6a2ef80ae20ace7445716e02d92cee04adba6b841b04e3fdda64101ae40cdaf8a780d0a65194a3cee505ec4da2aae35aa31aa64ce2e20
SSDEEP 384:qcqrVGsaMyRrUwMM+4+/OVAXvElMeOJpSw03sM1DmVw76PRo1:4xGsaLt97oEGJp10cM1Dmm76Pq1
TLSH
T14F92D00ADF197813368EA1A9C3A8F89C128FB6515DCE14CDDBE70AD64212E9C7DE50C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d28eccebf419578454bf0b4937ecd4ec54514894ef3a5d1da250329bc0cbd6f0
MD5 54b658b6aa392b13a18071f9b5b2fc34
SHA1 1d1b9e54f1c71353f583911aecd2e8c1ef2cc6ab
SHA512 218ea0008ab08941b9d643e1e1127b0e2a83a6083eae2e62a6d2a5ec65f0fa1f516674c11e5ebfe612da8ded596ad524820aac5a12263669b915d5a8b73aae85
SSDEEP 96:A2Xgc7qqeI8mjX7PWHPoDNQQDzosFbtUQOI/g9DdKFyKZiCVwWsHP5ouWxuneMzr:A2XH7qqa4X7PWHPoDNQQDssFbtUQOJKs
TLSH
T19BA15528E59091B9FF665779B0922DBE2531E689C0532B8F4D6CD6747CA739C03B0B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7df22893d26ea1e002de57e93d26c092a5feeaedd2fff41935a9178e46099a3b
MD5 2005a7aef698a652b7f88a9766a62501
SHA1 3ed6f54aa98ddbc5168a06e895b1da80acb3824d
SHA512 958140410623798af2abc35719f36cec30026e1bc74db47a20c2a3cea68c8d1e732a2224209ccdac40f791e28af3e9f3f4b3983907ba2a20d1157ef005398410
SSDEEP 96:b2Xgc7qqeI8mjX7SWHPoDNQQDzosFbtUQOI/g9DdKFyKZiCVwWuHPYouWEhuneM7:b2XH7qqa4X7SWHPoDNQQDssFbtUQOJKW
TLSH
T124A16328A5D091B9FF6A5779B0922DBE2531F689C0532B8B4D6CD6743CA73DC03B0B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\000003.log
Size 3.8MB
SHA256 02d9463443e0ad0d29dfb6d98ec986094ef9940cce18c0603d4c256fefa23e55
MD5 94c27eeea21de16e833d200c24d069d8
SHA1 f062638499b06785f460d730d912dbdf9992e7f2
SHA512 58811ab82846e2ca25eb394b23cf55cdbf5bd505c1b9cd3b0e58aae3cefbaa178416e39a8441248afbe1686bc429ba2a74a30df97bf8c3039f57d7e58726e9d2
SSDEEP 24576:Ea2BFd7NMjIwSBIyUDuOt4lYzW7e0caQpSwxSJi:hVfuOCY2i
TLSH
T1DD06092B680988335EAF5F325DEDD0CAE7655AC3BCC30E9B80DBD626C2C7549199493C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_onedrive.live.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3966490f305fa5e0a507da8466cf0380ee3086e692af935b6ccb0a47f221ddc0
MD5 dd06991db0317a0c6fdc974957093895
SHA1 2fa3bedef6afba629017c5b1e2d7ccea08c2b789
SHA512 a15761f2f7ef7aa1ae6fe73ef01730d95e9c734a88bcafab14edc263e7bda45aa4c3ed43e2efbe8bfaa2a80773ea4fcf664d433b9b6fc38dc37524335c388611
SSDEEP 96:D1uOHDnPWgVwai7zB0CMOf9uoGwBVBGdT1YKQ:D1dHb+awai710CNf9uoGkjiTGN
TLSH
T1C781C0F7C3E8866EDD1156F0E6187E1BDE1D0989432C3C09C5D4AE5B93E24B0E281A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 93c87dabce85d8c17e400e14c528fcfb4e73c255ef7c7cf44155baf63f7d8e55
MD5 e1e2f08c1f6389760bd9f9d634594baa
SHA1 2c283c2b0253525f75ac5eb61f38373d7e10b5ab
SHA512 7db893c62b7e46e5b7c6de7153df7c225e48d9178606193549464b01ce96546e0e1bf2f1dbe63580fc845eb2fabb092153091fd876857294a77274491154ae21
SSDEEP 192:sxZTRRk6/fbsoQZZmLFzodpaKWayHW6+WN/XI4/YbIBWYaT+RIg53DJ:sxZTY6/fbsoOZMO7yHb/f/F8YOYd1
TLSH
T1B342D755AD28697B8CC7D219EA55BF53E3F91033A0855E48AAFC8A2C05E76DD230380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 10572dc461c2633e4b19b390abcda5afd11b1da32fff8413d0ff25584d878f6f
MD5 2a225bec72ad5bb101f3eeb9a699c990
SHA1 03b542078c82c47526994bafeec17916c43bdf9a
