d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe
Size 514KB
Sample261110-n58m8axt6r
SHA256 d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd
MD5 443c5e870832246575af3d8b9a9a21c7
SHA1 5d209c0fd60aced6996cb939fc0e9c38fefcfda3
SHA512 6b46b7297521ff39e9cb0c0add07ae28090dad11b2a7c4e7fe15fac188c63854a852c3abc66fe75ee5d2d820855c0972d55799d5ca3b5771e4647d6de5a36772
SSDEEP 6144:OUx72wXbRygI13JlmL1tjvuGpuQ8K2yYnTrwdOmbDyEpZ13JlmL1tjvuGpuQFG:OeygI1HmLruGpGyOwdJy6Z1HmLruGp
TLSH
T1BFB47B4A77E801A6F1BF963988B301129772B8161B21DBDF0A9556B91F333C18E35F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	w499b1297d2.exe

Loads dropped DLL 2 IoCs

pid	Process
5172	msedge.exe
1732	w499b1297d2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\wsl_6c51cda6_c7e0cdcdc534480f9daf9f137e57570d_Admin\filegrabber\Desktop\desktop.ini	w499b1297d2.exe
File created	C:\Users\Admin\AppData\Local\Temp\wsl_6c51cda6_c7e0cdcdc534480f9daf9f137e57570d_Admin\filegrabber\Documents\desktop.ini	w499b1297d2.exe
File created	C:\Users\Admin\AppData\Local\Temp\wsl_6c51cda6_c7e0cdcdc534480f9daf9f137e57570d_Admin\filegrabber\Downloads\desktop.ini	w499b1297d2.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api64.ipify.org
1	api.ipify.org
5	api64.ipify.org
9	api.ipify.org
37	api64.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
2508	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	w499b1297d2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	w499b1297d2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5076	cmd.exe
6028	netsh.exe
2508	cmd.exe
3736	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2576	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1732	w499b1297d2.exe
1732	w499b1297d2.exe
1732	w499b1297d2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe
Token: SeDebugPrivilege	1732	w499b1297d2.exe
Token: SeDebugPrivilege	1732	w499b1297d2.exe
Token: SeDebugPrivilege	1732	w499b1297d2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5172	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 5076	3472	d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe	89
PID 5076 wrote to memory of 5832	5076	cmd.exe	91
PID 5076 wrote to memory of 6028	5076	cmd.exe	92
PID 3472 wrote to memory of 1732	3472	d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe	93
PID 1732 wrote to memory of 2508	1732	w499b1297d2.exe	94
PID 2508 wrote to memory of 3020	2508	cmd.exe	96
PID 2508 wrote to memory of 3736	2508	cmd.exe	97
PID 1732 wrote to memory of 5172	1732	w499b1297d2.exe	98
PID 5172 wrote to memory of 2144	5172	msedge.exe	99
PID 5172 wrote to memory of 5444	5172	msedge.exe	100
PID 5172 wrote to memory of 2576	5172	msedge.exe	101
PID 5172 wrote to memory of 5444	5172	msedge.exe	100
PID 5172 wrote to memory of 5444	5172	msedge.exe	100
PID 5172 wrote to memory of 5584	5172	msedge.exe	102
PID 5172 wrote to memory of 5584	5172	msedge.exe	102
PID 5172 wrote to memory of 5648	5172	msedge.exe	103
