240dfd6f5686447cbe84e1a096d77a244023daf2c8d97834716928e4df67e141

Analysis

user interaction
yes
max time kernel
100s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 1KB
Sample261020-vrcrysce29
SHA256 240dfd6f5686447cbe84e1a096d77a244023daf2c8d97834716928e4df67e141
MD5 eab9463c49fcef933b893766a6f60e4d
SHA1 88c79b213320cc20ba5b7f14bda543b08e48f890
SHA512 0d090ef42d75236c74633e3eb63ea8d82c13ccbbd980c83a9a25b61a12df2905dc2b11be53bc733b67a036325068878c50406152d5b0398c7d761aabc5951883
TLSH
T1CF2166239040B43EB727A7B5E89A31C87164152FB1620E38FD7433B0DCDC435191A24B
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
43	4612	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{B6FD88DE-DB3E-4369-ACB8-8795F2E78780}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1888	5032	msedge.exe	90
PID 5032 wrote to memory of 3140	5032	msedge.exe	91
PID 5032 wrote to memory of 4612	5032	msedge.exe	93
PID 5032 wrote to memory of 3140	5032	msedge.exe	91
PID 5032 wrote to memory of 3140	5032	msedge.exe	91
PID 5032 wrote to memory of 252	5032	msedge.exe	94
PID 5032 wrote to memory of 252	5032	msedge.exe	94
PID 5032 wrote to memory of 2328	5032	msedge.exe	95
PID 5032 wrote to memory of 4900	5032	msedge.exe	96
PID 5032 wrote to memory of 2328	5032	msedge.exe	95
PID 5032 wrote to memory of 2328	5032	msedge.exe	95
PID 5032 wrote to memory of 4900	5032	msedge.exe	96
PID 5032 wrote to memory of 4900	5032	msedge.exe	96
PID 5032 wrote to memory of 1556	5032	msedge.exe	97
PID 5032 wrote to memory of 1556	5032	msedge.exe	97
PID 5032 wrote to memory of 1556	5032	msedge.exe	97
PID 5032 wrote to memory of 3276	5032	msedge.exe	98
PID 5032 wrote to memory of 3276	5032	msedge.exe	98
PID 5032 wrote to memory of 3276	5032	msedge.exe	98
PID 5032 wrote to memory of 4616	5032	msedge.exe	100
PID 5032 wrote to memory of 3404	5032	msedge.exe	101
PID 5032 wrote to memory of 4616	5032	msedge.exe	100
PID 5032 wrote to memory of 3404	5032	msedge.exe	101
PID 5032 wrote to memory of 3460	5032	msedge.exe	103
PID 5032 wrote to memory of 3456	5032	msedge.exe	106
PID 5032 wrote to memory of 3456	5032	msedge.exe	106
PID 5032 wrote to memory of 3456	5032	msedge.exe	106
PID 5032 wrote to memory of 4912	5032	msedge.exe	107
PID 5032 wrote to memory of 4912	5032	msedge.exe	107
PID 5032 wrote to memory of 4912	5032	msedge.exe	107
PID 5032 wrote to memory of 2996	5032	msedge.exe	108
PID 5032 wrote to memory of 2996	5032	msedge.exe	108
PID 5032 wrote to memory of 3444	5032	msedge.exe	110
PID 5032 wrote to memory of 4328	5032	msedge.exe	111
PID 5032 wrote to memory of 3092	5032	msedge.exe	112
PID 5032 wrote to memory of 1232	5032	msedge.exe	113
PID 5032 wrote to memory of 1232	5032	msedge.exe	113
PID 5032 wrote to memory of 1232	5032	msedge.exe	113
PID 5032 wrote to memory of 5580	5032	msedge.exe	114
PID 5032 wrote to memory of 5580	5032	msedge.exe	114
PID 5032 wrote to memory of 5580	5032	msedge.exe	114
PID 5032 wrote to memory of 3460	5032	msedge.exe	115
PID 5032 wrote to memory of 3460	5032	msedge.exe	115
PID 5032 wrote to memory of 4688	5032	msedge.exe	118
PID 5032 wrote to memory of 5004	5032	msedge.exe	117
PID 5032 wrote to memory of 4688	5032	msedge.exe	118
PID 5032 wrote to memory of 4688	5032	msedge.exe	118
PID 5032 wrote to memory of 5004	5032	msedge.exe	117
PID 5032 wrote to memory of 764	5032	msedge.exe	119
PID 5032 wrote to memory of 2844	5032	msedge.exe	120
PID 5032 wrote to memory of 2844	5032	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x328,0x7ffc49e8c188,0x7ffc49e8c194,0x7ffc49e8c1a0
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,8069253807687479198,2004714360200437965,262144 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13058079584195262988,10477907240332095229,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,16753313871902797269,6094273485430793026,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14170120561460690556,12882809157200733318,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,6353694948944115029,12352843795512161361,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,13578137269878824399,12630051986887298857,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,13805502740450772064,3251329210626764384,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,14716989675696661850,9442713937042454645,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,2361986973496322299,2416657153058902262,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1114440302660889969,16296574243678892185,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1114440302660889969,16296574243678892185,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6660,i,6301070789919179926,15285948014893173577,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6352,i,16073596655843482739,3172170572683030599,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3854213358986236145,10427301314849004781,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3483053773991057543,8936167156232617872,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2817541631749545054,16839629205005540770,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=604,i,14136334718474817513,1025758770691142518,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4868,i,9135157871215535200,12128839927163794989,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2764,i,14502958976236218287,10705118520439583368,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3120790239839063590,16718272718564680261,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,10903924413083205758,5058278228257492338,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5656,i,16037633225329408579,5204262285571487273,2097152 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,13284068220398552757,875692268370185843,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,14494370306840848534,14299686397927076069,524288 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
  2⤵
  PID:2844
- C:\Users\Admin\Downloads\PlatinumTogether-Setup.exe
  "C:\Users\Admin\Downloads\PlatinumTogether-Setup.exe"
  2⤵
  PID:4396
- - C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.exe
    "C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.exe"
    3⤵
    PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7332,i,1847994329222919229,18147438384279074736,262144 --field-trial-handle=2380,i,18239159755321986084,7344602178373961711,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:10
  2⤵
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B4 0x00000000000004BC
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