SHA512 7d77e442751ad43170a8db2475a361d3f8c593b4874345476f9e268b75c9c5d7cf9475a6397beac2a08a2fd68a1a922e0513040967d9fe06b23c6e3884963a6d
SSDEEP 192:sxZTRRk6/fbsgQZZmLFzodpaKWayHW6+WN/XI4/YbIuFYaT+RIgjQJ:sxZTY6/fbsgOZMO7yHb/f/FkYOYj0
TLSH
T16E42C855AD28697B8CC7D219FA55BF53E3F91033A0951E48AAFCCA1C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dabc0e4444f9c33522aac5fcd6afa33b523a882a5d584c8fdc861c91220c30c6
MD5 cc96a3850e5cd1dadf3daff21c8b91f5
SHA1 1446386cbf2fc4540ae71ffd0be87e15e5d80a5e
SHA512 a485f69abb8ac2f90ecf4f37954f1fef65f51867f828cf58000808d0f1cf506bf70e3af54dc8b96b87b31c6e4b7445b4960dce98da0766de90236bcc5f2a79cb
SSDEEP 192:sxZTRRk6/fbslQZZmLFzodpaKWayHW6+WN/2DXYbIVWYaT+RIg53DJ:sxZTY6/fbslOZMO7yHbgXFwYOYd1
TLSH
T1C242D855AD28697B8CC7D219AB55BB53E3F91033A0D51E48AAFC9A2C05E76DD230380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 74b3ea9a5d61d52a0fac6802d7261dd9a1b8980f4912a1cfc26863590d0df791
MD5 9c7dd43f77ffcd7eec4d7829f4abf4d6
SHA1 9cdcc9ce356d25e22a933c2a88ceac270935cfe8
SHA512 cfd7c7ec83cbe79c08b5ea6dd0a03c0fc036db1d8021f407318c2d808339d401fc1c25ed1ac2317502c45018b1fda7230cd5fddc4e0adeb32fe985c0613d6248
SSDEEP 192:sxZTRR96/fbslQZZmLFzodpaKWayHW6+WN/2DXYbIxWYaT+RIg53DJ:sxZTB6/fbslOZMO7yHbgXFMYOYd1
TLSH
T17E42D855AD28697B8CC7D219AB557B93E3F91033A0D51E48AAFC8A2C05E76DD230380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\21f1e0e9-101a-4f56-ab60-6f6f3f736e36\index-dir\the-real-index
Size 18KB
SHA256 712a36c0fce3dfc213445391239d75705575658173e5a3ab049017a0a17ae3f5
MD5 7be7ad0440c0cf03ff83dee1a26a776d
SHA1 c9a23f1f3ebbffec6659b364e1acdadb642bc4be
SHA512 b3bbc474249c160fa4133f46fc0799f00e3fba757bd5040b3e493cf6fc61afb8d5787dfd3f20874ccfb065903d50f74cd561a255257bddd518214e34129970a7
SSDEEP 384:jDf7pwXPVhwXFz8JVFH2JwWPHXIkO5rZ9L6ls0EUTPH:jb78hwYJPH22W/Et/gsvcPH
TLSH
T18F824880EEE86A53CD7846F23A6B67D033B5C794CB2E83271142F5786F5A3521EC7065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59eb02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\21f1e0e9-101a-4f56-ab60-6f6f3f736e36\index-dir\the-real-index~RFe59eb02.TMP
Size 48B
SHA256 6d35cb17a50be3688c3e9d5cd9a8e2ff657bad3463b9ae1f4b0124ac40b9bf17
MD5 f5a80e7889f62ed2dbe10e606fa48bd7
SHA1 988ec81e3fb0c86e851776c328e9d9c2945d6499
SHA512 6c33f93e179aec688c10c2da982b74c549e1e56806cbd87c145c79ab0c4eb04284a69489e8aa1bc205e3bc09e3fad7f135ec9c947b2bf12b47ae89a722fbda53
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\4af449d8-323d-4159-b493-33e5e51b07a7\index-dir\the-real-index
Size 120B
SHA256 a28bf599458e23d54b3ac9e0e20d0114f7693f75aa8012e9989eecb3db5341ae
MD5 2e5d235e784667df77dc75d61c862591
SHA1 8a6efbb87eec8f476f89075269e7ee39a21a79f9
SHA512 5c9fcb43da47fd6e3f5347f0ccc0578b457fc1bf0ce576458c992419a107113d6d9341fb40838680c2326bff258f0b7485dd4b10355a6303aeaf4ca78d6d82a5
TLSH
T17CB0120441A625A2EC044A785296007062218C50111343137770F4A0682A6CA134B142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59521e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\4af449d8-323d-4159-b493-33e5e51b07a7\index-dir\the-real-index~RFe59521e.TMP