PID 5172 wrote to memory of 4308	5172	msedge.exe	104
PID 5172 wrote to memory of 5648	5172	msedge.exe	103
PID 5172 wrote to memory of 5648	5172	msedge.exe	103
PID 5172 wrote to memory of 4308	5172	msedge.exe	104
PID 5172 wrote to memory of 4308	5172	msedge.exe	104
PID 5172 wrote to memory of 2260	5172	msedge.exe	105
PID 5172 wrote to memory of 1908	5172	msedge.exe	106
PID 5172 wrote to memory of 2260	5172	msedge.exe	105
PID 5172 wrote to memory of 2260	5172	msedge.exe	105
PID 5172 wrote to memory of 1908	5172	msedge.exe	106
PID 5172 wrote to memory of 1908	5172	msedge.exe	106
PID 5172 wrote to memory of 2496	5172	msedge.exe	107
PID 5172 wrote to memory of 2624	5172	msedge.exe	108
PID 5172 wrote to memory of 2496	5172	msedge.exe	107
PID 5172 wrote to memory of 2496	5172	msedge.exe	107
PID 5172 wrote to memory of 2624	5172	msedge.exe	108
PID 5172 wrote to memory of 2624	5172	msedge.exe	108
PID 5172 wrote to memory of 5124	5172	msedge.exe	109
PID 5172 wrote to memory of 5124	5172	msedge.exe	109
PID 5172 wrote to memory of 5124	5172	msedge.exe	109
PID 5172 wrote to memory of 2960	5172	msedge.exe	110
PID 5172 wrote to memory of 2960	5172	msedge.exe	110
PID 5172 wrote to memory of 2960	5172	msedge.exe	110
PID 5172 wrote to memory of 4364	5172	msedge.exe	111
PID 5172 wrote to memory of 4364	5172	msedge.exe	111
PID 5172 wrote to memory of 4364	5172	msedge.exe	111
PID 5172 wrote to memory of 2728	5172	msedge.exe	112
PID 5172 wrote to memory of 2728	5172	msedge.exe	112
PID 5172 wrote to memory of 2728	5172	msedge.exe	112
PID 5172 wrote to memory of 6084	5172	msedge.exe	113
PID 5172 wrote to memory of 6084	5172	msedge.exe	113
PID 5172 wrote to memory of 6084	5172	msedge.exe	113
PID 5172 wrote to memory of 2208	5172	msedge.exe	114
PID 5172 wrote to memory of 2208	5172	msedge.exe	114
PID 5172 wrote to memory of 2208	5172	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe
"C:\Users\Admin\AppData\Local\Temp\d9f931508054a1bfeb6576e70d9088b9bc03f70bf941cd956368b72afce5f9dd.bin.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /C chcp 65001 >nul && netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5832
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6028
- C:\Users\Admin\AppData\Local\Temp\w499b1297d2.exe
  "C:\Users\Admin\AppData\Local\Temp\w499b1297d2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C chcp 65001 >nul && netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3020
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --no-first-run --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf"
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ff82825c188,0x7ff82825c194,0x7ff82825c1a0
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:9
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2384,i,12999441515035812435,586136175313914815,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:9
      4⤵
      PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79acba68-838e-4b44-9a1b-6574bdc2634c.tmp