052a8274-a3f5-475c-878c-4244d75f2152.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\052a8274-a3f5-475c-878c-4244d75f2152.tmp
Size 34KB
SHA256 001bfd094894624706ade4d2f18aa8a37b636bf011d67edaa5c7ab48b87287ff
MD5 6b4495f2d02778e1ea441499c8b1e388
SHA1 652a858724ee83d7816a8d12edadcc7d9b802982
SHA512 61620670de4b1a87bf670596c5dc79eb2be03adae0eaa669f8b1ae8a50810476749852aecd3aa4732ce9c3dff187af46af8ebb7d7e1d1e1c86879d7f318efcff
SSDEEP 768:rW3u7HKnJDjOahxDc9bsMSJz/Fn/3xTlL0:rW3DJjO8VQbs7JTtjY
TLSH
T126F2AF75ACA05D978DE3A780769A3657BFF48943D9C81A4499CEBA0D02C72ED2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23643ca1-7be5-419d-af26-8a854d3a0513.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23643ca1-7be5-419d-af26-8a854d3a0513.tmp
Size 38KB
SHA256 9563119a9d5a40083964e258bb6305e21bce2800d17eca10e16d3319f87f5cf8
MD5 5ce15bea448b78887d492afeb38b272b
SHA1 2c9416076617a39f7ef3dd28075cd7e407289d97
SHA512 a56283029dd9eff6e7780eb670790f4cccd38b3fb73fa5fdae7bda112146aa8ac53900e94d38aa589cd1739e447ad2c6cc700ba0a5afe7160ba255f223e64ff4
SSDEEP 768:Q/UxvxjgC+U3NFKnJDjOamxDc9bsMSJz/FnG3SHXPyK/:9Zj3+U3+JjO5VQbs7JTqSb/
TLSH
T1F403C03AEC904C97DDF767803A8AA657AEF54943D4C529A449EE7E0C07CB3AC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54fd444a-5172-464f-a99a-e02ab000cbcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54fd444a-5172-464f-a99a-e02ab000cbcd.tmp
Size 37KB
SHA256 3326f9ad12b9b7722ad01755c880512f6d83b52cdeda41baced06967324192b1
MD5 5d865618a6a944ac3ff483e1ccb660ee
SHA1 7da8f8f135e92f9d412c9ae59e3f6d0d60d91df1
SHA512 dfc010fe4757bd364626859cdc167c55df2f0fae0243d9fd36baa6f301f6502700f31d6a4133c856d1e9248958166b9c07fdc02bed9c77e93db6d6366241db4f
SSDEEP 768:z/UxvxjgC+U3I9KnJDhxDc9bsMSJz/FnnzSHXPyK/:GZj3+U37JhVQbs7JTFSb/
TLSH
T14703D03AEC905CA7CDF767803A8AA657AFF84953C5C5299849DD6E0D07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce36ce6f-0a07-4521-bc23-5b3d4005a81b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ce36ce6f-0a07-4521-bc23-5b3d4005a81b.tmp
Size 105KB
SHA256 ebf0f1691f49d860fa202d63b050ce2cad38a0496d2658dba8550bd94b28fce4
MD5 7e383905ea5e52c72981148e0ba96a63
SHA1 69b00ea95b83255ffb3f785258efe9e2849602af
SHA512 9017a3852bc1710a7236871d7d43724c12d99f4aac743e58adc0ed0e10a6b4d51529c2fd094425d056a04de8831ea1cbb443ebf8f28e3ebce5c3178e7f66be02
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

0ca7c409-26a2-4c16-92f9-718ff059e88a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ca7c409-26a2-4c16-92f9-718ff059e88a.tmp
Size 23KB
SHA256 1d35312c5884f8acdec8ba74573a375dc6061d99677d4449af64379a94802f9d
MD5 420d9ead4ef08d189daa1dc08c6dc8e5
SHA1 21e19f76aa4fdc46f9b159be47ff46934eb0c790
SHA512 d4c318ee91af29cac0a187883cfa14961b871dcd03c932c2ce1b8ac103e165abc27ec43b94b0fd30cd614659d66d4c3902808600b6ec3c7a85a49866f44f5bc8
SSDEEP 384:dFIGx9efCtgmkFfk6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6W9G+RhAromLt:dmGx9sWgmMfk68F1+UoAYDCx9Tuqh0Vl
TLSH
T1A5B2DA3B644CCB7E9FC00A9DAD196E976D9802C796588D4047FA984C03C77EB912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1932e4a6-7cb8-46ea-9b60-c36fa9f8cc81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1932e4a6-7cb8-46ea-9b60-c36fa9f8cc81.tmp
Size 11KB
SHA256 00ca7349e9e8541ba59627758a11788cf584bf6d62591277b7b578eb519d66d9
MD5 930cf39575e7cfd7cdddfe82c8d33394
SHA1 1cd2f75f472e8c538d24e6857a9c4b44b2fd353f
SHA512 341f26b9d2d045df79cb94b2904e582d5ca2c7ff870f329145a037e6912e9fdd499b71094191b958893a70599bced983804794e9beafcda1238db33b851b2bb7
SSDEEP 192:sxR2RROp/fssMXpzoA8peeB/g6+WNRmFfYt5pT+GtIgD4J:sxR26p/fssk0z/5efQPw
TLSH
T1BE42A615AD38AA3B8CC7D60DBA55BF53E6F9503361D11E48E6FC8A1C04E76DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