Size 48B
SHA256 7ea290d5b689e0c9ce94c392eeace72540190cfc29bfbcffe1f4ad9feff10130
MD5 3b0e78056159ad71a2ecf1eed99ef7c0
SHA1 3aa596213e3e48b1c21a03f8f729fed938ce90e9
SHA512 b87250fa7a1ebfbd300930a8d2672daf2b2398bee963fa596df84bd71602dbbe2173e6dba93b5b1b8574de096898b2ed32de34c683840d38610249a5a987cee8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\index.txt
Size 381B
SHA256 67ad79534a69f2f37656ed4bd15097db937aaa62080cda2ab0da5f6d290f2b0f
MD5 21b20eb9c1e6331121af60caa6a58fc7
SHA1 1a56205946f1a9d8be8db24e752b67b553adc191
SHA512 c658922b80c4814f816bccdd8ff0f52c13201a3e29ae65b3e8ac0ac0ed6d7156b6f639989e78cda21fc878951516cbdd71837e4afafdada94291fe305d286939
TLSH
T1E2E02B397D300925B9359783C1A935AB243DB9872D408D84A8906251C8932D6E02DD5B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\index.txt
Size 377B
SHA256 b192e7a0d4d08bb9d68109e81230a5f4338d4661b9d14003c177cd9499a82945
MD5 04cac9d2c08629bbef0ab01930ec9f41
SHA1 3c73f5031d9dfaf873a95912a52426bdab17f693
SHA512 540ae859b6b99df708694b03cc61f46caef7aadc3c596d72c1f1f9d74f179fef51b73f51a22225ff28d02d4b5c415e8f57ff70650f9d2e48bc5af1fce09f31d3
TLSH
T116E02B397D300924B935D78281AD356B243DB5872D41CD48A8904251C8822DAA029E6B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59044c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf33d2d39521f463a5cdb6f858d1228e36eb65f9\index.txt~RFe59044c.TMP
Size 232B
SHA256 875143dc7c5b71307536aee0183a90876ec3444396e4085e6018306e43f04bd1
MD5 dd4094245d882d67306c1ac33143e0e9
SHA1 24edd96af6d312ca6788c0d67c657ba34ca86922
SHA512 34d2dcecd735ed20d09ebfef58ac5e8ac4476652759101de466509b8dddb48d60273efaf294502b1770afd410b85a7f3d7fc8f4a21f6a48566f2e3e63a497a6a
TLSH
T163D0A73E7D240525BF36AA82826E365E303D6DD72D848D88A4903211CD722AAE03DD17
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 02cf904e75e6cbe694556dd36a204313efac17fb8fe61f5d4386f423af94cb4a
MD5 5e225c9b6ae98cfc648a8d0aea0441f2
SHA1 ec06ff24ba9c84bec2c22375a6c155d1cb72f796
SHA512 9b4546373f3fe21f2f2ff2fc4f58332fb638ef39ea92cb2d7a96e7feb918f09f7df1b2627ef18b8ede40ea65203eeaeb5cf9f3075c7b33c1e06db716bba6a9ad
TLSH
T19CB02200C8CB3002C8380B382E82000033208E23CA0FB000C0A0E0F8C830F8880C0203
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6effac2e3fcf5217e0a24c26e82a9f24582c37e51bb74e71b736677cf5d28856
MD5 37f4836b5abde87ec6b4ac15ee0ae0ec
SHA1 c348f8330627e281038bb2b3810984ee2d37a05f
SHA512 d62b86422d498566448e5791a864101c4d6613b4f6fb4d29a8a36231ad8ee58e5b72ed6d272ca67348ff2ddb3b63cfcb7bb22f34914d13d30b206229266156bb
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXWFnf:OtfFvpopPxrB4RhfWdf
TLSH
T120B2251571BB121038FE690881B5871F464232B33158EA7B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4fe303f0bf4a807d921956ee3e90948b7dab68c54750532ab6c6885e39594ec7
MD5 68a3b64ce2b589d4c63c4d1e7742dd3b
SHA1 45988d31288635b9e7a78a8b90fee6a568f7b35c
SHA512 74d185b4ead3bcc1a600a96f0e91335c630c967b0c5e42f90bb121c7fb8d9ed6394bb40b30c1f6d1d1e997b821f7fb67a879945acda1af1e43df85421e3c1b82
SSDEEP 384:nkiFeZcIb3sNP8TUNTUlI4H5mgfbjuK2flBE8noQz7rJCgtgOIwZOy87gL/7Izhs:/Fcb3Owg/YABE8oG9CgXsnFs
TLSH