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\79acba68-838e-4b44-9a1b-6574bdc2634c.tmp
Size 4KB
SHA256 2d6d51439b85ff7353d56017409d78f88efc01c50824ad3823a6740e7ef8b1bf
MD5 a70d1c54e6f0474a66cb22e28a2db3ba
SHA1 66451bcbce2ea834057d69b5a7456e3f0b6c43a7
SHA512 d582fbc48dc476826e0e4c570b6fc80b515395a372a64806f60f510f9bcdf36959ab33dd694c4523335557d443f56b63dfce0e6c159b2888516052086917bc62
SSDEEP 96:rqGNkosFfesee/1YEFvDABZPqvO2wfzi0eUcHEm9q4a:uGNTvstNFLkxZfu1x2
TLSH
T1CB8183727D34BC639BB25F45BA4A6B138FB8317BD4652F50EAE82A2C04C765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Crashpad\settings.dat
Size 280B
SHA256 8e93d85d3311b64d94f6cdade6ae452bcc1ab6eacb3052fcfd11a5086ecc1e54
MD5 80001200eeba644feb2a78b1f6248f4a
SHA1 e6536d67c819f96a9c97a47b6775ce30c882fb28
SHA512 5568021720d7e37548df9a2d73049a097e438d09dd422210befc2c70498d9f24e545418597c8162ac5c70edaf2e3b55307a1e912a621c508fda149c8ed25d746
TLSH
T16AD02222BF002020C2820C3BB200F3CF0A03C2300020A0C3023B2C3F8C8CBF023AA320
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Crashpad\settings.dat
Size 280B
SHA256 d8605752e371c2852768afec0e14f2b3c7862015b12f1ffa7031622840f8c961
MD5 959c3a94f94242519b3be9f6827eb08b
SHA1 b37ec5e15374820966506406b6485c8afb32626b
SHA512 f2bb4a3de9d826c8674b36d63879ee602ffcf42de41e16bf9f5065299f50769793e870d505366f1e61460d9dc2883ad17b01ad8791410d2160591f0abfb69290
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c05baf7ff3a2f165f971a860370f266a8c6de2e0f292fafa87df114618b4f428
MD5 602627d4f08a3bc7c26f134491afe490
SHA1 4eba799d968a72811511bea8d38150df3303a99a
SHA512 7eb7920123fd114d200c3c6a2d5c5d6dbca364c5e9e049c230fdd6c51677e623357fce701268ae687805ea935af5986a32b3ba8456f98794f5a6544924b35c67
SSDEEP 3:MsFlTlrllkl28kIfrvikellLTIS+Rfsb+/vwmgSF:/F028lzikezTIdzwmX
TLSH
T1F013125DD5C80447F15451F12079C770E270D130322353D30170181E7F52FC108C0100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 13174f7ef6fc6f51761e6ebfd29dd8e3e9d3dcab0989c9011827bfc6c26d42bf
MD5 7926a2bd5a5bf9d40676cdf48818a2f3
SHA1 71cc998e287ecb68d0effbec63ba9487b76b202f
SHA512 88c02f36efae8670da1b7a4ed5deb23b3f851d0088407eeb2226db61dbab738143a56125898aaad595456e18dd55182b749c3d3247861161b62679e5d887e283
SSDEEP 12:U/cEbUTi/d/+WD3ll/MMeIetlvliUDekOAt/yMj:7LiVWWHEUUSkOAt/bj
TLSH
T1664468EB8980984BCB2419FA6A02A02DD13B21292CD0BED1D03808C611007949079242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Cache\Cache_Data\index
Size 256KB
SHA256 80f69e7a19f572abdf4493872798fb729060222c4427cc6d4e8a26717986596c
MD5 8d0179770b3041653b9c178e6c928c58
SHA1 73bdcfaac7fe32e42e9e689139ad917bef32234c
SHA512 230dcef2fef916b0d2e1f591f45023c59d7f46f5d13385bf81a0d031833e0dbc20c2bd9ae45fabda9d6c10f7da63335820aed0b7bb215fa09b4df1868d28fc8b
SSDEEP 3:LsOlElNllklkXlA/kb0lX1lUltncNtlB/:LsKM3lPak4Xk2Nx
TLSH
T1C144026903941406D64003F448E287383334D409574F4743024402301F457910F47040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a8a6f695a3ff316_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\2a8a6f695a3ff316_0
Size 303B
SHA256 0b42939874766fb4354e70304a30c6211d6b83eee04541eede65255365e98492
MD5 d86a70eb75d29889942b83c5b7f66d5e
SHA1 061f8c67e08569627483286956b58f946e280362
SHA512 1ee3061d9c3286d1b39dcb64bf6ae86467f80350859aab12bb40bb6d9df9137c894992bb7e966a4e5cc5c27e3e5631d5f600cd7d6da70ad18ee4a816e14b47e0
TLSH
T125E02B0A014F0A59D45C8A7CCB335231951F566150BE71428D84D7BE16738347499321
MD5 SHA1 SHA512 TLSH