539a88b7-0d74-4112-919c-88fef9a0f328.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\539a88b7-0d74-4112-919c-88fef9a0f328.tmp
Size 11KB
SHA256 6c3393b7b178880ffb1a4381abb458fb581c1c124a4c08c595429d9f9472da01
MD5 8f1b1484765c06150af5c5aafe102de7
SHA1 d1999d643f9ea0137191b73bb2293fe3615f3219
SHA512 0574d52c5d0510a00638f78b33ab8ae9a1d6dbb863ca220e86d141243e93a3fffca3de575f2196523c2f4b6690a2fc38a80a709736d3ba883b355c08a643ec0d
SSDEEP 192:sxR2RRbp/fssMSdzoA8p4Z/g6+WNIYt7RH+GtIgDCJ:sxR2np/fss5Qo/5IaPC
TLSH
T1F3329415AD28A93B8CCBD20DBB55BF53D6FD5032A1952E48F6FC9A1C04E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a8d250b-c03a-4102-8055-dce6a7a76b4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a8d250b-c03a-4102-8055-dce6a7a76b4f.tmp
Size 10KB
SHA256 3c98683a087d5c3d0303bffb66d92a7cbc129ba862f02a991ed17e47bbfa06b9
MD5 9c28a3ef8bb3d7b3479a12d4e13c4a18
SHA1 eb5dc5115f03926b6daef9982262a370b71de092
SHA512 9a304c2318f870226abe583640a1962251062e3f46051125bb770f1199b90ca448aa1d0ebae7c84f30bd4af90b0c23cb11bdedab82614e10c45176ebca1f1ebb
SSDEEP 192:sxRVRRbp/fssjtzoA8p4i/g6+WNIYt7RH+GtIgIJ:sxRVnp/fssjgT/5IaPs
TLSH
T191329515AD28A93B8CCBD21DFB69BF53D2FD5032A1951E48F6FC961C04E66DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9852945f-10fd-4b83-bad1-59dc0b1a94d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9852945f-10fd-4b83-bad1-59dc0b1a94d7.tmp
Size 11KB
SHA256 a7a782d5a7b8c525c53fec20fa4235000b1862fef30554112d6c4e1ba4892387
MD5 77c85a07bf966267853ecc5e06f8ed68
SHA1 ff772770120d29c3125602514a979f57ce000708
SHA512 13753e5c6f854b4d9ed265678a8f12cbc77c94479dcdd1c06f892cc1e1224ae6a23f075fc29c1722f7f4c93b5a3426419d48f11e7b11159f547b682d9c28ed65
SSDEEP 192:sxR2RRbp/fssMXpzoA8p4ec/g6+WNRYFx/Yt4mpH+GtIgD4J:sxR2np/fssk0Y/5iT/9IPw
TLSH
T1B032B615AD38A93B9CC7D20DBA55BF53E2F95032A1951E48F6FCDA1C00E76DE620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2556e1e9f1d2475450f016cabb56872809caf571e40d6a56d413873f81057b9d
MD5 40e23508c8e65dbbb1a4c0e7273e2ada
SHA1 67b2feb7ddc71895d0482a68f4c3ce824e0228b3
SHA512 ced0c77636d2f220735ea0d907d89adc70caec457488f004a713519d1d8fe33775b180568230c03a0ab6599442a94a446de33b47aae5cf61680faaff8eaba3fc
TLSH
T15A613CC68690A13AFB780134A6C00DF3F63F86A3D5930E0E7698CDB96D46F9601D07A7
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 04e17794a121d4357b9e596aa22b9839b09704d763822b08441a28407384871c
MD5 fe0ea4cee855c58bef887918c2f6aef1
SHA1 0c1198cb89b7a9e650a73e412b6ff088bad9aed0
SHA512 4bd08f54dab89f17ea56b436be5a576df273d4a5c79fceed642bd4d7d71c11aa9556232164e82885f320b5a6ad53aae96937cc42952aec6be97a5773656d701c
TLSH
T1CB615DC68290A13AFB681134A2C00DF3F23F86A3D5835D0E7688DDB86D86F9600D43A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aef1972083e080d110ac561898d4a28fe5e1b5847590a6de3129aeb1edf30482
MD5 5b626d528ed7843b3900b605ce7e2f4b
SHA1 67e882bc595c3539f9aacf8723bc86888bfc0330
SHA512 3d1cdc3e097882f8c5979b591288a58104588610556afa905320c1e348c9ea26ca7c35ff12ee45949fa0c8e1c40d35eb3d80d1f904e6bb64f7f3a113841e9656
TLSH
T1AE613DC68690A13AFB780130A2C00DF7F63F85A3D5930E0E7698CDB96D46F9601D03A7
MD5 SHA1 SHA512 TLSH