T109C23A36E8A4CABBECEB8AD5A74A7603DEF40113968C9AC4D5D91D5D00971DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dc3b18a238cd7311d64146c8538d1f14a95a546ab423eef68cc25f8a3e6471aa
MD5 f9c9badf6ff10632e53bebbe891a85ac
SHA1 b3dbb1732560e7e7406548d15e1eb394a5c9a24f
SHA512 0995d73c551fa55385d0a01d627d5b3f8140f3d9a23cc1cb008181afd9fe0d0ae322ed9593e257013ddb4563401ceaeef08ef3ae449d0c6802a43b4f83262e17
SSDEEP 384:nkiFiZcI63sNP8TUNTUlI4L5mgfbjuK2flBE8noQz7rJCgsYgL/7IzgoWI:/FQ63OwgDYABE8oG9CgsV5I
TLSH
T1F8C24A72E8A4CDBBECEA8BD5A74A7603DEE44123D69C9AC4D5C95D1D00D719E030BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b0ef4d3cc6aca987e74d43979e336b3903df1e2fe8b10f341763a5ef3c44e1d8
MD5 49fdca57214239622c5916420f95b98a
SHA1 8f58a01677e0d95f64235453699568b35dabe662
SHA512 b6ce7b540ad94a31e1ed07965b8b446120f2bb74043c95f1b67c365b4ecc09e41bf71fac38b6c62c030c9a5464247b9aca52626fe736dadae65d058eff237b58
SSDEEP 384:nyiFiZcI63sN48TUNTUlIm25mg5+nK2flBE8noQz7DCB7O6R2Feo4gL/7IzAoE:5FQ639wgSlJBE8oGDCB7TR6n
TLSH
T112C24A36EC94C9BBECEA8FDAA7497A07DEE40163959C8AC0DAC85D1D009359D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dd90076bb7cd3bbfdfc33597c6c7e6ce9bbcd1b84023ae34bce473ed932db91f
MD5 a588b63f07ebef0179a2239f60249c5c
SHA1 96ce5574ca2ab7b76032d0c3cf809c7c67250ce2
SHA512 25451844986342559b8b40d4c07017476043810726c9ea379a04c3a753da43c1d2a4a5ff747714b5293d5a2c943509469525b3ead15325cb292a986a46e13deb
SSDEEP 384:noiFPZcIb3sNP8TUNTUlI4H5mgFbjuK2flBE8noQz7r/CgtgOIwZOy87gL/7Izhs:zFHb3Owg/IABE8oGjCgXsnFs
TLSH
T141C24A32E8A8CABBECEB8AD5A74A7603DEF40113D69C9AC4D5D91D5D00971DE030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8c155ec67f7d9ea57c27bfc5a04c8e6728a5b899aba891402341707549836605
MD5 0331e4ca2db10246a93ab3c201931242
SHA1 fe27ae5ac72b623cf77aef6469253e26d82d8245
SHA512 d4e56069c4009b6c6ad7ee59379181d68fdcc6055c4ff7d08f4dcefc0b41f6d5535128b590803fb1450a64a0bda4e2a1e83857870bd066f3f0e6213b31b3a58f
SSDEEP 384:nliFoZcIbb3sNP8TUNTUlI4H5mgZbjuK2flBE8noQz7rRCgtgOIwZOy87gL/7Ize:sFWf3Owg/CABE8oGVCgXsnFs
TLSH
T18CC24A36E8A4C9BBECEB8AD5A74A7643DEF40123D68C9AC4D5D91D5D00971DE030BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8cb80fd8c188fcc41bce68a124bef2e33f674c54685358f0f7c811455b36e5e3
MD5 3ccf2f813020c92c718bc6bef61c69a0
SHA1 e003eb2fe35dc1bc5a666a6c8d75e70660cf0248
SHA512 df4a37fabe0cfe0958d8adb2cffaa41cbdd81140bb78f4180861d8c3bc8366224686045dcca02498ed05502532b7994ae833b472ae5cb52598f9752a6dc90a45
SSDEEP 384:noiFoZcI93sNP8TUNTUlI4H5mgZbjuK2flBE8noQz7r/CgtgOIwZOy87gL/7Izhs:zFW93Owg/CABE8oGjCgXsnFs
TLSH
T1A1C24A32E8A4CABBECEB8AD5A74A7603DEF40113D69C9AC4D5D91D5D00971DE030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6dd25efba424708e052884ff05a873e0228dafc43dfe903f8a434b3333bbf336
MD5 eb08c20568a2a2ca61ba5742981432d2
SHA1 ac1cf4b93e4516187f6cf2498dfd913ec7220837
SHA512 60c588a8e0506bb541b9b6c6c5fd3715a74c8a62faa3ada31d6b341d10fdb534ae9f8268eb4114c29b6e06b99d830d80c3f599e97ce53fe8ae4832eb081ea9e7
TLSH
T15A412868A6FD1158B3B76E16ABF2A86E587FBC732F06D45D10110E4E0A33A41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

