c7a53cef7508f2abb86996be29a075c2ea63bf09b1bb08e1b1b7a592cf074e60

max time kernel
599s
max time network
594s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10-04-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

18KB
MD5

975aed651740cac29bc0fa6e3992d3cc
SHA1

42033f32c97b6be4e446c0a77690745eafc28112
SHA256

c7a53cef7508f2abb86996be29a075c2ea63bf09b1bb08e1b1b7a592cf074e60
SHA512

53a57fbf3952c5f0e08781879747d059d27a81f58c3f1a9f38c8763ba7aa8d31849e9797092c7624311b626e9aedd4937956bdefc54350ade3d480b04d1eb87d
SSDEEP

384:rTqN2DpmReVoOs41N9ylKeGM+U8HhhbG167uS2LjFrSE3+dVJCBXQL:rTqYBVoOs41ryI1M0Bhb68CFrSEMJQQL

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e80d43aad2469a5304598e1ab02f9417aa8260001002600efbe11000000260cdec4cc64da01f3facd47d264da017cc06e70758bda0114000000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 560031000000000055582470100057696e646f777300400009000400efbec5522d608a586c932e000000a60500000000010000000000000000000000000000005b5ca700570069006e0064006f0077007300000016000000	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "16"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\SniffedFolderType = "Pictures"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\NodeSlot = "13"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "14"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3084248216-1643706459-906455512-1000\{82C4A475-AFCE-4AC1-AC63-47944F713B50}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	Popup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
1076	msedge.exe
1076	msedge.exe
3236	msedge.exe
3236	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
1200	msedge.exe
1200	msedge.exe
4984	msedge.exe
4984	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	Popup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3488	AgentTesla.exe
2148	Popup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2612	1076	msedge.exe	79
PID 1076 wrote to memory of 2612	1076	msedge.exe	79
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 336	1076	msedge.exe	81
PID 1076 wrote to memory of 4244	1076	msedge.exe	82
PID 1076 wrote to memory of 4244	1076	msedge.exe	82
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83
PID 1076 wrote to memory of 4488	1076	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffae2703cb8,0x7ffae2703cc8,0x7ffae2703cd8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8785039852055692484,5929502348727224750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4076

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\The Worst Of All!!!!!!\BonziBUDDY!!!!!!.txt
1⤵
PID:2820

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\AgentTesla.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\AgentTesla.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"
1⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\rickroll.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\rickroll.exe"
1⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\Popup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\Popup.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.rjlsoftware.com/
  2⤵
  PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffae2703cb8,0x7ffae2703cc8,0x7ffae2703cd8
    3⤵
    PID:2676

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaacbd78b8e7ebc636ff19241b2b13d

SHA1
4435edc68c0594ebb8b0aa84b769d566ad913bc8

SHA256
989cc6f5cdc43f7bac8f6bc10624a47d46cbc366c671c495c6900eabc5276f7a

SHA512
c668a938bef9bbe432af676004beb1ae9c06f1ba2f154d1973e691a892cb39c345b12265b5996127efff3258ebba333847df09238f69e95f2f35879b5db7b7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c194bbd45fc5d3714e8db77e01ac25a

SHA1
e758434417035cccc8891d516854afb4141dd72a

SHA256
253f8f4a60bdf1763526998865311c1f02085388892f14e94f858c50bf6e53c3

SHA512
aca42768dcc4334e49cd6295bd563c797b11523f4405cd5b4aeb41dec9379d155ae241ce937ec55063ecbf82136154e4dc5065afb78d18b42af86829bac6900d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
35KB

MD5
a053b626552864ee4e93f684617be84c

SHA1
977f090d070e793072bfb7dce69812dc41883d4e

SHA256
25b3ad881a0a88c6228e12688078638fe0b96210d0f0e20721e3c911a5b37dd4

SHA512
f7b444b1a1c465a4614cd1b9bd678875251f44e227abaaaf1fa6b35bb67bb25932b9b11cc8fabd19d2d5d6e80c6ad0b15149869e6e41f6345db3d49f08683e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.1MB

MD5
d404b61450122b2ad393c3ece0597317

SHA1
d18809185baef8ec6bbbaca300a2fdb4b76a1f56

SHA256
03551254e2231ecd9c7ee816b488ecbde5d899009cd9abbe44351d98fbf2f5fb

SHA512
cb1a2867cc53733dc72cd294d1b549fa571a041d72de0fa4d7d9195bcac9f8245c2095e6a6f1ece0e55279fa26337cdcc82d4c269e1dd186cbbd2b974e2d6a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
232c6a03c424bd60569a82249e647c3c