Submit Download

2cca9bc741a6516d_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\2cca9bc741a6516d_0
Size 306B
SHA256 dd8a00a4fe2107f8123e4233aec0ee7c407680466f0fc699a0b91904b3c373aa
MD5 42a0a83277eb71032fe7c1149d676987
SHA1 114df4f45f0be2f2e9121f26772684cb0ffcdf1d
SHA512 c5e71ecbc86686f4742beba6646521cd768a51e189552627881c31e4f2424c0d9259009471cd1cc314a2f223e8cf210fb3a1d58b15fc962a7c09bc70e9dff80c
TLSH
T1E3E02B035C79194AC0FE8375EF6743B8C64D5A2110BB718705E192533723894D5C5322
MD5 SHA1 SHA512 TLSH

Submit Download

5cce1706364839f1_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\5cce1706364839f1_0
Size 307B
SHA256 6c5fcbbe749c3004b484d66d8d7b7589a0e6297a73178801f583d2e2b9ef8dc4
MD5 3e007beb5c7ee2e2120f73894c1b1cae
SHA1 e5b7fb9a6dfc65630fe81d1fafca57f001e67f42
SHA512 4a77b2e42dd32b95e6d53cf38fc02222fa517bcfe988962c2da9623d8603657f978e9aa66ee3a04ac1ec106a54fa90509c9989ca9beebdc9668ed5e105309f8f
TLSH
T17AE02B07AD8C1A0CD8AA82F1EF7B47788149169015793AAB54F093612743DA1D0C0132
MD5 SHA1 SHA512 TLSH

Submit Download

5fbb54f36261c413_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\5fbb54f36261c413_0
Size 308B
SHA256 736b403a1b74fc4e5d23746b267d984c9c2ba20b76b102070f5d1ef03bee13ce
MD5 2034b1a9b88b190f05ccc7df7c74af9d
SHA1 2131ba52a7012b0c70aa73f738ba91f47eb763f4
SHA512 acde729aa0649dc30def89ada0fb432fd570f62a4bdae6dcc18aef8a8c2ee6bf5afe40f95625ee0b4317cf5afdd0e3bde897a98319a58edd9ea95b72e79d0760
TLSH
T19CE02B42FCC88406D4AD897ACF7B0278569E57E1116B335758E402631A73974D5C2072
MD5 SHA1 SHA512 TLSH

Submit Download

7de0dc67a2b3a69c_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\7de0dc67a2b3a69c_0
Size 307B
SHA256 a019eaef1c2dc10238ab61b2c032cd4178cb1d4c6a4b03bdd2e471b4084372ca
MD5 0b8e2ecd86cbed0c119a324373103b00
SHA1 ea68a9c7232247691abd4ad17c13db92375b42c5
SHA512 2f09adf4632e3a77aa092ba0d5276920d197f4e0fd67b5866d3bb3f7fa74572bf259c81648934aedc0c268203eca96789f7521c740a6cfb7918b391d4bee7608
TLSH
T1F1E0C286A84D1C5AC8AA8AF1EE23827687598699117A3A470AD442A22E03950A1D5232
MD5 SHA1 SHA512 TLSH

Submit Download

8020acacb3d13763_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\8020acacb3d13763_0
Size 321B
SHA256 4b9afdd61b426762a39129a2acf2a8b9dc99a34f8a3c5fab8fde6e58bc5771b2
MD5 f1851639e1a4640052cb8682fd0ea559
SHA1 1d6986c0561d4bf52c5f793b5e20818d08c2153c
SHA512 e56386bb37b0e4ca8a999a038f7562f262d20f3691158b2214199f4ec4406c1d0764a412de2cde4936dac3ea73f85072c506ef98d9cbac1ce1399389d4e1f73a
TLSH
T168E0C24A6A495D4AE8DE42BACF278A38415A5A9114BA319718D241A12B634A0E2D46B2
MD5 SHA1 SHA512 TLSH

Submit Download

8bb1867be67136eb_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\8bb1867be67136eb_0
Size 305B
SHA256 a6832a6e9b186cb91bf9e4913f0c7342ff84878e7193d5c3aa96c8db2facc880
MD5 b0b28497b10de68edf9e2221e0cced35
SHA1 7166f1593c78f63a937bd114c4463485ed66334b
SHA512 0677ec2f6270fb4257e5beb80e4ac7f9dcb3af28b9178717aa55db1c7491099ff6b44c1127d92b0da532fdcbd37f42a7816eaa18aae39d00628494dab7d33f27
TLSH
T11FE02B43A9C454DEC0AD47F6CF778B74C10E1A52507A356788E5425626C3850E4C7A75
MD5 SHA1 SHA512 TLSH

Submit Download

945cb8fb56d09a8e_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\945cb8fb56d09a8e_0
Size 321B
SHA256 da038111e46351c7ade74ad0411e5b1efbea78222331fd1daef78b901a675bdb
MD5 108ac60835481c5e286d8ae347bc57a2
SHA1 80c2912b7d1f5c6a604248fe79f2b8f7a37c4dab
SHA512 28086d3ec403fb83dbe246fa0ef2e23ef05ec27984c4cf188b3bddd51cb4d9255b720195d7f118f7bb441364124c9f52735e5a179bfa667490f187dac80a2211
TLSH
T18FE0EB0FA80E0D46D8FA4AB0CE638338831D05B232FE733320C2029313038A0E2C6233
MD5 SHA1 SHA512 TLSH

Submit Download

b21fb45197b9c728_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\b21fb45197b9c728_0
Size 303B
SHA256 d6bca78392a947aa095c85ca41d35426ac572ac07b72a2090de1ebd556c9ea4b
MD5 906a904865177be1116467e0bdb2c3d1
SHA1 f299105776556e03b3917f261e4aa72279bc3e3b
SHA512 75c48b45e96e3f49b784e9d1431bd345a9e6d341852a79753c43fbba5e04cb9fef50058f8037470373605811aedd5fdb167f2a56cbf3ae1cf86b895f9c12eada
TLSH
T139E02B479C8D140AD4DD4374CF7BC378C1890575907E77970DE902622B13910E5C6277
MD5 SHA1 SHA512 TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 34114469bc69e32f09cf76b34d5de7a39424a80e5667979869b0a0af3b167c28
MD5 4dc054cffa582556bceea5952feed232
SHA1 313d8d2cff7f8aced07f439dfaa8d0969d7453c4
SHA512 7cb91c425fbfcd770c1189e1451b42da41cd33168ad0d2d69ef2328a18d3992e7b58dfc55f158b480dabb20140a1919ed2156f105da3fc08687a9ec9f60f17b0
TLSH
T110E02B81C34C0F1DD32D96BBCDBA02054B0A42C42ABE3A03A9C0C2C237174341149122
MD5 SHA1 SHA512 TLSH

Submit Download

baded5730168391f_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\baded5730168391f_0
Size 313B
SHA256 6b081f407a504eee28884ec0c80b84fc902de0c215f1c5488255105b2c26fc96
MD5 bf0837a840898045f7c3c2c969be8350
SHA1 5fc1ecb9b46af11bdf8a75a2a727f2189f53525e
SHA512 2daaa87cb592345a0ae1ec198b4cca4ca6d9d96e8e085073bf317318d3d2a575fae0ed8f1665d8e02da7e13428c4db92fb00ba94ea4b9c091449e0c9cc504a94
TLSH
T187E02B4B69899485D4DC47B2CF67873D815D4AF01279759B18D31BE9131B8A0D1C0132
MD5 SHA1 SHA512 TLSH

Submit Download

e94999eac39dfd99_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\e94999eac39dfd99_0
Size 317B
SHA256 861a6fbf29e95d55b6d950b58dd5842728cdd00dba4ca06d3d298096576018bb
MD5 6a9af6150b236e4d4d43853ea11dcf63
SHA1 ea616f0934f40ea37cb2f8a87b9e6ddab5821b60
SHA512 8f74c378073f33a0b018377b984e8598e96a3ef0c74a29cb065995928f1d5361ca935c09e860572b4b163b39aa7a1fa8bf0d41dd9898f2745efa9d225cbb35d1
TLSH
T137E0C283BD886809E0EA9277CFB382B89A881951146976A34CE083A23692990E285162
MD5 SHA1 SHA512 TLSH

Submit Download

e9a142a21b9ad9ef_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\e9a142a21b9ad9ef_0
Size 297B
SHA256 58836cce735bd8e19d10aae1d012c5ea07d4c4cfe28ce183295a2b376c8c48b1
MD5 f5174ade1e2159ca82bf7b1019722954
SHA1 c62bd583f84b32208589e627deda0f6ae36ced9e
SHA512 f04f3632239586d13066d4c11519e6a36acd729f5d86245e1d6c0cd1f4c6714c2b8d0008f9a2be675e9b4d519468944bc960d63d4ec74f0a0f64982a403f1a92
TLSH
T135E02B83EDC9545DC9AA46B0CF7B877DC11A5A7210AA329284E003512A1756095C1072
MD5 SHA1 SHA512 TLSH

Submit Download

ebce9e52a869b921_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\ebce9e52a869b921_0
Size 303B
SHA256 a885b5c1dd787d545690612e53f16b522a00818a98f6a4c3477043ce4537bb28
MD5 de40256270c1e1afa14e160910614025
SHA1 d0d7d4fc59bd0e76969903781aed2bd2938fc276
SHA512 a8ab5189a7088ee94382a7ef65ccd71b5f65c09f05df1a6bd840d8f2835d04744a39965d68bfbd8b1d49595f1f41d50ff14832de0601f8c7f622a8b083ce0815
TLSH
T1D6E02B266094070EE0AFC3F5DB774141436663D0903E3563F4C820D17100A70F28021A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6b9ad044f970ee13192df781870d9f721d456de0da5dc95c641d45e589d5a5b2
MD5 8f7981f07271cca5a86ce81d37a5aa75
SHA1 3ea325a2917529a614901aae94cfbe758e260102
SHA512 b81c1cb0e19aa6395630423c712828837afcbcbab4f01d39605b8a1a963f40d8ba17a4407c3e328c4338de952d05052234513b98a7ee115a328bcd827f8e3d8e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 295b664a588549c4c3b4e0df6c3c9f9dde8ac9e95c56af4476e1dbc04e34b868
MD5 a568bd3b63a863b33a5815728c280d94
SHA1 6152b50f66b07b71fdb2b8f29107774eed7db096
SHA512 4f7fe936d6b6b69046c2d0c0defdb3a9928bda420f01f0e7a24da760d73e279eb62e5fda07ec6cb0d02f4ad6f6b2b17d91be847a2d1a49eaffc855e0f1450e6d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\DawnGraphiteCache\index
Size 256KB
SHA256 920c18fe625d25c9a5d63e1e965315a4212f21a107a1a50d3e7f1fda6a311feb
MD5 0b598f6cb7bab5e01b5fa6a1206e59c1
SHA1 9cd0fbd86a6fd8911ef130b354b900cbb93719b8
SHA512 00c03abde5d9c936a51acc646581486cb296c48ea6422c273f34e9f34b43dc2d652308a59f9a3d345d7c048b23b3478a5b43c29ea4105903e8ece359f40e25fb
SSDEEP 3:LstlNllklkXl2Hkut/:LsX3lP2L
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\DawnWebGPUCache\index
Size 256KB
SHA256 661ea4b8aab0ece8228dfcc525e3a4af862110183e5084849ff2d11170eeb7e9
MD5 1b2415ddf07795d9180c0c78d235cc3c
SHA1 a62ebb03733012bea7863f033b19ab933b6308c3
SHA512 ae1d47964e6c8454396ba4bc06600d937a87e4f096a0c2842f2990eb6af78e4283280f8ad275c2494b5af6163dad23435cea4129406af98b6adc4d5ab8c12e45
SSDEEP 3:LstlNllklkXl5H5t/:LsX3lPf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\GPUCache\index
Size 256KB
SHA256 4a214d19bdb027746bc11c57db7d23c10100e9d5f22046a1695ede5fc887892f
MD5 7081d09c4ab291e80e16d5b06d387049
SHA1 fb220fc338dd93aeb2db383caa61d2220ea99447
SHA512 a745e34bbc8e0792218032292e27776847cd547dace5274f6c3872dbd3eb3d12d5a86b793f8d799f431529ccac5d8a927a6d1683660a063e2d6fe5a064c405a7
SSDEEP 3:LstlNllklkXlJ8hl/:LsX3lPG
MD5 SHA1 SHA512 SSDEEP

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\README
Size 182B
SHA256 a0c9abae18599f0a65fc654ad36251f6330794bea66b718a09d8b297f3e38e87
MD5 643e00b0186aa80523f8a6bed550a925
SHA1 ec4056125d6f1a8890ffe01bffc973c2f6abd115
SHA512 d91a934eaf7d9d669b8ad4452234de6b23d15237cb4d251f2c78c8339cee7b4f9ba6b8597e35fe8c81b3d6f64ae707c68ff492903c0edc3e4baf2c6b747e247d
TLSH
T15BC0123585C365A5521A02F2694152826606E923A82ADD6097DD804C1703BF1F2112DB
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

89bf8280-2181-4cc7-9539-28b916097abb.tmp

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\89bf8280-2181-4cc7-9539-28b916097abb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\arbitration_service_config.json
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Default\default_cloud_config.json
Size 8KB
SHA256 2e7a7f0b9bc75d0c3b20042b5027d5c2fa5d51565ddfa38ae863242b5d231550
MD5 1f2ae372fc4cbb3ea21331f7fdb3992f
SHA1 ce8823aff176eee15937b362606b033fbb353c0e
SHA512 031ed30270536d7b7396ad25a739e3c3dda311a4cc4d175a03848540e1cf90feb52e542364ebaed33fdbe994e3420533e748f9ad2a5e94ac263c6287fe0bacde
SSDEEP 96:RR2F2jKrEFYNSdJeRgPAn8XckvgGVFqAQ2ghEFq9Q2gERflbPER4q0IqoY0dwWtT:weggaRIskvFa9k87En4GpU7REH9z0YN
TLSH
T1F002AB7AD2215C7729B452AC9CBC4793F210137F5281880FB8BC656C4F7BA76A488F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\Local State
Size 1KB
SHA256 56bc1c056fc7679ba131ed4eda0df9841c4c2ed407355b9280c24a588d5912b0
MD5 805c1dc144fdeeac3e69595a25d7681a
SHA1 920d6159b1b780521227cad72224ec6f037ba787
SHA512 0c35ae29d67bd60968b05921e338cda1a098d93dd0f32dcdeef7519d7a8a59fecb3a1398bcaa1a2927aac797f01a9d83e160219b9e636ef54f9fdf03ae1f0bef
TLSH
T11A31B8B07C747C73AC911B45978ABB979E38223AC0155F5452FD1E1D05D365C120AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

f1a01913-588b-4168-90c0-42984a1aa47a.tmp

Path C:\Users\Admin\AppData\Local\Temp\abe_7aa7bb47340b48c4b27912df3260eabf\f1a01913-588b-4168-90c0-42984a1aa47a.tmp
Size 4KB
SHA256 6012e02599f311106f6d44067347573c304f807ef3edaecf945f2abf46c23f96
MD5 0b90c916a42f5f5d3843ff884f5d61b6
SHA1 880a8caa880170b5b37909db46dab4c58b8482a9
SHA512 c3799ac6910b3d4b4bc89fda3278e2d75ca1cebf158f3fa50346b015dcbfc65d4d0b865ddb21f4daa9618e304b0ad4eb9520aece3f942622eb0550d1d39dfbb6
SSDEEP 96:rqGNk7QsFfesee/58Frh/cInURoDotov/pFvDfBZPqvO2wfzi0eUcHEm9q4a:uGNfvsSooDUwxFLpxZfu1x2
TLSH
T121B183726934BC679BF29F05B98A2B17AFB4213BD0943F94DAE81A1C04C76981346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbn3z15.lwz

Path C:\Users\Admin\AppData\Local\Temp\idbn3z15.lwz
Size 4KB
SHA256 b1aa062cd7f6c6b5eec36d94c70fe5e14bb899f753ae58834c3f234da2b5bdac
MD5 50812d3432aeb9e500a60c44598bf255
SHA1 ebc11d1857ca56838a005829dff8f405542f17b4
SHA512 6fddf3fa9172e3ba2363d23d7fee73296fbd7b6e3b25dc0b45627a36a392740b47512d000fc33acde6767bcf6c83b83e950e9fd602b47c41ad3f680ff676d215
SSDEEP 96:pC6Nd+U7D/u1i5WFtfvuvTj7sCRDotok5EHDsB6jGyvutF6LDmbYLsV4a:pCGz7q134vtDUDSgf7F6LDmbY0
TLSH
T1C4A10B71EC7D997B85B6C485B5422A43CFB0227F6A02BF84D8DD1B1C11EB6EC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbltjusb.w33

Path C:\Users\Admin\AppData\Local\Temp\vbltjusb.w33
Size 38KB
SHA256 434251e73e8c9d1618a07d0f2760a020e68abb4fa9f9aafa4d011d98eba3018b
MD5 2452f22eac009b13944e9aad7cbd976c
SHA1 afb12e170d1032ce05597eed1d1944ad51d96fa7
SHA512 31ed44f9efb9f3a996a4ec4e7d30ee4835c6289474cd37aea778e07adb47884aec36dfb765bec117b64de6806780ab4466e95cb63ecc247b6e7db60c4adf1902
SSDEEP 768:X/UxvxjgC+H3YnSOjMR/9OA9at01j0iq00+Ia2/SHoN:KZj3+H3Yq+CHq00NaMSIN
TLSH
T1F603C031ECA59D739CF7B384730A63879FF44663C5CA6AA049ED2A0E01876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w499b1297d2.exe

Path C:\Users\Admin\AppData\Local\Temp\w499b1297d2.exe
Size 267KB
SHA256 fe90ce496580195a7f0404c359abcc8ee752fa46ceaafcc94ac801413ddcff9e
MD5 bf9c614616d1bd1d87754c5a3c3c5e19
SHA1 f0024b6484f11665033acf03e86be7c5a963c308
SHA512 ed6aec37791dcd0026eda206f5747ad966bfafc82ab667cda77915fb4c3ec8ec1975c664e5208fa6f2c226dcf6c9e268d3057460e458895f4cc05669cc19a186
SSDEEP 6144:gK2yYnTrwdOmbDyEpZ13JlmL1tjvuGpuQF:wyOwdJy6Z1HmLruGp
TLSH
T16D446C4A73E801A6F1FF9A3889B201169772B8171B21D7DF0A9552B91F337C18E35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_20261110_120015.png

Path C:\Users\Admin\AppData\Local\Temp\wsl_6c51cda6_c7e0cdcdc534480f9daf9f137e57570d_Admin\screen_20261110_120015.png
Size 534KB
SHA256 19a54d4d385d5f9240a04d8196a72702af0122d2af760b51c607d76417c43103
MD5 e1bf227303da6528139e93a1a5272f61
SHA1 e84c78ce46692f9a153c0e60984f4df4eaa305a9
SHA512 1cf5736f282bc597bb4fdd72018d65cf4ed4fba070b289c3a9cf8441684ec317e4444baea3a0af26fde41e5e8545a25a3a6aff1f7708e775f093fc637ad40efd
SSDEEP 12288:OJqu0LHBoAgvsvafAkuCsZBw/cRM5xuApXQvpKG5ZGDP7tGpX:J1H5gvsvqAkDsvw0O5xvQvN52Px4
TLSH
T1A2C4126CE5F052468DCD403B6F909A9213317747E9BE057C92213D90182E7BDABA6B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsteal_worker_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\wsteal_worker_x64.dll
Size 145KB
SHA256 0eadd720fde481a159218bf2ffbe87090b78d2d3b1aba89033c981ef25fd8be3
MD5 68aacf8a53897d28f6cd35ec93209d6c
SHA1 aa4fda09b58d6b6c94f0a051003b3c0a084e13f5
SHA512 cb0eceecfc82d00670e7e66ccba9c6d33ab4159ba7ec27d47427d632c2705ad9efbf5c8a6b62a9462d7783e04939f37339028bb5b509197b2967eda4e161a770
SSDEEP 3072:vC4QJTY3JlmetzK1zCcqYHj+CuGpuXupIGwbIb:/13JlmL1tjvuGpuQ
TLSH
T1E4E35C5BB3E541BBE173923989A34646F772781507209BEF03A4437A2F273D19D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1732-28-0x000001A6BFBB0000-0x000001A6BFBF8000-memory.dmp

Download

memory/3472-29-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-0-0x000001B9F34C0000-0x000001B9F3546000-memory.dmp

Download

memory/3472-19-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-9-0x000001B9F51C0000-0x000001B9F51CA000-memory.dmp

Download

memory/3472-11-0x000001B9F5210000-0x000001B9F5222000-memory.dmp

Download

memory/3472-8-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-7-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-6-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-5-0x000001B9F5280000-0x000001B9F52D0000-memory.dmp

Download

memory/3472-2-0x00007FF82D740000-0x00007FF82E0E4000-memory.dmp

Download

memory/3472-1-0x00007FF82D8CF000-0x00007FF82D8D0000-memory.dmp

Download