Submit Download

0ad620be-c3e6-4739-8413-71653e59d909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0ad620be-c3e6-4739-8413-71653e59d909.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

23e369ad-2d07-4b56-8ea2-17cb727fd71b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23e369ad-2d07-4b56-8ea2-17cb727fd71b.tmp
Size 2KB
SHA256 abea6626df17312d4322ef2a7a6fb67e7e4a6644447fd95b2d4cd2e2c1d61143
MD5 99a7476a659cb31ae6cac966200a24a5
SHA1 765bca3555fad3929682d2f0d475329576e3edcb
SHA512 98f984e3cd92cf1c14468532f6ca44b36a093343e04c8068b9de2a23cbe7d3f24c856d48b18331d718b8f714890a6fe74926796edc8460f7061fad081b56ac56
TLSH
T1AD51CEF387E6866EC90196F0AA14BE1BCF1D0955432C3D19C8E4AE6793E3471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

6869f787-ebad-49b3-8286-dbadeb735bea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6869f787-ebad-49b3-8286-dbadeb735bea.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

8b8ce9d7-3a72-4b3b-a8aa-8364c082393b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b8ce9d7-3a72-4b3b-a8aa-8364c082393b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 655d014d53ef5f0bcddd1e974ab64098a0644e22e85841752c685eef1b9ee27e
MD5 10b54b379da89ec6f299254c547f87db
SHA1 210fc819eea6c2cf2e24a3cdeb010a0daa92f94a
SHA512 6b6bed245ef8a1b72a182738ef09f4d6de05d85900671f2e2a8b0452844cf37a2e9f214ca2dadf221d37d1aa7fd6baccb8a8db2fe2f4e972e05ab8ffd76d2e6c
SSDEEP 48:KUOI3KbK8PyhCIfKXqcHeI/KjiYRyd9IxKucUJ:KUOIKbKOSCwKXqEekKjicu9GKucy
TLSH
T17AB13621707B46013ABD360891E0A7AE174135733078EA2B77F950A69E6FE080DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b0ed0acf-f3a2-4bc0-8685-15cf9189b6fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0ed0acf-f3a2-4bc0-8685-15cf9189b6fc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd5ff92b-1957-4f56-9908-6cc715e5e50e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd5ff92b-1957-4f56-9908-6cc715e5e50e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

17edc351-a5f7-44c1-9ead-be0b5eab804e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\17edc351-a5f7-44c1-9ead-be0b5eab804e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 343694c8f6f3e038e092e4fe7eac619905381680b8edcad1d2dc6ea29ba5cfa4
MD5 21ed7d5d3541f294f9bfca23b3789b18
SHA1 64c0776240c3a05db9517d08868c7b38f97d7d3c
SHA512 77ab06c07ab20fb5d3d8256f5da727e7c3ed186606e5c51df3cd242ea0b3437497bb5e1505b044354cbc6fc6ab0a3ace08e2478cc355c2d931f6480423f93828
MD5 SHA1 SHA512

Submit Download

b88b567e-3704-4f1e-9b25-670d039f85ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b88b567e-3704-4f1e-9b25-670d039f85ec.tmp
Size 41KB
SHA256 a78f2007e987e90d24b67fbf8747972808735e1f6c3ec74256055ccf2212ca1c
MD5 b521b762edf99a31f61e46ab7b005e5c
SHA1 74aaa7b0425b053ebf22f3001318e6d8be3e841e
SHA512 17b52de6f57f67f55cb815e10670f84ac47836baf02bab5304868c2c629c9550e6117e09746beb287187c00d2653c101cba4a5ccbbce5b9d3dffeced2148f9cc
SSDEEP 768:CFIn3dwgTiHKnJDjOajxDc9bsMSJz/Fn/3xTlL0:7n33JjOeVQbs7JTtjY
TLSH
T115135AF698D385B7C9AE5743A7BD2E06AEBCC543B4845540B7C9690CCD862BFD307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8fb2f75-a139-48ad-b71a-bcbf8adb93ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c8fb2f75-a139-48ad-b71a-bcbf8adb93ad.tmp
Size 34KB
SHA256 b6b613002b114e824c3645f433a9b42b36f0e3f88650a1b32408e680edc62bc0
MD5 778edb153fd97c1ece29ee56a1a80253
SHA1 30c7f60689d92d801ab9dcca0df958e6abe2d852
SHA512 d579b778c7d21559a61ab76d010c8b8ff3c55013d78954d720e02bd105b1646102a9e145b6edfce9a79412393eff92cc745092de3e94f5f1ecb96c1fd402914d
SSDEEP 768:oW3xEHKnJDjOahxDc9bsMSJz/Fn/3xTlL0:oW37JjO8VQbs7JTtjY
TLSH
T1ABF2BF75ACA05D978DE3A780769A3657BFF48943D9C81A4499CEBA0C02C72ED2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c97f1f73-866b-4bbd-bbdc-cf1f10263b17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c97f1f73-866b-4bbd-bbdc-cf1f10263b17.tmp
Size 392B
SHA256 f21e3e83cc9d203291fcec361bc0c73e9d944b1b93dcd330ac7c48ad4103ab47
MD5 7463cd7b57c1cd2444532d5a67d354f8
SHA1 db4436f2aa1f9a282df5a5af0fee33940f046405
SHA512 1b530b03935eb99ededa1c3aeb1fce04bc7afe85a3d940ae6df792718fd93b84198129209e23eb2284352545507d4e673c0e5fccd4fa5ead62781f46cc02c490
TLSH
T10DE002015304015EC034133040C31B703BA6C12001561306051501607C193001F21AC4
MD5 SHA1 SHA512 TLSH