SHA1
51059b9285f9aeb1488c15627c869f447f69814e

SHA256
bc3d1a0c170a0b05761c1e449decd0d4a2b792c00ad2e5579be081d161fc5be8

SHA512
2b562563f096d186ab4f068dbc44186bd4b55705d3d9c462ae7b4d0155aa75390873f971c419e9584d87871ab1a9b4e00f85b17a704def14769987f725caaf93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
43c0e6150a24a6c8f48a80793b8b53b2

SHA1
340cb47bc0fa59915bfbc1f7bda2db01c9415d70

SHA256
cc0c1db91e86b5320cb0bb0e4f58a522a8d74614e2c7ef3fbcfc6910e4fe7f59

SHA512
3c4775f39ba6fdf47d147ffcec70b275285d88deab917785fb483cdaef236d7729756c14ebb7a7166260173c11f692b9fb380c872722ab9309b6695acc5f5bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5d5292709ac0f2e3dca059dc0f7fefec

SHA1
4da642c647bec29a581c75471b6da083f7e515a4

SHA256
b62a82b3c6cb214eefc4a62c21a667e558f53098beb362701231df79b4270b5d

SHA512
a2719a02767c507e6839b885ce5aba0b9854733b6326a6b2f55e222e61fb468316367134eaeecdd4112b2ae9a12c4881e132a42e92a0f723698f951f43f7d90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
85b7dd2ef629b5311da4b9587946d24d

SHA1
ff125bc22fae5883d9b7028df36d0bd29bfd1dbd

SHA256
91b10819759fbd3fa8be33fff7de0c70ae94ed9ba774299dd6945019e8593e64

SHA512
fbfb659e5b167d982cb1a75f68306e280ba6805a97b424ec23e3a1a8deead0a94cfbfa0ad9bd84690745d71591975bbf1604066dc754e5ebaa65606b891a9ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
71fb3e6cece9959a62f9ac2e0a795ab6

SHA1
24df9f436278b0329046b53046130b0f7aaf0ec2

SHA256
f115899bc5e1a0793519884a45ff37cd028dd514102fd439b492660c690cbeee

SHA512
ef6a8c074c9dbe11a84db95f82395a8b02db1edf280f2ad6c89ee7c711d0fa734531aeca7da760209565130ca85337fcbaf59cfb408167bf065ff50514e442e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4f9587300d3b81de1983a55bbd33540a

SHA1
d725f94d83848b9298c2b0b2a23fb17389733b5d

SHA256
a1bb78cc5b4b4df696f349983ba3982685c16d05cfb5ef94d0f2cd369fdc9eaf

SHA512
6e0b39a64ede476f2c952167fe870d0a9a4d76bda851fdf60230d0f346881797ade4b0beb706a6f4456d3ae364635f61669e3a4fd67db6a006a226c8b9a80c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a368f4da1f1b0641d26a6e9e4ee1640d

SHA1
aa28eac90e39ef2d6be72ce216b916e92181a529

SHA256
619085c200b5fa3d4db249fbf6d843c6ab068458aa7665f003b8eb9110fe5591

SHA512
c9a34d111bb4e0cb1b9c469ee6413834996f1b069aae4496f1adafa58a7a02299a62779ffec5097cd47a052876c9230817e66a10db7af27a69ccc26f9bbdea6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc86c3896459379d9f27ecbaf4151dc8

SHA1
42c2bb88998037b19f4943a88fa269534cb8df6b

SHA256
ef3be7cb4368ebb62851d474236e6d51b7e1d58ea54a4fde6734bc1ebab27730

SHA512
3de6c89ba02057e911c5b215f67395f8e00778b320ee939b3ef3dda9937e02462f7e044153f71b6b3f12b910490a1ea94d3290fbd52749bef98a189c20c65b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
159db21c3805f16a1e9c1d97bc1be788

SHA1
0d3e0a3f85c83100e0e19943e31ce97c1131143f

SHA256
30a3756310802fee954d60a9c2a792a170a9fa53f6d2388d1ecf32828de8dcaf

SHA512
3513947c19eedb9ef98230095f723f733127b4e7e14d3017b469e5194c618710a94efcae51ffea012d6f01dc8684024cc39b04570c4db7dfd2012316538adec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b4002dedbf85e7e44c3ece82de7c17e6

SHA1
7c4859b49883811c2c97ee1b484f27c01b2f21e0

SHA256
5086d54a643d18cc459fcf88c286bae27b4f2bd65007f2d76f9fad925eacdde4

SHA512
261ac401ab7df6be1cef366a93e5cbe45ebf72792bcc73d802dc17b74d4b5da8b2ecfb1bb576b3767899ecb438e0667257c83e3b7cf2b2939109012e9b54895c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddadb50c69ecff0b874facb550eb6d38

SHA1
76b0b6920622e4b0405b4e75a9446ebb1f064eb7

SHA256
1d6e29063626cf26eaba2038763efe2ca5862f73308720f50fff5899b68b78a0

SHA512
480fff9e2cb536be206bd70e211b24dfdfc0a6d930edff163e4f11e0677dc4d11d151bbb38afcbbcbae4bb96901841824437e1fed86927ae720ac627c433a021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a1ae4e50eb835539cb0aeab4dd0bd74

SHA1
caefa78a2b773524b204520767750cac18b06974

SHA256
bfb8e3bff153b2ff595de048d98dc081858f218b0f5c2d5f9c62c5d30d4691d7

SHA512
314d5a773a60c9e9c772a95d3b9050ee232de484ea1ab8b4891e88f21613038368c268cf7761d9800cd675de70d80f186e6abd119e25cdafd2df9ff92e33189b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9edd7176af10f35e09695b87ae054924

SHA1
6529694d4ceaf7d3c5234d6fbe6c62684ae75ff9

SHA256
777448cbd3c37edb2f93856ba4b39ea9b3463622282cebbc075ffc553bedd332

SHA512
460fea7ad6d371e39477a38251fc356c803d9e0cff18892506b52472434cf5ffa17aa7231538c8fb63148a68814f546fa24ecc09f21875e1d060e550d5d50c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c56a49d0ff263428f1168e784a35c6a0

SHA1
77b42ae8588d001cd7022b216043328be2ca507d

SHA256
f320508a0d254c7c27dfd90f620efcab22f63101dfe8e6ec338c4d85638d737e

SHA512
c8a41046628707be459112ac0f816d8dcf8f7c471b2f0d4a724478d87e483f4e9b111838a3ceecf817ed9b65d48315d4eefa589c51b5baf9586b9bbdcbee3c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b879500a5c164fde058d9ca41f2dc859

SHA1
6ec126f4f02bac7bc3a54952bf564e7126a63de4

SHA256
a7917384f7b38faab6b5a8ad2388c8170de52bb9b3bb54796526aeb5c0df2c18

SHA512
5fee1de81b75a883e80c834931ceba4f4c2317a7b14e77bb2b396e0320897361bd28df58ea3b3241e5257486605ee76e8f8a276f02918e7fae388054b93ce196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0052ca91ffe3112df3a0be9ff5014773

SHA1
2a49dc0a4acfbcf74826197f5303b9f8b4d755c6

SHA256
d7ed0de2703a925732e611b2859e3206cbde8acac19b4c34180ee20f073faae9

SHA512
bd8fd5e982ca6fd89d8e4da8ebee740cb1cbf86be8e2df68ee70ae06614a05d0020c3264a952a9af9419dbdfc30540c2838fed9fec23bbf2c95bd7896384e469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54287fb557a034d8d7b92deb55584573

SHA1
6f9dd7f41495021c6d3a1cd3b8ce06cb972ff6e2

SHA256
c5a631b8c45c96981a2310e5a4899f9133be0ae99ac1635c3acbefe0c3ec4f02

SHA512
0d90429efec02e49f513be7b1c03f4a7b8de866cf530672b0985737de708dda86a6542bd5d088dee59ddd96ae0b02c8c2c984affb2ad6b0d46ba2a86605f7a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
93f453b83a1af9650db3ab5ac9f04b37

SHA1
dab6f5e4c7c559387dce3d7b44c4f868b7aa9669

SHA256
d89f7b1f55c6ce241d5255209fbfe144f38dbe02c0b96f423c2b5d2e75a834c2

SHA512
b68cb3b9bba81a5c75c45fe5ca56b289fd90bf23609b798c74e681ea976ec50c388afdad7b33ab78282f560bffe0eb2343842cd4389605a1de2520aa7ca1e6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b0bf35cad6b7488d7b4e2d3b47ceccd

SHA1
e0b5cc1bc31da0e900a68ec0ff8654cb278fab97

SHA256
5af785f343a14d45594e04589619edb51f1eea8f2fd1c89b6d7aa27fdb86ae03

SHA512
1b0354d0aabf1023f1faa4136b956aebfa0016fe89258071940851ae29608d348a06ef898effdab5dcbfaad781571a6136943c4d85f4a092ed6102771f86a366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7cc9a2ad65f1da7c298d4fbb1c530d3e

SHA1
d0729698390c3c8aea2609103745e9cebfad65e3

SHA256
9d97fb8880f7a41ff6f1f84d5dc1d846f7aa71852200db414750febb6ef399cd

SHA512
01465356da730b00ed03fd7d6ae1bb449b503259fd2907f429e39ad73e282c878ab84e980f1dd0933f4a369946b89fad7c5b25eb2fafde06f3acf90859f31176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586126.TMP

Filesize
203B

MD5
4b5e7c1ff53c8613ab05031e73d31630

SHA1
ef1a9d30507c77b23621d243f3a6fe78d90602d5

SHA256
1900636eac43effbb4a93c79b4e4fd6bfdb67b4c0856c8697de1ea4a4f37e6df

SHA512
9974d282e5a29e1a9f2de5d0361b4bacedb7ba9c15bf45241c203abed0674812c9bb76a5e215c061c55acf9bb897708fc79dbef739d974e742d9106022ae901b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
372d263ffc92b6a29239eb69d3b4284a

SHA1
6479602fee4563899dceebfa5d65aa67520a49fb

SHA256
d806783a31a717bdbf783151a28b5ad74474d570f8e5a5dec1f594aaa89c4ab7

SHA512
08188fc8381c8d1141b8f634a6e313699f59e84e7b97ff82cc72ff9701ca2e4b0c9f44f52e195fab3ff7885c69571614bd47370088741a48f8ca081d177a0fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4cc442ea84e763a8dc73691b67bad29c

SHA1
4dc18b70b6a0f52aa38b5683296046d4ccc59a7a

SHA256
ebd43e80613272e3e33a170c7b11ae6aef89ea28ba6ad85cf3b7e765c79642b5

SHA512
cf75e42b97e2e22aeb3ec2bec398bfee94d44e76d0173bc6b0c176c515684a05bb0cc99a3e8f8d58bee18a0417f4df5a5e8045a72ff925f8aa7147ed84020cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43421c23e9a437b6172cd7ee42c7f3de

SHA1
7fb291a289ad14fa9e0e6c17ea0a157120fdef59

SHA256
a933389b26f4af7848101372863f21810ea8d5ad3c82526737dd9e172f86ee46

SHA512
1c0181741ae4c77d0c70c618ee0aed2c4d342e61d3b30fdcbfcd9c8dd56c26e1c25c97699e545c509896e340729e8d4861459474dbf09623ca2e850d5e3a19bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6aef263fbd537d983fb745d03664698

SHA1
d98fcfb857a6f7420d2345199d3dafae6982a2bb

SHA256
0a16f023550c0c6c602dbc8b470c1cbe9a14f5a0c395fddf29b6da01a2d99cc5

SHA512
58e1a07d2ef26f2e0aab12605745a0abe96b74a080266e8ad1efeb46c9480109b13d378db3fc6a455f9d9ec3c251d835b292139ae147530d5187c2e431e7e783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
2ad4b2a2346b391f7e70ff995c5b0107

SHA1
b230b8b0a54eb1f07f9b268003e2448b6c1a6e0b

SHA256
a7c55406a9c034a5394222e9f8ffcbe1bbfc698de4c47dafd77f2156cb208180

SHA512
f32d92b541316e004e896fafe6f1c71ac00ee314d2de43a46cba0e5e15f9dab339eaa84a9d8aedbf1543e357542d9c3d5ebf2c475d3943b6e88a0ef7c4541040

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
aeaeefeca4f06145755ee6bbce3ca9cd

SHA1
618baa53e4c3d1ddd7d588d49bd27144d94b2098

SHA256
ffa55c1bbe921f04961eba9443eba3979701a7812eb6c06b6e8af706acab8519

SHA512
f3e3c5b58d7d4c2c8aab3eb49a567321f09b0befb5b0c576ab86ee5c3d2603cec6fb5d0de08f3144ec647d756f64f92ddfeed6f1e170dab4913ac4f449e35b2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
16fc068843d910c6ae84a11189b5370d

SHA1
cb70944200defbe51657fb545fe5b596c4588a8a

SHA256
ed28d7c367c8722523b773d162906236d18ac64a63671a3cab1b3a00ae8de781

SHA512
78fca754a4e665f8bb372700f14f5249b5baf3a77cc79cf3e95d0d9bcacbdc8ca5188976488e63444ff784a474b44c6ee20a3a1699d809b1cdd92c85bb47418c

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/2076-912-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2148-927-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-932-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-920-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-1090-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-918-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-1108-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-1128-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-916-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2148-913-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-1150-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-1154-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2148-911-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4552-1167-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download