log[1].bin

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U1Q3VPCN\log[1].bin
Size 454KB
SHA256 09f173b3b7d5f35e356e604eea6b52b0be91eb06eddf0511a229861f02226bed
MD5 3bd0c18c5bf552ccc53a0ac74e46c6da
SHA1 00d374f2dba26a591d1c9cef9d994584ed2fba1c
SHA512 0acfc885c2027c30acceb92d532322500ee9adfe3e9a61b3d5ccd4c0229fef067c538c9d4940e8214fb59be6cd79ec3c88bcb3462ef92b9639a4394b26f61ced
SSDEEP 6144:+ApNjTC3mCg7x94zLPEpy6sf6uXuENwugACOBrtN8FkX0QW/wjQ3LyqNtXJkknAQ:+ATCWz7x94zrEqflJmRIjEL9ndOFFS
TLSH
T161A423A211CC779EC70F2AB1B88C3A1465619C35C4E7EDE7B2233785849112AF93E9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IT‑SCN‑2026‑0145 1.zip

Path C:\Users\Admin\Downloads\IT‑SCN‑2026‑0145 1.zip
Size 1KB
SHA256 df84e9ebefc011c765df34567070d8f29fb5c28eaec4a6f8442aa7c8b6be84e5
MD5 a5b26ebbc3d7d6f61bf2ed75af336bd5
SHA1 0a456d067449db21d1f4c559ed0a7d62ce6cc902
SHA512 14ed14a23a9a80fe655dc9bb7f1c4a5e25738da0cbef6aeade9ab96914f4efb43adc0d42e7d77a137598030c4c6d3c57ecc91c5195f0f14caa74652607583b24
TLSH
T18521B92A0A5D1515D0FAF7B84E81CA0D90412A29C1A183D56ABF78423FFEFA15F385D0
MD5 SHA1 SHA512 TLSH

Submit Download

IT‑SCN‑2026‑0145.vbs

Path C:\Users\Admin\Downloads\IT‑SCN‑2026‑0145.vbs
Size 2KB
SHA256 22bf453daa66ca3098d42f775faa5ea9f9f484797ab9ea2cbb5ecf86296fee6a
MD5 ea2aee3d1d36ddfe873d26252bfa36c4
SHA1 769a8e9f515668b5cb9f0545653da0f62b9e0efa
SHA512 0ab5a87395b6ea04d6fdc9fb69e7f810669b9322b01f7bff7c2029f751543d2ac95a4371da5430a90ac33088e8f10d70626ae141c8d4ebf0de5779dc51c99310
TLSH
T1E851694F9C1F69A30A73B6F44B43472DEE1BF677033560547A06ED562B34088F49105D
MD5 SHA1 SHA512 TLSH

Submit Download

Windows_system_deponcom.exe

Path C:\config\Windows_system_deponcom.exe
Size 211KB
SHA256 a899063db35e45811a62c7abc8e63f8a2bc91253c1a875899a7bec8bff924e49
MD5 6e594a497f0518922ab98e157da1c422
SHA1 6e8729375d2fb6bfa177c1d61920fe16b398b93d
SHA512 e9d6de0974701032cc8b58afa3516c7e0dddaffa14560420d467ded447dbc0a7aa723bfd7145c7b0ec1a749a707965fc65cbcfc4fc7a292b072866b69276e21d
SSDEEP 3072:ZPD7f0dqA6DPpTBuBDYQ1nvK418T93Lg5tD9l7I:ZOqZp790tD9ls
TLSH
T1ED242AD235C19860E56A073014B4FA7C8A3AFCE51B50C9AB7F84736ECE335D0DA3569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcef.dll

Path C:\config\libcef.dll
Size 130KB
SHA256 e6a68ca67bdcb5f2133cff1fd344f10e37272171dfa7bd07ec7963695e7e7621
MD5 84a01844c627e45854ae86b69268cd33
SHA1 b3792593765b4fca19308195fba7e58c2118ca88
SHA512 9243d0472cb8312463be96a48d4c623e994a7d68f86c52db3865072dfe973ee0d933c586896c975a864b3542585081d488257439c45bc0302817ac942b891d7e
SSDEEP 3072:AbsQ6lTFwA+wRLz7EPoUnU9h5maGNaujvGIM0g00XCan:+QTFwhK7U2hAFAfy6
TLSH
T15CD34A57BBA540FBE5B68634C8934B05DB76B82207609BEF07E0465A1F633E05C7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safetest.exe

Path C:\config\safetest.exe
Size 3.2MB
SHA256 8ef03c737155584fe752e82806d2f2ffd3a9320afa7fd88ab3f924d7366d8bfd
MD5 716c5ee5d164ad62009025f4f8d4ee85
SHA1 24d372dd29a2c756824c17e649f7753ce4c75ab9
SHA512 d0265f3e30f19ec6017add9fba96b0c7d998fbed0681adb213ec211265836f40f8bf041e0b2c186e0ef3c4018cad898ac4ae71ca4bb246776b8d67a33f921fa1
SSDEEP 24576:qW1Ca843TAGary0OoSQ0X6fiqnJv2KYKcUOgE5qMYsTR3+i1Lo4dEz5ueIafG7ej:+a84DA5rGoSQ0sn52KYK9E5QidTZf0
TLSH
T16AF54B6A725801D4E1BAD17D868EDE45E9B23C0643619ACF31ACA7662F37BF44D3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-2410-0x0000016500000000-0x0000016501000000-memory.dmp

Download

memory/4912-2673-0x000001EB847B0000-0x000001EB84822000-memory.dmp

Download

memory/5100-2645-0x000001E435570000-0x000001E4355E2000-memory.dmp

Download

memory/5472-2683-0x000001A790360000-0x000001A7903D2000-memory.dmp

Download

memory/5624-2652-0x000001BF417A0000-0x000001BF41812000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads