hxxps://github[.]com/TheRandomDev00/SpiralAAMacroFree/releases/tag/v0[.]14[.]0

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/TheRandomDev00/SpiralAAMacroFree/releases/tag/v0.14.0
Sample261102-d3547sst5j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5080	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AA Spiral Free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AA Spiral Free.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{1373CF2E-7E9C-4C4F-82AD-DE79CEBE33C4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2124	AA Spiral Free.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3328	QtWebEngineProcess.exe
3752	msedge.exe
3752	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	AA Spiral Free.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe
Token: SeShutdownPrivilege	2124	AA Spiral Free.exe
Token: SeCreatePagefilePrivilege	2124	AA Spiral Free.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2124	AA Spiral Free.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3820	8	msedge.exe	85
PID 8 wrote to memory of 5080	8	msedge.exe	86
PID 8 wrote to memory of 4680	8	msedge.exe	87
PID 8 wrote to memory of 4680	8	msedge.exe	87
PID 8 wrote to memory of 4680	8	msedge.exe	87
PID 8 wrote to memory of 4468	8	msedge.exe	89
PID 8 wrote to memory of 4468	8	msedge.exe	89
PID 8 wrote to memory of 1964	8	msedge.exe	90
PID 8 wrote to memory of 556	8	msedge.exe	91
PID 8 wrote to memory of 1964	8	msedge.exe	90
PID 8 wrote to memory of 1964	8	msedge.exe	90
PID 8 wrote to memory of 556	8	msedge.exe	91
PID 8 wrote to memory of 556	8	msedge.exe	91
PID 8 wrote to memory of 1252	8	msedge.exe	92
PID 8 wrote to memory of 1252	8	msedge.exe	92
PID 8 wrote to memory of 1252	8	msedge.exe	92
PID 8 wrote to memory of 1580	8	msedge.exe	93
PID 8 wrote to memory of 1580	8	msedge.exe	93
PID 8 wrote to memory of 1580	8	msedge.exe	93
PID 8 wrote to memory of 3804	8	msedge.exe	97
PID 8 wrote to memory of 1828	8	msedge.exe	98
PID 8 wrote to memory of 3804	8	msedge.exe	97
PID 8 wrote to memory of 1828	8	msedge.exe	98
PID 8 wrote to memory of 456	8	msedge.exe	100
PID 8 wrote to memory of 2772	8	msedge.exe	105
PID 8 wrote to memory of 740	8	msedge.exe	106
PID 8 wrote to memory of 2772	8	msedge.exe	105
PID 8 wrote to memory of 2772	8	msedge.exe	105
PID 8 wrote to memory of 740	8	msedge.exe	106
PID 8 wrote to memory of 3096	8	msedge.exe	110
PID 8 wrote to memory of 1748	8	msedge.exe	111
PID 8 wrote to memory of 1772	8	msedge.exe	115
PID 8 wrote to memory of 1064	8	msedge.exe	114
PID 8 wrote to memory of 3472	8	msedge.exe	118
PID 8 wrote to memory of 3472	8	msedge.exe	118
PID 2124 wrote to memory of 3328	2124	AA Spiral Free.exe	121
PID 2124 wrote to memory of 3328	2124	AA Spiral Free.exe	121
PID 2124 wrote to memory of 3328	2124	AA Spiral Free.exe	121
PID 8 wrote to memory of 3028	8	msedge.exe	122
PID 8 wrote to memory of 3028	8	msedge.exe	122
PID 8 wrote to memory of 3752	8	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/TheRandomDev00/SpiralAAMacroFree/releases/tag/v0.14.0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa1b0ec188,0x7ffa1b0ec194,0x7ffa1b0ec1a0
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,17908757117513114141,15884934649317653425,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,18353892230575199800,2959412262480035021,262144 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,14399716275857071558,5882035429651303690,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7402765398377744246,11985691928319018340,2097152 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14164839599178045034,10396009898265206181,2097152 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,261958613305026838,9369766075064389658,2097152 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,4501841405386340709,17159825465725481863,2097152 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8884665687065009260,11544225656030216638,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7039140049063764444,2383205927723360114,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,14748372112844825572,15254558084660103725,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,14748372112844825572,15254558084660103725,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6400,i,2190851552404727158,1188663297656018438,2097152 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,7774310135014168391,1191777639500918483,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,5962068994169307691,5548068858093084330,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,10428519070880818766,2996153469940974330,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,9202086140079108863,2803458077603265802,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,10534862940921759846,15934901709181153153,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,361114525795153877,490333377247155751,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1544,i,9166915047214315968,7647614668965351428,524288 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5472,i,1196299577744635318,13221752188477005077,262144 --field-trial-handle=2252,i,13631426360800955442,15646718943230715804,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4032

C:\Users\Admin\Downloads\AA-Spiral-Free-14\AA Spiral Free-20261101-224503\AA Spiral Free.exe
"C:\Users\Admin\Downloads\AA-Spiral-Free-14\AA Spiral Free-20261101-224503\AA Spiral Free.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\DOWNLO~1\AA-SPI~1\AASPIR~1\QtWebEngineProcess.exe
  "C:\Users\Admin\DOWNLO~1\AA-SPI~1\AASPIR~1\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:lV --webengine-locales-path="C:\Users\Admin\DOWNLO~1\AA-SPI~1\AASPIR~1\PySide6\translations\qtwebengine_locales" --webengine-resources-path="C:\Users\Admin\DOWNLO~1\AA-SPI~1\AASPIR~1" --disable-speech-api --touch-events=auto --disable-blink-features=EyeDropperAPI,WebOTP,DocumentPictureInPictureAPI --video-capture-use-gpu-memory-buffer --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --field-trial-handle=4628,i,3532144465155301222,2003528226293948149,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,WebOTP,WebPayments,WebUSB,kSanitizeOriginalUrlDuringNavigation --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0dc62b48-d46c-4cad-b2d6-33d1f5c56d16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0dc62b48-d46c-4cad-b2d6-33d1f5c56d16.tmp
Size 26KB
SHA256 ed494c20a5ce79670baddcc6014198fc40f33c4fe4e77b59aad2fdf525c6eab5
MD5 a8fdbc523ba5de6706a9071a1d259d41
SHA1 ec3e43dacfb80c94ac516a7b9fb7d998760c3cf8
SHA512 bad44a3aca11f98eaa2eb19acff0f0af906f7d8c2dbe2e0f4a6371dc334718a9074372ccebf29b957fef0b63fc03fafa28df7758fedfe014b55e7b9c691191f9
SSDEEP 384:3OiFJQkUSvChsNj8TUNTUlIl2z9U5Kf2qBGYX5EKKO/v/277H7vBEJRIIlN:3lFrYOwg+ae2EGYuKKOv2HH75EJRLf
TLSH
T1FFC23BF248E7983AD9AE9753A33D2D039EBCC057F5846A90F788591CCC861BFD34A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33d0f5cf-957a-4517-842a-28cfebb267e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33d0f5cf-957a-4517-842a-28cfebb267e4.tmp
Size 8KB
SHA256 17d509d6592f00ef6bee70e8c28e54ee44e561a1d50596d837374635fe6b9ee4
MD5 f948a8b14563e64e07b05e05f617e07a
SHA1 4e1cb26570820457984a75c2b22bca39afaa4424
SHA512 442967ba0122a208eca06e9c794bb785853321b4ff0c4298d6bd3ba8b2e67653b1fa4bcdc6d28ff2369f2fee77cebcba73346529af5131d1a4def377b1e1b309
SSDEEP 192:LJONrh6DphmqQmiUyGyq8wGYX59ezDCIRY6Kkk7clU6:lONrh619MRwGYX5EKKE4U6
TLSH
T1CB02EA35E8B87C7B9DE3AE45B4872A135FD8112FAA916F94D6E81E1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68f5cc67-2973-4200-8ef9-be283af246ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68f5cc67-2973-4200-8ef9-be283af246ae.tmp
Size 18KB
SHA256 7bb50888e302c67890381f4fc2c0b649a5286c34aab0b145e229157a7a4450a7
MD5 18e0fc2b8588d6884b28f277aed34439
SHA1 7fc3c8a0ba0bd2eeeb09a07a377f14229427fb8d
SHA512 17bd03dcc3c13ed5980b6428b79336e8f45f0eafaa9c1d92f1051e7aa080f8fbe2441225058e5a7ee5f631ffbc4a22c578996ff4e211a84852ea4a7b53675fc8
SSDEEP 384:oSQkUSv0sNRdz9U55j2qBGYX5EKKO/vF277H7vBEJRIIlN:oK0san2EGYuKKO12HH75EJRLf
TLSH
T12E827E32A8B46C7B59B3A550F14A3A039FB4952BDBD46F90D5DD5B1C00CA2DC234FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

762e03e2-0395-4da1-a3bf-050b848cb61a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\762e03e2-0395-4da1-a3bf-050b848cb61a.tmp
Size 18KB
SHA256 2ac2e9d0e847ae93613b90d31ae89ece5845dfbea7830b9971c951867eea2d4f
MD5 d0ff12751d7e78fbc92adfa21edd538b
SHA1 e0a261c31c1c93047c40e51ce936b84419c3023b
SHA512 9e8115de70fd137c06ac331543439a9011006c02a5a057aa59e2684282324aaab678c43b09b70888f2a2069e472eb610e9d9be244f670fcaf0d8524b8115e5c6
SSDEEP 384:vSQkUSvesNRiz9U5Kj2qBGYX5EKKO/vF277H7vBEJRIIlN:vKeLaa2EGYuKKO12HH75EJRLf
TLSH
T19F827D31A8B96C7B59F3A550F14A3A039FB4952BDBC86F90D5DD5B1C00CA2DC234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84e57b66-fefc-40aa-8183-8d2b1ed80680.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84e57b66-fefc-40aa-8183-8d2b1ed80680.tmp
Size 8KB
SHA256 f3c09888b297472504e240390d9514e2216363e8cfddb9404c65478f89aefe28
MD5 c97e7ccde8a9cab382a6d9076f9fbcd5
SHA1 babd76093d4d52ba328ddf898a1ed625e0f82131
SHA512 54748dd331e7a93124e66b1d62488e4d0db1b38ce239f92204cca691792301200188fa41229b42a7848657696c46dc8bf3f2630f67766072c44db0281bb22e66
SSDEEP 192:RONc6DphTqQmiUy3y22wGYX59ezDCIRY6O/eeFMkIIKq5M77U6:RONc61wP22wGYX5EKKO/vN277U6
TLSH
T192120A35A8B8AC7B5DD3A551B44739035FA4512BDB857F90D5EC1E1C00DF29C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85e49864-bdd8-424e-8e2d-41bed6c8f3c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85e49864-bdd8-424e-8e2d-41bed6c8f3c4.tmp
Size 18KB
SHA256 957ebefc75f53dbc49b9a483937028cdc0ea8934228be9a7ae4e3abb5c209900
MD5 c84b254bb182f6be5d8ceea588debbff
SHA1 f0f59d113ea970518e3841f5fe683a589322e910
SHA512 2a03b21cb33a65fac5392275e2f4a225849b91cc969581ef42dde8b1201ac3e1dbd2dd11b13d9cd03cd03d776921d2aafe2414a7ca8baebd117f67710c3601cf
SSDEEP 384:v2QkUSvesNR2z9U5Kj2qBGYX5EKKO/vF277H7vBEJRIIlN:vWeLaa2EGYuKKO12HH75EJRLf
TLSH
T1AE826D32A8B96C7B59B3A550F14A3A039FB4952BDBC86F90D5DD5B1C00CA2CC234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f1940ec-78bd-4aaf-9368-575a020a0de8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8f1940ec-78bd-4aaf-9368-575a020a0de8.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

191988f3-13f4-4b96-b262-52aa1e65953d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\191988f3-13f4-4b96-b262-52aa1e65953d.tmp
Size 10KB
SHA256 21a273c9826d339f651717b7cf94adbe4b6b5766522ee79934b94cb2318ceba3
MD5 a18aaea4049631e2ddb8e7519d8a9bc9
SHA1 2eaf03ee59234224c8042341c360265d3d9a3315
SHA512 6118a51986054454262f8b768ca3d172ed889992f82ebe972b5b146983695dc10c1af90a3174d91a7b208ab928b15a8591cc93a447222d5a240a6d88a245ec9e
SSDEEP 192:sxZu4R2nq/f4sRNIdp9HHgHW6+WNYZe/Ygw2BpZIg5tJ:sxZPyq/f4sRuJAHbj/f5
TLSH
T10222D9527E34697B9CC7D21DBA15BF13E2F9143295D02E88AAFC861C04E67DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6425ffc6-36de-4b57-8432-b4f3f1b6d07a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6425ffc6-36de-4b57-8432-b4f3f1b6d07a.tmp
Size 10KB
SHA256 ece137dfdbf3d7477602517d2eb6b2879b2b955a019009b6256d566adb6c4cdd
MD5 f86e8ee42591cbbdd84b961759daa354
SHA1 6be547807153f839e265e611909f43964497ab59
SHA512 fadd9a58397ff4b50944ccc503072f9b5e7d2c9769833da93b98c039884a42ceec5690a0d91404d99da90c713521f147ed9300ac932591635dfba17f97e94742
SSDEEP 192:sxZu4R2nq/f4sdNIdp9HHgHW6+WNYZe/Ygw2BpZIgrJ:sxZPyq/f4sduJAHbj/f9
TLSH
T13322C9527E34697B9CC7D21DBA15BF13E6F9143295D02E98AAFC861C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

769bedfa-eb8e-4b52-b79d-29f8c65c1fe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\769bedfa-eb8e-4b52-b79d-29f8c65c1fe6.tmp
Size 27KB
SHA256 6a2eccd6fbdebff61d7b8959368e78ca4793fb3294009985c3cb138b797de121
MD5 d12d0d5b3ba5a98de6969e6f53657b81
SHA1 1351184597c72d0f2f061fe3c6fa26b1c99eec41
SHA512 2570807021996b693b3bb991cdd5796d46b1588a3d4ef3a98faf6ab90dbf9bb3f1beb729d82bcea9b17471cc592c15b47650ceea79b78c69c9af19e943267e0f
SSDEEP 768:UpichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzLroG1Zf:UpichfPWvPZplu1jan+LKgz46f
TLSH
T135C2E93B644CCB7E4FC01A9DDD1A6F9A7E9802C7A6588D4087FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e24eae4-5cea-4159-86ec-8bfff15697c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e24eae4-5cea-4159-86ec-8bfff15697c5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93cef9cd-3c51-4a51-97cb-ff05908e9cb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93cef9cd-3c51-4a51-97cb-ff05908e9cb4.tmp
Size 11KB
SHA256 6bb6543afda911c59b218f777b4e83d8ee8fba81f67eaaded2528238f872c1e4
MD5 09eef62e63ce31dca33b773d98790e61
SHA1 72699516e1e0e681fe8491500977b3a90d80ef49
SHA512 3382429ffcc67e1bd11931a20b2c6052437269d68466c79c807b9699311c017f1cdd61ee98d870fcf1e36b2636c23392486aab1c4b1c3c79a766d7b311790ffe
SSDEEP 192:sxZu4R2nq/f4sqNIdpvHHgHW6+WNYZe/Yg0I3ApZIg5FJ:sxZPyq/f4squPAHbj/ax5
TLSH
T1A032C7526D34697B9CC7D21DBA55BF53E2F9143294D02E88EAFC862C04E67DD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f54b129aab7bff8b3cb8de3bc08dfa5b9e8c2b93ffe04a39203822c1e637cc3
MD5 6978280f6a1ce4ec9a71e0ecf4ee83f4
SHA1 abe1797c0a4d77dd8e17987b4ec93e01792dd45d
SHA512 17688039411b17073c51c95d620366d9e1f3dacfd7345e13ba7f91ae767ddeb5dded28d7ba9b6359f859986a7b628b1c316380130b6b09c1de3c188af91e3dfa
TLSH
T1EFE07DAADBD8C22EE249688B51F9D38CE2C0372BD3C4AF0E1740CCC970455C4B2D67A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 4f727ed2fa915f1beb2d2956dd71e3573e1f9820c26f1402d818a37204bea2d6
MD5 6901afedcaafe4f0b98a6955f304b32f
SHA1 17c176c704f9edc32e56efde242c0d4bbc440ab0
SHA512 35869bd3c991afb68c7dd7babf08ad341166ffb70938a0f411d2e1c90f6ee85c7e8cc4cf79e5392286bd86716a92b55661a201bf8a5ac54223530522a92275f3
SSDEEP 96:vdprmoL+OnlcZaCq67xdAC2XbWbkDREtM3P44M4Ger:lwoL+wcICV7xdAdbvEtiPLjGer
TLSH
T148B1819116E68D5AEFA4607C62C7CDCB3FF49D73ACD38D1A0128CAB89762F5B9C11080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e9746a8d5b011ac6f8488b06112274165a2f624da93fc60ad3050fab66298c58
MD5 466fb9f778be7b645ebafce823bbd9bf
SHA1 f15d10d7175e4dce61d8aebd181249b0d4188c96
SHA512 ec0b9155f4a9d0551841b6ce0e480a82637dbaf60c802204be786c130a13c68e8ff2e02410bf2b4353cdb897352ed32f7e3bc04e27ae1608b1e51ca56f854810
TLSH
T1F6615F8516868D5AEF7470BCA3D5CDCB33F055B6E5C39D1A0168CAF8EB62F2B90050D4
MD5 SHA1 SHA512 TLSH

Submit Download

c71c4b5f-cf39-48e2-93d5-d4b8409d3921.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c71c4b5f-cf39-48e2-93d5-d4b8409d3921.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f6989565-1da5-47ac-8e12-3a23fce5e0f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6989565-1da5-47ac-8e12-3a23fce5e0f2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f8c8edd8-3d97-4d50-bfb1-5460ed41065e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f8c8edd8-3d97-4d50-bfb1-5460ed41065e.tmp
Size 2KB
SHA256 8d5bb5fd7f78ecaef63995e8d43a93bacc4c4df6cb6c22a98145d603824bfdd3
MD5 bac1e48dd9f20f5e9ca0a39e94dcd73c
SHA1 d3ea6d426f8f80b1c2b04267a8821f2373a465d6
SHA512 6ac136e8dd45a702da51d635a7f0cb778dd7d853764d3e6efd5c6d7a9520d250e1df748ceed36f4d655c82f2a66f8a56192bc724799e853534916e3ee74fc923
TLSH
T1C2419CF743F1956D9E025AF0AA18EE1BCE2C0111831C786989E0BE57D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3cae3ebedb952bac299a71a2da459f33433a6b4c0748ab3e9250f08a4e8927c
MD5 1bc84f129ca7564983be1be3e2ff39cf
SHA1 c55fb84edb01540c9cb476b30248d9d05f3794b2
SHA512 bf9db9612a59e49c465e9a88f86468d173adb25f2463e1b5b844b4d47a4ee44ae356a3d805f916b1bb26ad41772d067cfb3048bd0036cb7b6b585413d58cb604
SSDEEP 48:K010JF3jXYbLuLISdYK991vYxdIY+vF1yLnDnmnHnjnNnln1n2bnlnon9ISnjn24:KkKEKT6qSsoKJimAgKt+a6
TLSH
T151914114307B025539BEB54C95F6A61A424631F23668E52FBFEC44A34E7BE140CFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7e60dde-7b22-49a7-b8a1-c9a01591aa5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7e60dde-7b22-49a7-b8a1-c9a01591aa5b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dca7248f-7a92-49bd-82e0-7b03da5ccec6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dca7248f-7a92-49bd-82e0-7b03da5ccec6.tmp
Size 11KB
SHA256 bae8d2e2703d4e9eb17bd8a1ac57aea014730a416628c745389d8c6bb23b2d0b
MD5 2c2c256bf76269c4099659247e9cd82e
SHA1 accbd86bbebe706fa16da28070c3237b88bd7aa5
SHA512 0b89dc66184a4a2770156ba860ae69b3ab5189d5e75ce18c6e2d90a8590cc1fa4c8787e3370d98cb5becc9b867af428c3ad256de477c107640e9210a2b5065cd
SSDEEP 192:sxZu4R2nq/f4sqNIdp9HHgHW6+WNYZe/YgtI2BpZIg5FJ:sxZPyq/f4squJAHbj/rv5
TLSH
T18B32B7516E34697B9CC7E21DBB55BF43E2F9143294D02E88EAFC862C04E67DD624780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54cce58c-1101-4f75-819c-2d114b7d4ed9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\54cce58c-1101-4f75-819c-2d114b7d4ed9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a93b012-3501-47dd-898b-2502509d857f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a93b012-3501-47dd-898b-2502509d857f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ba099065e8769fe7717d55cf4e0702cf84a91d423691d1b3ff1e505f94c26fa
MD5 1f7c81bd391e6f50fc59fe7238ea1189
SHA1 d549178cb8eea572e9d1189f5155f27741db5f28
SHA512 ce5b2d506d8b51c7f5a03c997f391a00232644a7877ac7fb6785c396295014e77b2d99d86e2342df5180439ce92bf19242ea80eec08db8668cef497a207cd3de
TLSH
T1EC41295CA6FA1108B3776E4A9BF6A86D487BB8772F06D49E10110E4F0622F40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.tmp

Path C:\Users\Admin\Downloads\AA-Spiral-Free-14\AA Spiral Free-20261101-224503\Settings\settings.tmp
Size 5KB
SHA256 d54e80fd7352d7604c0245389cb3d38ea0c18f5154dbd872bc5b30651d0a6841
MD5 62eb6c76e87970daf6ca16e84493b869
SHA1 2833e1644ef3792e6d3ba9c5efb916023c7fce3e
SHA512 a2af2c651faa45150312b7706815e30baf95ac03a4ab883092d5309dd61e2a99ebb24d2698058e15f4b7a469c787f98ea31254632e98bc5c73cd1be96ce00bad
SSDEEP 96:XIkCVTwH9NpZTkB8WbSrs0SPx0CN85ERmQgtNoEwUnS:LCZK9DObSrs0SPOkHRxgtNoyS
TLSH
T11BC15926D9684CBF20F9B26AA97D6203F5B0435B01550C5FB2FC469C1F736636182E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.tmp

Path C:\Users\Admin\Downloads\AA-Spiral-Free-14\AA Spiral Free-20261101-224503\Settings\settings.tmp
Size 5KB
SHA256 e91ed0aaaa95a3d7dec7ea113747633113f60308cc428f0e0da275018294f0a4
MD5 bc79870a1a4a6747ee7062270d445a57
SHA1 6501f4cbdd394a5da815a41478d5ff02678128f8
SHA512 19e20191f387e72f3fd991697944226421b2fdf2dbe8de198f36338d09cdc20272e6af1a933fb4509ea2156ec12f0e481e7caaabc54cb2e963d4805cc05c7d23
SSDEEP 96:XIkCVTwH9NpZTkB8WbSrs0SPx0CN85ERmQgtNbzEwUnS:LCZK9DObSrs0SPOkHRxgtNnyS
TLSH
T1F6C15926D9684CBF20F9B26AA97D6203F5B0435B01550C5FB2FC468C1F736636182E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac8a098d-87df-49be-a595-0714285fb516.tmp

Path C:\Users\Admin\Downloads\ac8a098d-87df-49be-a595-0714285fb516.tmp
Size 13KB
SHA256 bad1d9710631273085cf1aced91af71a024281b5014cc98e67fb643c8322009a
MD5 fb0ff78f7238a196fb8331e1972d669f
SHA1 6ce2b7039137af077af4e6283a6040fc46feb79a
SHA512 b6aeafca86e770bf2ad072f7de71c60cfef0ff184ddc97504775855d903a63ebcebf4b87cbd817f75ede9982388e0a28eaab706692a0e8bc6a9333f3f2f21f78
SSDEEP 192:h/YicZ/hixE0Rear7mN16vM6YWRLr6eKeQRA1jaAMFvm0FP+DVJHsR4jmIV5p:h/qZ/R0zg6ngP0ObvmnDHseXf
TLSH
T12C52AF2CE2DFF58DD192CEF63220FDE3DA494FE28A41C2EE1166821654C98E3519B1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-467-0x00007FFA10100000-0x00007FFA105C7000-memory.dmp

Download

memory/2124-479-0x00007FFA13BE0000-0x00007FFA14F8D000-memory.dmp

Download

memory/2124-468-0x00007FFA0E880000-0x00007FFA0EEBB000-memory.dmp

Download

memory/2124-466-0x00007FFA109B0000-0x00007FFA10D11000-memory.dmp

Download

memory/3328-472-0x00007FFA0B780000-0x00007FFA0BDF5000-memory.dmp

Download

memory/3328-470-0x00007FFA364E0000-0x00007FFA364E1000-memory.dmp

Download

memory/3328-473-0x00007FF9E66A0000-0x00007FF9E76A0000-memory.dmp

Download

memory/3328-471-0x00007FFA353F0000-0x00007FFA353F1000-memory.dmp

Download

memory/3328-488-0x00000289F5880000-0x00000289F58D5000-memory.dmp

Download

memory/3328-489-0x00000289F5BD0000-0x00000289F5F25000-memory.dmp

Download