darksiderat | ae44caeaaabec0b6e7cd71912965b4d62bf19f6f5035a8a1921a3e1f40b6e5e7

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
Size 24.4MB
Sample261024-144dbscx2t
SHA256 ae44caeaaabec0b6e7cd71912965b4d62bf19f6f5035a8a1921a3e1f40b6e5e7
MD5 0a5653aa03fbc82ed52714f5100fc857
SHA1 a4b6cbbce3870424609a1395bd06be0e4aa16e99
SHA512 109432159a86acde32b76cda31972bca5177b179c7e50b971184a0b7fcb65869e589143ca1d3c33c8d1d9a7c35121f6517354b000ca126217bbc486b16a9b633
SSDEEP 393216:gebscXjtKYZ2jqrk1Awo39/bIHcranFq9Ypbi0h0A9ov33cL7SFzMRxhkRbCpZ8Y:zscXphZKw599enUqpO023cPSNehk59Y
TLSH
T16E47334ABAF6D2D4CB424E907F8B45D435E1A28E81FE4A3A36CB5C017170D7A468ED73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution darksiderat spyware stealer trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 5 IoCs

resource	yara_rule
behavioral2/memory/5860-149-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1936-146-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5056-124-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1960-122-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1960-79-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe

Executes dropped EXE 12 IoCs

pid	Process
2708	ag_74c305d9.tmp
5076	ag_74c305d9.tmp
5604	ag_74c305d9.tmp
1960	ag_74c305d9.tmp
4224	ag_74c305d9.tmp
5056	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
3248	ag_74c305d9.tmp
1936	ag_74c305d9.tmp
4780	ag_74c305d9.tmp
4764	ag_74c305d9.tmp
5860	ag_74c305d9.tmp

Loads dropped DLL 27 IoCs

pid	Process
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp
4276	ag_74c305d9.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	discord.com
45	discord.com
55	discord.com
41	discord.com
42	discord.com

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 2708 set thread context of 5076	2708	ag_74c305d9.tmp	102
PID 2708 set thread context of 5604	2708	ag_74c305d9.tmp	103
PID 2708 set thread context of 1960	2708	ag_74c305d9.tmp	104
PID 2708 set thread context of 4224	2708	ag_74c305d9.tmp	105
PID 2708 set thread context of 5056	2708	ag_74c305d9.tmp	106
PID 4276 set thread context of 3248	4276	ag_74c305d9.tmp	111
PID 4276 set thread context of 1936	4276	ag_74c305d9.tmp	114
PID 4276 set thread context of 4780	4276	ag_74c305d9.tmp	113
PID 4276 set thread context of 4764	4276	ag_74c305d9.tmp	115
PID 4276 set thread context of 5860	4276	ag_74c305d9.tmp	112

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1989167767\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1989167767\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1963434601\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2612_617197209\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1961614331\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1545415394\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2027287596\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1545415394\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1961614331\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1963434601\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1545415394\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2098213550\_locales\sv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
908	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ag_74c305d9.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ag_74c305d9.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5908	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ag_74c305d9.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ag_74c305d9.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ag_74c305d9.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ag_74c305d9.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ag_74c305d9.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{5F6151EB-8A6B-4FD6-9316-3037E13E6E26}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{85EB03FC-2D92-48ED-B67C-9D51E03EFC24}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ag_74c305d9.tmp

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2612	2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe	91
PID 2148 wrote to memory of 908	2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe	92
PID 908 wrote to memory of 3032	908	cmd.exe	93
PID 2612 wrote to memory of 3156	2612	msedge.exe	94
PID 2612 wrote to memory of 568	2612	msedge.exe	95
PID 2612 wrote to memory of 5908	2612	msedge.exe	97
PID 2612 wrote to memory of 568	2612	msedge.exe	95
PID 2612 wrote to memory of 568	2612	msedge.exe	95
PID 2612 wrote to memory of 1540	2612	msedge.exe	99
PID 2612 wrote to memory of 1540	2612	msedge.exe	99
PID 2148 wrote to memory of 2708	2148	20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe	98
PID 2612 wrote to memory of 2316	2612	msedge.exe	100
PID 2612 wrote to memory of 4340	2612	msedge.exe	101
PID 2612 wrote to memory of 2316	2612	msedge.exe	100
PID 2612 wrote to memory of 2316	2612	msedge.exe	100
PID 2612 wrote to memory of 4340	2612	msedge.exe	101
PID 2612 wrote to memory of 4340	2612	msedge.exe	101
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5076	2708	ag_74c305d9.tmp	102
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2708 wrote to memory of 5604	2708	ag_74c305d9.tmp	103
PID 2612 wrote to memory of 5012	2612	msedge.exe	107
PID 2612 wrote to memory of 5012	2612	msedge.exe	107
PID 2612 wrote to memory of 5012	2612	msedge.exe	107
PID 2612 wrote to memory of 4184	2612	msedge.exe	108
PID 2612 wrote to memory of 4184	2612	msedge.exe	108
PID 2612 wrote to memory of 4184	2612	msedge.exe	108
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 1960	2708	ag_74c305d9.tmp	104
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 4224	2708	ag_74c305d9.tmp	105
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 5056	2708	ag_74c305d9.tmp	106
PID 2708 wrote to memory of 4276	2708	ag_74c305d9.tmp	109
PID 2612 wrote to memory of 5984	2612	msedge.exe	110
PID 2612 wrote to memory of 5984	2612	msedge.exe	110
PID 4276 wrote to memory of 3248	4276	ag_74c305d9.tmp	111
PID 4276 wrote to memory of 3248	4276	ag_74c305d9.tmp	111
PID 4276 wrote to memory of 3248	4276	ag_74c305d9.tmp	111

C:\Users\Admin\AppData\Local\Temp\20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe
"C:\Users\Admin\AppData\Local\Temp\20261024-0027_00c3ff98ab3f033e525830c15fba8afe.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/wayking
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa4301c188,0x7ffa4301c194,0x7ffa4301c1a0
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,9717879835681447066,13418228588277864481,262144 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,7796886404774082204,17969174367281537207,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,13293658341132842113,17693799960372291141,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,5162161051276453258,16654696834117748303,2097152 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,3585941087780514505,8885554430710964536,2097152 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16381690739235427295,11683263460267034719,2097152 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,15889217905175922178,370812237131350851,2097152 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,10668777748269296935,12757136267303092163,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5420,i,7302856953361441920,11650618560248634638,2097152 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,16620598905102706877,1159598438703730967,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17785854677303978000,10826177059884836416,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,2609156778576347047,15773036413102631768,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,2609156778576347047,15773036413102631768,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,3420183397302259185,10306836586966262006,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:12
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12565470908303943648,12871969439471103159,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    - Modifies registry class
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,17219841130862179716,1894815786335838180,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4372417332101954602,2001488071054280570,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,3480313994368413288,14750915529377759771,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,1097762711907468546,9049398655546260369,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,1448687507176404533,13522947720366770028,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,2595284630065106563,9576621784781226804,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,16246493655713446098,9008146605568773331,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,10807970580645527658,9041687499747724747,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,9186742438863953668,8635168336945635157,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14564199571152374097,1140908306736989658,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7025013322332775600,4804543010328288692,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,8101577366126461588,8208928543427921126,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,9289965148166378670,15162270040085576792,262144 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9653614050437999382,9252797037385035066,524288 --field-trial-handle=2348,i,6340161427723432836,1549064897131204840,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:6284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=90 lines=30
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\mode.com
    mode con: cols=90 lines=30
    3⤵
    PID:3032
- C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
  "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
    3⤵
    - Executes dropped EXE
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
    3⤵
    - Executes dropped EXE
    PID:5604
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
    3⤵
    - Executes dropped EXE
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
    3⤵
    - Executes dropped EXE
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
    3⤵
    - Executes dropped EXE
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
      "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
      4⤵
      Executes dropped EXE
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
      "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
      4⤵
      Executes dropped EXE
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
      "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
      4⤵
      Executes dropped EXE
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
      "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
      4⤵
      Executes dropped EXE
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
      "C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp"
      4⤵
      Executes dropped EXE
      PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3b403abd-2054-4c1b-b5c6-c899ee99bd1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b403abd-2054-4c1b-b5c6-c899ee99bd1e.tmp
Size 34KB
SHA256 fdfaf948b3d00afe63d1380dad51e34d39cf9004aa85734717016e38b6b08ad5
MD5 9a80ba4cae1386a4b574c21a7657a424
SHA1 4ba1ce2b23cfbbb87b9a881712b0f498e886e062
SHA512 e6703874e0a6959e14e832892ba6c53b869b2b30e1e8c01c868da1dfcb1213765b72b02d3e3521e5088a443f5303bf77d173247476cb29fcca18002e56173da2
SSDEEP 384:nVQkUSvH38NyAqduhBW9/nfydX63i7Mqt/ErgYg57HD8CJGZXhJqlX/XBdm/e5xS:vH3WBqK3BtgE57Y0GZxJsXBdK8ZI6KLV
TLSH
T159F2B030A8A19D638DBBD391724A76C3EEB452B3C9C44F58DADA9B0C01C719E174791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

1b0bb8ed-3faa-43de-a6b0-51049c89e95f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b0bb8ed-3faa-43de-a6b0-51049c89e95f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6e4a1991-41a5-4c77-ac00-89b2338fa1b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e4a1991-41a5-4c77-ac00-89b2338fa1b1.tmp
Size 11KB
SHA256 61e2c619b4cd81df07b6341f49cd79b1522797edec7abeba950daf871dc9d98c
MD5 424569ff48c6f100fae8f6ffdd36d14d
SHA1 0820f54cc90bcb2d53f3e1d6b0594cd54ee1ed02
SHA512 2cef3b72e2993e6c5aa0ebd6e2c54e3a8283ab898a48ba1b8dc970070ba121a6362789e984eb1db0c0f8d2a20f465f38dc061eeac917df900cc003b5e2ca0062
SSDEEP 192:sxRhR3kCH/fcsrPVCvzoA8pi/g6+WNIYU213RWGeyIgVQJ:sxRh1zH/fcsroGi/5IdSS
TLSH
T17732A755AE28A93B8CCBD21DFB597F53D6F96033A0D12A54E6FC861C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77d37fef-27b5-42b8-a37e-c7722dd15894.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77d37fef-27b5-42b8-a37e-c7722dd15894.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 e31d024d8d6d23f70e43f86b59be1d6b9fb275f60cee831f5f25e711c4168ef0
MD5 9ceccc9d6898b43bb9b3c481a380291c
SHA1 ec8ebc1874615d2009350c9e7c91f9f76d362c80
SHA512 3cf4948e87aa9516992935908d4d89deeea722833fb608f8eaa66bbc225b0d370b69f0e3c84449dede4c0ff89ad05473e4d462c88c08e70e2bf30528da23ff5f
SSDEEP 96:wNP8YNPNkhPxAuWUgaDX2/4LxPqSyTyuQhZZT2pjE5cV/dnoCtFGyONx8FdddmU9:S89DxZZydlhblClABK5yoocqoQ
TLSH
T11712B34183A00761FF6F0DB446F21D6236310676E8F31F9151A5DDBEEA8AB53B4C3469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 a3622f968f25af46640da1088f3ee9f2b99248588c162ded352d89cd38f62dbb
MD5 15fff2b3a33b7d0d3df85c237da8e20a
SHA1 c6e085ba6705d6422d6f7288e365789e36ae58e4
SHA512 fb61e16a2ad735f55a7985ca21d8b61e936ca6d28836c1ba4ebb7271031d3db437eac24eb1e1ee9bcbdd98313c4cbc3771125855f9c1a011c9f29e2c2527674b
TLSH
T1C251D68241B18582FFBB0CB88BF10C87393446A1DCB31F1171A9D5B8B64E36750C447A
MD5 SHA1 SHA512 TLSH

Submit Download

e761efac-966e-4638-ae3d-0acca9f441c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e761efac-966e-4638-ae3d-0acca9f441c4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

080bb186-b9e2-4904-a3fa-132f6b39abf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\080bb186-b9e2-4904-a3fa-132f6b39abf1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7c340764-2703-48f3-b5ef-ef79e05c3b03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c340764-2703-48f3-b5ef-ef79e05c3b03.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d28ac082-fd9b-40a8-a5cf-34a734546dd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d28ac082-fd9b-40a8-a5cf-34a734546dd1.tmp
Size 3KB
SHA256 1e8318abd4532c4713a359ef0802eca94e6ded83ce413c061163e61203598609
MD5 2c5f27221a89474c05ede59bda29fb15
SHA1 67c430ccca687860d399732a0085f3adccafd037
SHA512 0d94ba3846eec05b49bf5727a32003f62a8af5a569af73f7f44688a22bc1846d9c2267c0638a5f97dd3e14e01ce2e502837e1041b7a24cb3d449918db3f8f8a2
TLSH
T19151BFF387F8866DCA0196F0AA187E1FCE1D0914432C7D6AC4E49E5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 567562b38cc788318488c310238c24494e9be8a0312a15ea1893165d9e7c98bf
MD5 f2f432276e8a9b7cf5d239a1c6b2483a
SHA1 2ddcfc2bc84118c8a6e56c7db29f90dee1ccb33f
SHA512 1c612dcfd71f2d0491f8966c77221d19da9aae6b992836e84b340834bf5cbb1e1f6e3fb925b0fae0792b68ec0954bbba164113a3d28192a9c5b63862bb35da73
SSDEEP 768:6Jaj2+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaomBvrozufW:6Jaj2+Eb/KWgm0fbbu1jadhB86e
TLSH
T182C2CA7B740CCB7F4F900ADD99197E9B6D6802CB9698CD8047FE941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 d1e8105d1bcad2dc28fa6e9157e58545f89bc3125de6dc98854ca6137b0dae3e
MD5 37c0721c39c948972d67618e9d64b655
SHA1 2148c8052eb35b0c5a6cab3b2fce7e5e1484001b
SHA512 77845579778dff7faa61459566ea98e46160b477e00efcf53beacf92f9adb07c3d1e69ac0b4658b7afcc1d8534ffc27b61cad08899021e0e8c69569127fd05b2
TLSH
T132C02B73E15E0200872403618233052C47302CCC19C6CC5C7007B4341038F3B3102FD3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 a2282ef3cbc4df6d78ef94f7eb12e782ad6aad43d69a0f6b06463e16482a4c82
MD5 49560b50548b03f32b0927281b06b1e7
SHA1 8f82bdd9a39255ba48b96d61cda347bbad6a30a8
SHA512 b7d463b3e34ab1aaf3a7058d5a983f20b92cd47eb31c61e8e29405704a6afa1b0dae2052f67a82807292dfe753c45ef3869a51c2238d6085d25b589b95a03c63
TLSH
T107D0A72BD12A1140E7BE4B716562153946302C8C65DA9948A40504358448BE7B642E9B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 4812976aae7976596b151346a13794bda9728460fbae2ba303cbf610ef92ed58
MD5 a4cf095be69de645e0b021070067f28c
SHA1 22a26e1c7adb8126f3adfe7c7e6af40b68625155
SHA512 29dd32f0156b1be410418084f622aae26b0c16783614c6b6bafc1276dcd401c2138c093f959d85da62bb7cc1f90f551626d6b3d39580afb89efa4538015936db
TLSH
T1FAD0A72BD12B1040E7764672B572157A46312CCC599A9948E40634398478BD7B612E9B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3801d5ea7650bdfb523a7985b80f9b0d8a8dfd349d8075a855d0167803eff37f
MD5 7c822f92625c31731d6e39fb5dc5eddc
SHA1 7495110105f5313253dc9c0d3f0e9c08f2c522dd
SHA512 d1d0f3ecc22dad49d68e75f01332c11d72ba676f24ba874e4ef189f4bfe1fdcd18646ade47b5e1f889dec4e2492ef3d84c76a311ca7441807c51a7bce6248e8b
SSDEEP 48:K+1qZlbnzkDnAPIAdkKBB5TkNF06gbF5yxGIXKLKArLIJKUQkHylZIr:KEKYKDySCGcKLKYLeKUQG2Z8
TLSH
T104A12D21303B46113DBD7A0C91E4A76B5B8271623028E76B7FE951E64A6FE140DFC4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b77f5c8a-da07-43a0-8561-27e9ae0dda84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b77f5c8a-da07-43a0-8561-27e9ae0dda84.tmp
Size 12KB
SHA256 474570b2c2df1050b141339d8260054107f91bbb08d0e134daa9df4d8f803ae8
MD5 522d4f6fd2dd05fc1e7d415dc6f9aab1
SHA1 f10c8d4010e1655b6808467437f848fadb428de2
SHA512 797f8f72d2a258db1587e3d12b869a7187efff7f431304d15c84667731126289d475ebe7c8c77fa97b9565577d7bea336d3b6616f79657eb1c76264007322de7
SSDEEP 192:sxRiR3kCH/fcskPZRdtExvzoA8plN/g6+WNpzA/YU2sCQCreWGewIgDKaHJ:sxRi1zH/fcskRztExG3/5e/aM/p
TLSH
T10342B815AD24A93B8CCBD21DBB557F53D6F9607264D12E44E6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df419312-cdb7-4bc7-9922-3885a5168692.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df419312-cdb7-4bc7-9922-3885a5168692.tmp
Size 12KB
SHA256 62477a125c4d46c47454e0afc7a6097628c357409cb3c3fac08af3ca89798186
MD5 51d12cbd43183b8890e5fa567e8984ee
SHA1 b7fdbab144d02af32906759211e2710741dc2868
SHA512 7dbc89f1cb64f6825edcf2dd4c53585ed4c10380dcd4df0b6a009495d682d887099a312cb43c990ec1a7779a48c6b7a5a9ecd5a24b5736021af52ee6702b8111
SSDEEP 192:sxRiR3kCH/fcsdPZRdtExvzoA8plN/g6+WNpzA/YU2sfC1eWGewIgDoaHJ:sxRi1zH/fcsdRztExG3/5e/+Mhp
TLSH
T16642C715AE74A93B8CCBD21DBB597F53D6F92072A4D12E44E6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c28f8349-6ce1-4ba4-ad24-2714378a4937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c28f8349-6ce1-4ba4-ad24-2714378a4937.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a0944b48498402fdf396e96fbf25402ef6df09c5f64371886dec084254066ec9
MD5 aa0697426d7f1bc041968983584bbdea
SHA1 4888b8e69cd5e6e42d27ed5de1433e15142dcf0a
SHA512 82662533036b597166a986fa89ec01da637d6108abe0b51d137f46ae5ebbc285d9385496c86f46cc5161759f3607a808e5b77eed0ae2679588351146fbec9ce1
SSDEEP 768:A/UxvxjgC+I3cwK3SE57Y0GZxJsXBdK8lMSHUPpMs:tZj3+I3m70/JsXf7mSfs
TLSH
T1CD03B034E8A09D775DF7D390360A7397EEF446B3C5C55EA48AED6B0D028B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c13bd313-479c-425c-b9fc-9b313f971ad6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c13bd313-479c-425c-b9fc-9b313f971ad6.tmp
Size 38KB
SHA256 59afb8ec58aeb7d8c9040d75c27cd43e6d6a0f1e8c58415a0de4ae3bbeb4b479
MD5 0893df4e4083573429eab017fd4dc71e
SHA1 8d4d07c2806beb2d391c0e0a358bfe2594f9bb11
SHA512 b5ec0b85584d5f9963948e6e08258d0cf69fedaad40c5366b01cb225a973e76ebb8bd3a26265d0fa7f90309a6529799bd242738124f8c7929ebc2918fdb6de59
SSDEEP 768:y/UxvxjgC+I3Lt0K3BtzE57Y0GZxJsXBdK8EISHUPpMs:3Zj3+I3W70/JsXf7JSfs
TLSH
T1BA03B034E8619D6359F7E2A0364A73D7EEF415F3C8C14EA49AEA9B0D018729D130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49a3f510-b5e8-4ff5-a1da-3ad73e88ec9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\49a3f510-b5e8-4ff5-a1da-3ad73e88ec9b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

83a80d64-2a78-4310-9947-78a7f814c194.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\83a80d64-2a78-4310-9947-78a7f814c194.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

94fdc81c-33d0-448c-9cb0-e350c3b9d860.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\94fdc81c-33d0-448c-9cb0-e350c3b9d860.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

db155f66-5ff7-4e7a-ade8-3524c04adfd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\db155f66-5ff7-4e7a-ade8-3524c04adfd7.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

e7b79fe7-6bee-4d6d-a5f2-c18b625f28c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7b79fe7-6bee-4d6d-a5f2-c18b625f28c6.tmp
Size 37KB
SHA256 6d7cd898371f594a9862c50c74e8193ff219147e2308eea2d0545491f370df7d
MD5 b7905836f95fad3f5d053428321e584c
SHA1 2b0c448792cb71aeb02111107238be149879ce7d
SHA512 4cac43d38282181bfdebb2d5efbc4383ae8ba89eb885cfd369ce564752f2224c9d92275c61672842d015e14d9e0a5ab19bb3ef59c2fdb8a404896aa84302495b
SSDEEP 768:YFst3FwgwBkUBtyE57Y0GZxJsXBdK8ZI6KLV:Tt3A70/JsXf76Bx
TLSH
T1B9038C34D890DE27ADE79791B7097687EEE011A3C9888EE4DACA5E4C00C71DE174BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83813dd1-344b-4399-9fcb-5d4e2088ba17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83813dd1-344b-4399-9fcb-5d4e2088ba17.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8eafa025-9030-4a8b-9f4b-243285b8b20f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8eafa025-9030-4a8b-9f4b-243285b8b20f.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f23f1c6b-e6d5-4107-b4ee-e5f61b642d2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f23f1c6b-e6d5-4107-b4ee-e5f61b642d2d.tmp
Size 38KB
SHA256 7b7442a3c4dd8e60c74c82419f4caec044961cecc253154b3e058017f0f5ea26
MD5 8a8d26f2aa913f2935754873d31577a7
SHA1 165e01ab66464a6eb23692ff0a419e39fdf88372
SHA512 1771e9bf4f21347bf3939bee633c6027b7cf60f75de65d0428567b302838d29c572ff1d260b93163ecfae604932dd32fa99b01829e4c4eb78e7107c9631b875b
SSDEEP 768:P/UxvxjgC+I3w5qK3BtgE57Y0GZxJsXBdK8ZIoVG:iZj3+I3w70/JsXf76oVG
TLSH
T10D03C030A8A1AD2359F7E350360A77D7EEB415F3C8C54E68C9EA9F0D058729D170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f43b4d74-a77b-48a8-96f0-5c3cc919cb45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f43b4d74-a77b-48a8-96f0-5c3cc919cb45.tmp
Size 34KB
SHA256 0ec0416880e8d3f00713057675229864ee3de7b90e34e297225f44028f116926
MD5 a80329d7335cd94e1f160fe455402837
SHA1 364dbe3bd8ce70778d1edd4e1a06871c87203ac0
SHA512 70ff915c259ed0db77c971d5573637b2b244018e436367369152db0425e583d3172cc6072c276cf245e825d6cadadde97b216d37e910b44e025e1e89c18de00d
SSDEEP 384:npQkUSvH38Ny5qduh5W9/nfydX63i7Mqt/ErgYg57HD8CJGZXhJqlX/XBdm/e5xS:LH3n5qK3BtgE57Y0GZxJsXBdK8ZI6KLV
TLSH
T1EAF2BF30A8A19E634DBBD390724A76C3EEB452B3C9C44F58DADB9B0C01C719E174791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99ef4e0d-4f2f-4d52-8da6-6686f44d13ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\99ef4e0d-4f2f-4d52-8da6-6686f44d13ba.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_20261024.txt

Path C:\Users\Admin\AppData\Local\Temp\TokenCollector\log_20261024.txt
Size 262B
SHA256 ae323e4469fd0206d6779d1773de0936cb0716ea1f88f80d9fad64232ce6440c
MD5 06cf4cd6b13cec344ad7ca3d6b57fc9d
SHA1 af0b9661801daa68b6c3f7ea3bd7aed45a82b442
SHA512 b1acc7db01026fe4d0d98d8bfd723645b80fd6a2aeac5543a59613e8f81b2e99516b0207aa6f51e0dd1bbb6a8f12888daee3c77aba9d3b6fbf772b460804e1ab
TLSH
T1E4D05E4A0479807AAE4281746488BFB0CBA9B5708124899C9B0CD7946C6CC3D0BAF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

ag_74c305d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\ag_74c305d9.tmp
Size 10.2MB
SHA256 7d83419e25e6008b0694c1ef901ad03ed2c959a676d7a54bd6c240e346874ab2
MD5 641e906d209c8934b38fc22b097a41a5
SHA1 9d3926b105f05a5d61f54e1241cbc848be346ed8
SHA512 dae8514a4feaf3a746a61b614260d3dce652ff9871e982217fb8cad025f12e3e988df2d3df0d6dcf624487c717660bcc38d3b0b381fa6c39cf18c85f865e2c30
SSDEEP 196608:dZk/xGBDRmv61X2chhH9pCHNeCGUyBtzT8DD0JqJimWZJyqF:dy/xG9Mv6B28fofyTIAVnuq
TLSH
T1ACB63359FF9201EDC5BF51B8F8A424B3A3A1B96502D0C7EB06CCE1839E715D96E1AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b726c0e9-18f9-4865-94ea-e3fa9e8b13ff.tmp

Path C:\Users\Admin\AppData\Local\Temp\b726c0e9-18f9-4865-94ea-e3fa9e8b13ff.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_ctypes.pyd
Size 139KB
SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
MD5 659510afbc97992af071a0e2a75545ef
SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
TLSH
T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_hashlib.pyd
Size 67KB
SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
MD5 3fbad145af85337e0c05dbc5ae6c0b4c
SHA1 fff5ebc3b2f044fbf024605f02a37554fded3b17
SHA512 aeaf32f2c73da687bb847bb89daf80119d5f2927b439330cb92158180b2fb48013be449228ff40d0be5833cfba3b599265cf9ee84b066f6bff9443bb9005bd65
SSDEEP 1536:OXwAzOYBQc17JKRQ+C5cIpDILyPs5i9nfIbHHnM:AJ/tJKRQ+IcIpDIJTs
TLSH
T11C635A86A6984092DA2382B5C9E34F43F974F2522B0197DF6678C18E2F233C3577B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_socket.pyd
Size 85KB
SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
MD5 8e833fd16c777682dd1bb099d06390d9
SHA1 3f455b62cd6bae8f74266d371959298d70412016
SHA512 1e7d20c0ff2964f718e8387b9a74df0dd89569e2b5a817503a85e3828ddfd29d90bd6bccd7021ef574467ed72dcb8d957d13bb3039ce44ad5a06f17142643866
SSDEEP 1536:2cVuncT0XH3XAJtZypxQ7XP+66wSzj/jAjI/Lb6UaQecs8PgMrAIpGwfyPs5i9zs:vEny2+jypxQ7XPz6wSzj/jAjQLaQnsV2
TLSH
T1E3835B01A66040FAEB72C172C2639E63FBB4B5C012D4A75F1466D55A1F333D2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_sqlite3.pyd
Size 129KB
SHA256 ec9694e5929747e93e05bc32427d24350dc4de5074b61a37bc961c3048794a67
MD5 f08ebd6bdb9f70ab4df68e8dded175a9
SHA1 9ac163c380c3dc36bf5058b8b9f847f969ea6f91
SHA512 3db6e962ff3b6dd877d3945b5187665040bb75292425d8357bf08850d34689024cd774c4a1286b6e8744069d197a0879017d8edfe741a8c881b968603535f924
SSDEEP 3072:ruY2i95CzyzpKnNp8cB756uU+rSw1laEUcIpDQ28P:ruY2qzUoS59UQ1EEUnC
TLSH
T111D37B6B231800A6E9A782B8C5735A43EBB5F461573053DF11A0C54A1F373D36F3AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_ssl.pyd
Size 186KB
SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
MD5 35cadc41cfff6464baf8d07c87daf4ec
SHA1 c497ccd0d26491530eb91bd4c671d74a4fcc936b
SHA512 3d714563a2b5cf20f7cab6f9095dfaf845cdbafc0ddd29332005a9a20136e3602c6bcc0f3eb36945afe60327acf7351168168f6e15f875ee083e63edf33ed0e6
SSDEEP 3072:MVpZeIk2MZ7IifjvQtY7qr66Xrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrUIe:2xk2MZZjvQttX4457qTVMr6
TLSH
T139147C47B5442AF7DC02E8BAC6234543FBB4F045731197DE48D6EA620F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_wmi.pyd
Size 39KB
SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
MD5 b656a1c0ebf27c1ecde2a3ddf5a952fa
SHA1 101242914a676177c994454c6337126b25117eab
SHA512 71aa2a253f5ae6c6af1af695e6f3b1e403bc870d80b8940ae70ead12fc9023f2c9aceff22ac8b43403314604f93b3d5edd4e790a95d72a7e6190e666049df8be
SSDEEP 768:R2/EEqrVmjsnuUOQMVUIp3iSyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:sE9BEhUOQMVUIp3iSyPs5i9FfIYEq
TLSH
T1F4037D89A6784092EA67C674C0A5DE83F675B7D36711838F326582990F333D1DB3A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ag.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\ag.dll
Size 11.7MB
SHA256 48a7483b663a4c0a8a740e22ce80a4aef5856568e2f646e45b069c4e48832e98
MD5 e2adb9aaf7a7f4e9de085bd061c83b32
SHA1 f475d08fd2ad2ad644e9c0f5c7d3ce6fd3b55ea3
SHA512 e931382987747aee9a973c14b7a9f60bb80d322bcd17958a0a81a864147ab773ca7d38bfaf7572c2ef610e600e78bb53b7bf9297e8e7b70d250f2dc4102675ba
SSDEEP 98304:qTrkZ94NVHx67/YLCp5K7MCpz/TvVqj1DSE1E2uvXeCow0uT6y1/AUktm7E60T9j:qUZ2Q/YLCp5KPjTvEj1Xt760T9j
TLSH
T15DC65A5562A80423EDD5F67C3E6B968BEB31E406B311C3C3A02E48AE7F876645F7614C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\pywintypes314.dll
Size 133KB
SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
MD5 c11818bd607c6060902836c3f6bf024a
SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
TLSH
T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\sqlite3.dll
Size 1.5MB
SHA256 9a8fb79d6b7e581d127314028dcecf754b8d7fe4aca1247f82c1f33ee8fccc7e
MD5 2150377ab51d54d827922e1dd6c5276f
SHA1 a861036ea980f58ae0ab377f282626d156fdd857
SHA512 2fd30b24f396108485e38436ebd376372cb2ba879277d19880d95ca045c9121efd5e55095d535881e464eb7724782271a948809c9a0cad5dc6bfdd4313f6db5c
SSDEEP 24576:3DKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fZX3h:z8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fP
TLSH
T16B759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7DF1590CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\vcruntime140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\vcruntime140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_266164_w5bsGtpZMvE\win32crypt.pyd
Size 123KB
SHA256 1144670ad8271e4d477167bcb55b8ec38e8ad9f02c6fbfe66024e67083da2131
MD5 bef94c55e5f2b9c742467469abdbb089
SHA1 720fc0e2954fea3822144ca97303c6d60eb64133
SHA512 07644f2a5f9b6ae3fed2c55366aba74f5f3961d3deb1316139a1300df7229ae0d2be543b8100cc07cb8ba530c62d44a8e5c5b702641e63da4366eb946bb71799
SSDEEP 3072:+sFWiORseWQgjXefpRoh+MNO3xhxRXvxh+Pal:+0W9SQg0okRfxh+A
TLSH
T10EC33A1332964DD6E9AAD3BDC8239807E7A4B0154721ABCF0950C6DA0F67BE06D3E749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2612_1226130643\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2612_631395870\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1545415394\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1961614331\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1963434601\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_1989167767\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2612_2027287596\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 1ae8dc2eee8dc516ea59c8ee5454bcfbfb00f6e09a213cc659cbd024b07dc1e8
MD5 208c14142edce5ab4067120c5eb89219
SHA1 13a3a85e5f0f257fe8710bd33a5007d9431112b9
SHA512 629a56f95947496c824e8ed827a5b3978a4f4ea0061e5d33fb151081ef42429cf5ed0eeb68c843221be852337b6c6c057d8b15b609aa0b503dbee8bb195e7189
TLSH
T13B2100260649915D22B341D5081DB42FA31FC4EF0E3B8D8D3F8E450F7BA2A1C532374A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1936-146-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1960-79-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1960-122-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2148-7-0x00007FFA5F040000-0x00007FFA5F042000-memory.dmp

Download

memory/2148-6-0x00007FFA5F030000-0x00007FFA5F032000-memory.dmp

Download

memory/2148-0-0x00007FFA61AB0000-0x00007FFA61AB2000-memory.dmp

Download

memory/2148-739-0x00007FF72D8B7000-0x00007FF72EBE5000-memory.dmp

Download

memory/2148-1-0x00007FFA61AC0000-0x00007FFA61AC2000-memory.dmp

Download

memory/2148-2-0x00007FF72D8B7000-0x00007FF72EBE5000-memory.dmp

Download

memory/2148-3-0x00007FFA61AD0000-0x00007FFA61AD2000-memory.dmp

Download

memory/2148-950-0x00007FF72D8A0000-0x00007FF73045A000-memory.dmp

Download

memory/2148-4-0x00007FFA61640000-0x00007FFA61642000-memory.dmp

Download

memory/2148-5-0x00007FFA61650000-0x00007FFA61652000-memory.dmp

Download

memory/2148-8-0x00007FF72D8A0000-0x00007FF73045A000-memory.dmp

Download

memory/2708-49-0x0000000140000000-0x0000000140A89000-memory.dmp

Download

memory/2708-637-0x0000000140000000-0x0000000140A89000-memory.dmp

Download

memory/3248-145-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4224-123-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4276-612-0x0000000140000000-0x0000000140A89000-memory.dmp

Download

memory/4276-128-0x0000000140000000-0x0000000140A89000-memory.dmp

Download

memory/4764-148-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4780-147-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5056-124-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5076-65-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5076-67-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5604-112-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5860-149-0x0000000140000000-0x0000000140015000-memory.dmp

Download