Submit Download

db1f4e8b-b760-4f9d-bbe3-43cb82ccf9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db1f4e8b-b760-4f9d-bbe3-43cb82ccf9e1.tmp
Size 41KB
SHA256 f328c579275b054bceb3bd734e8d02d0cb90a24ae666e218f7797a4358b88dfe
MD5 5eff946b56db6c27c046c83798d4d7a5
SHA1 88336c344ffcf3c58761b536f682224a00582df6
SHA512 a3fc1d233a30e7f996b1f511df376f08bee8cc1dfdc25b18e188eaad1f2a32b03ea5610a7d94b9e1a61d05601c1ff44b7dd34a298007f2b77c7e739191959556
SSDEEP 768:CFQy3YwgT8HKnJDjOa1xDc9bsMSJz/Fn/3xTlL0:Zy3AJjOwVQbs7JTtjY
TLSH
T16E135AF698D385B7C9AE5B43A7BD2E06AEBCC543B4845540B7C9690CCD862BFD307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13372433-41b7-49ed-b68d-0ddfd9453f10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13372433-41b7-49ed-b68d-0ddfd9453f10.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 bc71590b4976891d4d0b87c33d8d2f336707eab7f4f486d0e57cb7c3b03ccbb0
MD5 b7ae64df6965318e646ddb3a89b8285f
SHA1 97ea591fadbb3f04c4e1bd6c6bf296fa595e386f
SHA512 f9814c0f2241bcc23f3e41783c3838a5d84177b290a7eeea2dce885e75df9c541e893f94738240b5710e38757f1bd625f90604b290d684fd4af40771eedc55d4
SSDEEP 768:50aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:vZP2tFPuNnY4UmqEMioTaBacg
TLSH
T140154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectWriteForwarder.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\DirectWriteForwarder.dll
Size 493KB
SHA256 e585360ca511a352f0b53438a24b8f588b3ae7fac73a8f9abe1e9c18c8affc09
MD5 18fa76b8d197aeb62420585aaf937e4b
SHA1 e422b07787e67f5a561a83af1f62d9af12cbfb89
SHA512 81afc8d660e8cce77e89d7f4f64e6c653a6d11a4b5f43545e95d5d367823da716c548df82742aa11482aa4e7ca3379217a8d2feaa63735022c222d2c7d1c82ab
SSDEEP 6144:0lramPXxuPcM1rFBEqvIPOHWR4P4XWZ5rv8EDQT29mnSfvWylSownrQQ6icHUuc7:0bhuPcM1rFBZwPOW2P0HmWclicHUNvig
TLSH
T1A4B48E25F7C52762E86E92BA4243C2629531E8F65707E3C3C681C6252D3F7C2D73A6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 0ed8917deff4e38def167b11ad222354bb463ba8092fc14710f4e59b4f7f99da
MD5 6b15b5344df9aa78a946bda8573834a1
SHA1 63db967195e85f72157a834d8f292cd85db35b83
SHA512 426784a44842f8b8398215031d4692f089b159c3489c45e14d40848f6c2608af71e64cc524e75d311f2eee3ea822cab8a1e66d6ac5a6c5b37679f973240ebc10
SSDEEP 384:8phz23MXBszkWhPGpWCZlNZriSR9zUEZBWSP:Y5Bs+9rr9zPZ7P
TLSH
T1D8624BD2C73C8103FDEBAEB096A4DE833D3857C348059A6A059AF1191C637C1DB3163A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlatinumTogether.deps.json

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.deps.json
Size 36KB
SHA256 aafe63bf55713347c1f98f1473a80f5959624fc5f3827377664dda5fe8a4ba86
MD5 629433a1b1bfc8c4093ada1a5513960e
SHA1 005ddf2da3db2698459fc38918d499fe12f1ebea
SHA512 46df5d923616db61424c0798a648e1c26521ef34d2b958b676a25669f18cf7e1403d2ff4dce210a9e482b0853d66066584f1be85757d19c658b22cf454c71137
SSDEEP 384:XJXaUa+sjgqndDagkjqyfHnfn14XnFAuWmK9kYbsi:XgHWZLbZ
TLSH
T142F28126D96049B70A3597F738394A64F366032F3440088EB5BC6C1DDF77EBA0255BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlatinumTogether.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.dll
Size 1.9MB
SHA256 ea2107b173f53dec82f99b5ace80a9bf40a4368f68e73464254ccc5e133bda6c
MD5 1c06a861449e25b91f0458a7419992c8
SHA1 eed92c8624e8a346b275f0cf20805d4254b5969c
SHA512 12cae00a78132876b3fc5d606ebe34a126c47e79b8db9672f0a762dfb331de90df0efe30a7ea7344a59107fd5e1efe551defd7be148547371d244619c782e404
SSDEEP 24576:UO0c3UYhdHEZCYga7gHgogsg+QgnjHphgMrdgcgJegfOgeg+KFg/gZg8UE6gFgJu:oc3jVqq9jHp/LKjUE+kh
TLSH
T160955C3E5A8043206DB213D9F24D5623FF49E167622283388C7D425E319DADCEB679F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlatinumTogether.exe

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.exe
Size 229KB
SHA256 5260756c8962df642498c535469878dd074ad3c5d12ac1efd6066e3576ddfd16
MD5 a989af99e409af34d2411c6291352cf0
SHA1 465cd9965038f7d4e252ccac650fae5f70c78d7e
SHA512 7621a2677c935ff2affc8b74a324387bb66f6cbf3eb15b5da14e3ded5407218cef4fe8d239d732fba0ccb5718c3f2adaa1ace93a8de589ad471e9442a0ddfb5b
SSDEEP 6144:VAAwxrI14Q38gB/oC1nPs4PSqjS0OGyMze7O:VAphI1Q4/LnPqqUGyB7
TLSH
T12F348E13A6A810FEE1B7D639C9924941FB7278594B71A7CF07504E760F76BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlatinumTogether.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PlatinumTogether.runtimeconfig.json
Size 527B
SHA256 74f985744e8134cbd21428da8a217a9f54a0a48c298244236b1215e645ce9554
MD5 19532a6c6df8fb42430ba74b97dc2a44
SHA1 2fb94fd85785ea63cf353af5d1d16dfd31215a37
SHA512 4691f2f0cb270052025d0bb8c795d2ff668f72b83b6090b596427cbf406b56f7a90836c3f1b4cb8ca9ff256ea54ebd169865073faad154fc9f2780bc9718e892
TLSH
T131F0276ACA106D7718B5737AD526C182EB30632B10041D82B9FC081C6F775B61012F95
MD5 SHA1 SHA512 TLSH

Submit Download

PresentationCore.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PresentationCore.dll
Size 7.9MB
SHA256 96a329ae739f41626263b52e9d4179f55a49c5be1ab0f0285c7b95ff119eb07d
MD5 008470c5e8fa78bd0c48de1b199b913b
SHA1 ec07efdf955ee9091d5c6f3208d9d8a49e0090b5
SHA512 4cd8d89ef9c2c7c5d263a9be0366669da4173a21366bfd30104eca99f0fe2c0937cb207715339684c1f081524e40efb52a71d00a1b18e6c21b61c0e4e2eeff4a
SSDEEP 196608:7tzLeQNqk+GyW5QZzKFCr1axAtGYOShfPKR:pzLeUQQbyhiR
TLSH
T188868D08E3C91E25D27F95BDA2A36102F7B4A033971192CB3D9DDB192F937C19A77212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\PresentationFramework.dll
Size 15.1MB
SHA256 95323c3fb3370d53a2a8ff288327ee5186b006b18c595d54a0f8495340d066c3
MD5 dc0af395ba0ce912de298dbcb7b630e6
SHA1 ece1ff3a15901c6435f3f8475d538edccd5b0491
SHA512 92fdc49e887abb4525b79593b4e98d0578f36c0025e71fb11f153a19fea6af1ce1e5ce9fa56c437952c39f91d46161c3e2c7564b7fbb4ed56fcbee638a26f50f
SSDEEP 196608:u6k3buHljBxsAJted72Zlzcgb/erKHvAtkcfgMbgDr:wEljBxsSed72ZZHPAtkT
TLSH
T1E4F67D19E3D84A05D37EC1BF82632102E5F5F8B6937285DF0527DA492F83FC1A676262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Collections.dll
Size 289KB
SHA256 22f81315a6dbe69080c917faffc9d99f8ebd0d20dffad432e26d11f9c14aaf2c
MD5 317e2b48eac94ba8ecc945d75a8c3e87
SHA1 b22044acd9d03da4bed82d63719e8864c27d2619
SHA512 436c9351c47ee0034e76bde2b33ed519cc4a8df21ef9a60e9bcd9056093ff11cae65a6a3e1c6866a16737166e254d06f7d668130e500960cad3daf118a45d90c
SSDEEP 6144:YdtH4FsjvCSCDLEFCL8ph2wqXh0PsHkbtXa:0OUvCS8qCL9wqx/HkbtK
TLSH
T12054392873CC2711FDBE41BAE693C042E3799052835082EB46BDF6519F9BFC16AB7425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Packaging.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.IO.Packaging.dll
Size 313KB
SHA256 92b115060814437134fe3c667b2fd0f5b49e389db66e5fe02b4c01a48f645b03
MD5 a4d92758dd8105e60cf01aff53e14778
SHA1 e3de4fcdccdded9ab80898c9726bc652cbc637ab
SHA512 2c9aa76b4c59a4c44d354edbf62e4bc6942c770ca5260a131da25a6b364b3f9e06a9d9cd34f615b0487e22d2ed179a9c90b0ed7ffcc17f276b7fcc2d3b1bf7dd
SSDEEP 6144:I026TCxuA6WnSCLSF5y+//2WbEUy9vafnlKUV6P:I02bxuAFSCeF//2WdwasUMP
TLSH
T19F64F72633E80506FBBB5BFC91F3A051E27AB45227A1C6CF0521D59D1B93BC18EB1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Private.CoreLib.dll
Size 15.3MB
SHA256 5b6700e2802afdb2cc4863b096760a66442e89fd6ee5edb718c697ae5cf33ddc
MD5 f2f1e377eb7bae97cbf2edceb2befe8a
SHA1 c9f020d0a116c3b51d3dd18be3ea52133a667229
SHA512 3e685edc37756e80a2aff502323e715745f4fd0967df97ff5b962ebfdeba61581300a9e21e706a342fd089d6468a9ee4cc05910595d0ea49720f492c97ed38c9
SSDEEP 196608:Azw2LnkvY9BnpsZdI9fkuOH0Ar+6x5LKd6kIn+9ZNIbe0p:2w2LnkvY9BnAdI9dOH0Ar+6vKd6k52v
TLSH
T1A3F6AE10E3D89F4AE53EC2788057C616DA70F882532B86CB0195EA493F73BD5673B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Private.Uri.dll
Size 249KB
SHA256 5541bb33861941addd700eacdf9a206c49da1a0382bb6725d50eda964b656c36
MD5 d19d3b2ce89fb2c93ebfc5e0ab594f9e
SHA1 cfd17d8baf0e9859f194b5051cf41cea7d3322cd
SHA512 b1a92d43a7197c5cda58e0fce23ad7d7069a98c4ae36748ffbcf79e51f86f83b60e9d3143c9cabfc6a25623af1327dcdf5d38d56f8b1f3307790e3055cee270d
SSDEEP 6144:8gE0Now00kgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMW:cIhtCmC2+HtGw
TLSH
T163447D1BB3D40E6AFB2EC3FD8693C592D272B1965305E7DB07B490812E133C16A79993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.Extensions.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Runtime.Extensions.dll
Size 17KB
SHA256 242fe2a65b3ea3fd42ff29106d54a8b7c5efafcd971e5b9b13f2f0c4f7d3567c
MD5 29b403f45f6e754ac5584c137ebc9e91
SHA1 9ac2e386dc1c063f8aafafeb5a6528fd0f6f35ab
SHA512 8505e1d9f1fb6d090c78374b13425cf78638f71454cd9f260f33257ef1b7a6e9de164f66d612d74a5fdaf7a6d76b9ff3ffdd06011a48d0b68dd05acb509071fa
SSDEEP 384:6u/E9x+Du3FW8yNWbBzZlNYAUyR9zVCaRo:6pmu0Y6AU+9zVC3
TLSH
T145823B92CF5C8313DD9B5FB0AEB6D9822DB8B7C29D71D96A0689E0081C537C4D731728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Runtime.InteropServices.dll
Size 109KB
SHA256 b6231cd2114de5d310fa8665715b39a08c0f045da62c66648dc948ae757b5b4d
MD5 c1d55ed3d2ee97003c445d4c99802608
SHA1 23ddd2ebf157c9b3e2116d430aa6d5aab4d96c41
SHA512 5cf64c78b98df3e752d6f7b09821fd270ffe3ea3b13a91588cabf04feaeb3a64befe7b00889fb7f0398e2f92a10e4593f5cf4e1c25d15edf9a67319493c4cd5d
SSDEEP 1536:4eBz2QtNQMALNBKTerzicKDq5t4udNY/w2yVvObug894RHPeF20gArkzwKE:4egiNQMA7KTVC2udNY42ypCu2mcArk8N
TLSH
T173B34A107B98863ACAAA87389C335D448DB3FEC69312E2CF9584C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Runtime.dll
Size 43KB
SHA256 7f87ad22ac2ec701604a68646bcf4aa1f5c43ad6744c6d01bfaa9e9667e5595e
MD5 7ebfd3ee5132c9fdb50282ab4f7b536a
SHA1 7e864f9753bd8ac2098389c9229f9ca2e9fcf4e0
SHA512 353a5a2f1d04860250d9b62f6ab65cfce866ff359ce1f5275fbad2775c63dadcfbd145d851223105859d7fb9a737ca6a1d6e7b4edbc0876f2d88c4045f503861
SSDEEP 768:LAShN9Yzl50v4boRiPYVbugVJL8ibhAU+9zVCgVaM:LAmN9Yzl50v4boRS0L8ij6zIE
TLSH
T1E813C4A1EE28C233CCCA93B29CB3A4801EF673C240764D75556FD73524AAB89523637D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xaml.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\System.Xaml.dll
Size 1.3MB
SHA256 0c47b6d98365094016d92fd4831119afd3069ce8a1497190a78183b4531bfc1a
MD5 341fdc27adab5cd1bff2894a3d224b86
SHA1 86861028ef10355616658d7f4d3f9429a35dbf3e
SHA512 52ebec6dd8d0dae63ae344571e3816f132740e7994505932ff1f3c2a3ee9b92fc8d820a96f95b59db46d6f56c4286897971827b4e928910760f9df47d445ca39
SSDEEP 24576:3/kc7vpWcVYFzBzhJsHf0xOL0nsfr1ALiDvQrTcvjS+HaftF:P7CFzBzhJsGsfrhvQrTc18
TLSH
T1D1556B2463E88615D7BB82BFD1938122D6F590531362C6CF8405EE6D2FD77C3AB72262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsBase.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\WindowsBase.dll
Size 2.1MB
SHA256 09e57985154139bc0c3b50b9de5a57078864199874479bbef87929bec5e82401
MD5 20076ad88bb34179e6ca88c23716ff25
SHA1 ce410c8b226a7eeb3f8d8549de8257fa551deb5b
SHA512 d3f51c437542151ae752d92985706ae188dfae1dba4ff8a9799ff59731e8c07ec4f3921509a01d886b02e00b39d1e5a5b236e94b3a046c6e7a77193a73019680
SSDEEP 24576:hSfXf1vpCb8ZvoX9OPIA9wxc/rYd1/Yph4R+uyhapRSvM9:h8fvCAeOPIowxMWmh1uyAci
TLSH
T113A55A2473D84726CD7A82B9A6739112E677F457031ACBCF1809C62D2F97BC087762B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\clrjit.dll
Size 2.0MB
SHA256 18fe968846117d13edf3262bcb305ca28f678742a3281f8b4228a44047966f79
MD5 20523aaef93c259bf3929d187db592a1
SHA1 167a37a4b84df90364db6646f8fa0563df572d05
SHA512 7edeb6446b7c207191f5bf1a19ff3d647de911cefff98e37845107b8341d0da92a38a1175aa6d8f997ccd09eb71fa6c4ec8fd3d556cb5e9dbfe60ef72046f3ab
SSDEEP 49152:k1NyfVyKIaKUnctJfilvld1oZgpdZTctkQLFbD/Mq+Nyupy1wmp/Ky7f5hwbq:kx2nctJfGvld1oZGdZQtkQLdD0q9upyZ
TLSH
T17CA5AE47A2B900FCD46F9274C6274A07EBB2B80527719FDF03F04A556F23BA2296E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\coreclr.dll
Size 4.4MB
SHA256 85135fcf132fae2c3e03d3480dfbb51f910e78e8a6c35ffa367ea33b243216d7
MD5 9db0fbaf52c9fdceb59b2b1be0dfd76e
SHA1 d972628c8db3a131de08bd3b076a02765895f614
SHA512 67d10ea09298ca34978312dfb83f12bb1bed74e8affe35d6f5e29a321c6415f5c757f4aa4335a65cf7dc894c22fd7eaf832d2277d65eee1923c93288891c55ee
SSDEEP 49152:sOyyR7TkLEH6ut8PjdCRxKe2b7b7b7b7br7b7b7b7b7/IqnAXYIxmRL3zeE24QIF:tyyJRvcO0qQzX0T1Ur
TLSH
T156268E25F6AD01DCC4BAD178C6E74A1BFBB238591338DBEB026146651F237E16A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\hostfxr.dll
Size 370KB
SHA256 dec56b41cf09cfcae002a3bb752b0b381c68b6217ed9e4b41b1ac2b645b5fdc5
MD5 15210d3243249fe60b443ff678225af9
SHA1 26c75d046727c1d2d32e1e56c9f56d16b8adc0ae
SHA512 c2c043c1b872699a4f96ddca5548e6d1fad6f80b67d84112424fbdd37966398e0c6e76d797e33a47a6da9c1a00e10bc83988a83cb7d68ca9bb91e22ea00c39be
SSDEEP 6144:falRvjNggqbRqhaUzIS64W+zz3Z0UCVvfpJEl0FsGxilKmkVAwBA8/UMs2CUHFhr:f5q0iOnpq2TDdl9BqAR
TLSH
T162840816D3E8057CF0B79678DAB29942EB727C494BB0E5DF139088651E73BD08A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\PlatinumTogether\Launcher\2FF016DAA4B0-20514695\hostpolicy.dll
Size 369KB
SHA256 385c3c4cddab07e1763a1fb1f978c57e31bb0f478b30b4c535ca1a3db50d28db
MD5 15cf6a2c9195970e025dae32555327de
SHA1 3ada2fa09f6255f0f36f406f6559827b2000a944
SHA512 09ccad0029485307864c0b5b8b1a5d4c570d2eba6edb586892808a718c4165c1555fe1513fa510248243e5bceb668bdb2e934f6d66a1be322a09b70e3585b82c
SSDEEP 6144:fsQpbUUvKO93ss3JDpMBqyiNlCCxO7ptsuBNV3h3BjcZjKr9HLhLuxJb/JDtkwKB:fHFvK+H5Kcyi8JHpa2wKdMFwEs
TLSH
T11C842916D6EC007CF0B7E679CAB28901EB727C4947B196DF139099A61E73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1893f6ff-5b83-4035-af57-7e7e77c41978.tmp

Path C:\Users\Admin\Downloads\1893f6ff-5b83-4035-af57-7e7e77c41978.tmp
Size 40KB
SHA256 fade154869473207ad459931ce7f7587ba94f2b1f47abdd5367f680a9bf9c1b4
MD5 c92bb564769bb4b547e5315e53a80270
SHA1 af41189c052b54722132e1d7876c73049620d1dc
SHA512 d8c91489cc88a772ffb1fb0c18b4c83a819103860e992fe3a7311fbf6f3c759994bc4df85ca2ecd4fe95f6266d06c102e743d4976fe055e2557b8756bcf39fe5
SSDEEP 768:a4BefRSsvPXK7yC8a8mywxUQJYpSmJb4M6yb8e5rS7:jBeRzeUa8ilYpSyb4M6yb8eI7
TLSH
T1C513F80877FC822BE2FF6BBC68B021510B72F96BA635DBDD0DC5558E49A27108D50B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4396-348-0x000000001FD70000-0x000000001FD82000-memory.dmp

Download

memory/4396-330-0x0000000000300000-0x0000000000310000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads