hxxp://securenet[.]cyou

Analysis

max time kernel
259s
max time network
257s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
27-01-2025 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://securenet.cyou

Score

8^/10

microsoft discovery execution phishing

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
38	2212	PowerShell.exe
95	2212	PowerShell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 1 IoCs

pid	Process
4108	SandboxieRpcSs.exe

Loads dropped DLL 1 IoCs

pid	Process
4108	SandboxieRpcSs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2212	PowerShell.exe

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
108	1636	msedge.exe
108	1636	msedge.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\Registry\User\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\NotificationData	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4048	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
892	msedge.exe
892	msedge.exe
3272	identity_helper.exe
3272	identity_helper.exe
4084	msedge.exe
4084	msedge.exe
2212	PowerShell.exe
2212	PowerShell.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
4108	SandboxieRpcSs.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	PowerShell.exe
Token: SeDebugPrivilege	1236	taskmgr.exe
Token: SeSystemProfilePrivilege	1236	taskmgr.exe
Token: SeCreateGlobalPrivilege	1236	taskmgr.exe
Token: SeBackupPrivilege	2564	svchost.exe
Token: SeRestorePrivilege	2564	svchost.exe
Token: SeSecurityPrivilege	2564	svchost.exe
Token: SeTakeOwnershipPrivilege	2564	svchost.exe
Token: 35	2564	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe
1236	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4048	NOTEPAD.EXE
4048	NOTEPAD.EXE
2000	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 3844	892	msedge.exe	77
PID 892 wrote to memory of 3844	892	msedge.exe	77
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1124	892	msedge.exe	78
PID 892 wrote to memory of 1636	892	msedge.exe	79
PID 892 wrote to memory of 1636	892	msedge.exe	79
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80
PID 892 wrote to memory of 1608	892	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://securenet.cyou
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a8e43cb8,0x7ff9a8e43cc8,0x7ff9a8e43cd8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1292 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,14902845866999784173,8989924839154907495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\tes.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\Desktop'
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mezpqzzp\mezpqzzp.cmdline"
  2⤵
  PID:3684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8C7.tmp" "c:\Users\Admin\AppData\Local\Temp\mezpqzzp\CSC84DC9021594C481DB4BE1F8AB4014B3.TMP"
    3⤵
    PID:2988
- C:\Users\Admin\AppData\Local\Temp\extracted4_5071\SandboxieRpcSs.exe
  "C:\Users\Admin\AppData\Local\Temp\extracted4_5071\SandboxieRpcSs.exe" -ExecutionPolicy Bypass
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1540

C:\Windows\System32\uexpww.exe
"C:\Windows\System32\uexpww.exe"
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
45KB

MD5
2ca67d9f2114ab3aa3da598bfac6a255

SHA1
6c41c18db2b548dfc08b257c131f6172382ec903

SHA256
211233c953415e5c95b76381ef51adff252de3e068861ec64d2d992862d90043

SHA512
d61f7633437bf9b0bf89fb7e3427e4f643005455bb8dbbfd6208934f2a8189ada966c71bed9aafa5e4313a8597822a60782170d26eb044c5229f15183a641f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
32KB

MD5
2e287eb418940084b921590c6e672c9e

SHA1
1fc75a9daa054ef88aaea181f3a9b4cba2b6b6e1

SHA256
6c2c58daae76131a00d1bfee20852f372cf594be7f4a8848acc42f8bf72c1bbd

SHA512
a77f69571b0f04f4a2354d9e18e41ef86f22274eaed20c02215b632bfef09c6543a83591e9db3f2b4036a9684bff666eb6a7b253ba18893500e9cd541ab752a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
17KB

MD5
7916a894ebde7d29c2cc29b267f1299f

SHA1
78345ca08f9e2c3c2cc9b318950791b349211296

SHA256
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

SHA512
2180abe47fbf76e2e0608ab3a4659c1b7ab027004298d81960dc575cc2e912ecca8c131c6413ebbf46d2aaa90e392eb00e37aed7a79cdc0ac71ba78d828a84c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
47b4dba7fe2b4bbb48a5d73e81d1d1c7

SHA1
4e26c1631dd9c748336d0e9a9480fba5e00a6aef

SHA256
3fb4325b60f41ddc8520c28ae1e602380ab505855569c9a2e610cd7bfb53b24b

SHA512
44d5177584d7ea49599c319dcf406efc0e3a6a5d59c413e6a10e8e94724030ef9c888f438f496ea4ddc6620cd4860ad34ae9610ec8ab081c9622538f10892da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ec61e3141105484bc84607ad9393687b

SHA1
aad139e859ad4c767a1933027fb718249e0aa7f4

SHA256
fc376970482838ed2b19a822c0eb66197e16f4519a865c048f34da40d00747f1

SHA512
e3fe322985a10a15cab66545a4a56310311d132360e655e732316c2674c440a136041a778d492246b58f40a6726c58efabe9b1d486c2a58cf845ba92c204c279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ec1f17d6d6d348cfcaad5a8b826400ae

SHA1
2f932431e3dc178ea147e60c396c2e3f1662626a

SHA256
d427f432b40b2925174af31bb5ff62bf1e07ea2c295c6b7ae28766104d30266f

SHA512
8145616b13e0afd0f82e41abd48c4eb4c64046803d438ba14f31536bada86d3f22fbab88e71d2ef7d81dfed4a402eaad4676f7e53d3fa0b6fbd1d44d7242d939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
a1a789a4b6af114201e3eb74f84f0b38

SHA1
a513b4b327f87f18ed22972d9e72a16f35d06b86

SHA256
16f31561183ff53a7a089f809d1ed6db66d27f57cfaede4e67737b8cf0d79a61

SHA512
2d8b40b0d70c4d45740f722451b7576e32f916a18a2cb2d8ce037cdcdb0caeba0242a73ddecda469f21672965c3e0ed457e0ee822b8b2677e4732ce6142a032d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
c393912116f0633b630cbc8a5053cb8d

SHA1
69c7310d2e350f45333b56d1b4f206972e25a239

SHA256
1b71d076fdad58ed5c019f017a0d1430c9a48be55094bcf8c3e6ab4b9e79e4cf

SHA512
2797b809e29c208df213e88dcf498eac2c816b32a1a9991a53649ac546015f2cd31c510782b0957846f7128750239bfa7221839cf89228d3d7728d5bd850b828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
112eea9556bb4b19167069e33bf7925a

SHA1
d5febe1b2f1eba2ff50899766101b43990365da4

SHA256
a5bbaf637c19ac2065894345f193fb44f46b86036c0b8632b89b62c86b5f7dbc

SHA512
530e4cc8fed573b3051930e27f3003b096464df2bf70ff43cd67e818ca30bfcc10d1ddb596d8db250223b7f5ebf83a7fceb00f186fd63d37b35af4c98c9c5e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee15502d5adc764250d09cc1a1fd643

SHA1
b304073247a2a088ebbcf6ed233de02d3a664d68

SHA256
83b6e30828ba8500fad6bdfa27847cc5cc84a9e173bcda78c83d884e85da8797

SHA512
5c75087f5b0e5985433296e4e92b4ccb7fd912204db9815dddd96d8202282959330a37a3c3c29cd91a1915c63eef86f99accfd3ce03a7953767bf97c07785d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7eda1af4470a9a377c79a86fa2b4e9ea

SHA1
027c003d0294772e58282f5c412ae6441ed46d28

SHA256
79749d16ef08a1a7e26a08a1f4933019c497c584bff53c08e4342362b5dcfcf6

SHA512
d240caad5361551b0f7e1399266fcb9d05f3b93db3731c49ad9bc8d7407e5b104098ed21e19f5ca4804775fcfe3f114fa2454719e07d8c2bc24c841af151eefd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49248f64bdb698c50248163f856f6703

SHA1
113f7c02028a14608321ae9ccab3d60abb5cbc83

SHA256
a46c034b70786bf8f9410c517d9d99015a66f89a3738a95c2a665f27eaca43ce

SHA512
6a51d50e873ffa291fdaef2d18eee6fc4b4ac0cfc03325969e0b3dd2364f6db2ff3600b975c4615cdceef6440f2d9827cda9d3676518d41043679e457e38d513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c814b0e06a45cd163d414ee5c8293ff

SHA1
4609bd6f0a01e5b8c7040114b2fe05bc48e9ea0a

SHA256
74de2daa3057543040da729617f9907adb0ea63056ea72874a74704e5df26df6

SHA512
841abdd6e82a383ff6959fbf8aae3d7c8c34fc05d2d04c9bce0ec43aa5cca227bb4d046e907829f72a3a3e771cc21a1c63892e117804da7d46ddbbeeee0c8e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4965a675aa11613134341470cda720a6

SHA1
602c709524138754c4a3f10c6d88dd6d98e1067d

SHA256
31ba996b9a288abcd399cb211253208e290c13caf2447f0bb6d8a434991083e7

SHA512
6953ddefd03779c0ecf11aac00b7776d4396935fc288df2137248fafc43e8bf7b5fa341e2d5d1d60ee9fe586b5575d017355ce43e1e856e2df6c69b4eafc546d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a5c20ffafbb9a769798ec43634bf8d77

SHA1
6aa38723fd015f35f292f68092201dd8fa37c68c

SHA256
796b3905ea22bb42404a9a3bd2e1b7b5586cc66cfe2bd4acd52e88f99c6fde6c

SHA512
1d1bd49933ad36f2f69a3a124e70f5b953139e00068ef7a1089f410d7ffbecc385ae413bc18273ed59fe7640b095cab85a7945e40a52ab2ef746fa897c83c045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6e2db49a71ab2f1dec23371e207a6463

SHA1
893102b3024fbfaa7d81fa4f455f65356b270466

SHA256
a159e567e7eba44a061332b53cbdc4bc4b6e7668bfc269a09d85f4530445f53b

SHA512
e8cd72cd606c2a45f28d48ee4117d63c031180b4a7bd9794e71dbbcb8ba83af704bb24c18a00d40eaeeb9452766aaf09df2af21d482efa0e7f5e599d08388f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
310b63c27de9fb5c72f9d22224ee36b9

SHA1
f3980044f9f5a2a180be3902c770da01c363a1b8

SHA256
f6cdc53e724da1b70a4325fe50a4a2ccaae2c13a6a3ddae5b214b8bc65125b57

SHA512
0e84ff8d781e96a1f2281e88340ee039f7de0c4b7804b1a0f89fa88407d230d8ce1bda3ac00ebca77f024a5f6b5bf6e0fc04b72acfb298298815877c3d896e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a97cdf1ae15c72140763a145cb46677c

SHA1
0d4da34200e03302821cabd0d91a0bcc5dcc9682

SHA256
c6f013c46bbd644a8d15aee1c13ece4ae4924b0034848441461e9a95b9d1bdf2

SHA512
71a97ec45f6b6d2c6118e50fc62ecb9b151b0f027041073146d4af00bc60fb1171a1394e5d711754766c0df0723c4db8aeb3f0aa347744329d1b4764f66ee8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1adf55bb33bcf4742cc82870c7c34881

SHA1
d2dba58ca4897bae22f939e5aed76b2a3976dfc8

SHA256
97851af3505829e138471518ee0689fde14e8b6cce7951a6314201b3613df370

SHA512
f81dda629eaa720c40968ce9e335a5dd1dc45305c0b13952e6e3ab0080ebb9685b6c5cccb7b2207f6067e6ba43a3a1f3f9b904f829fb355e33a221de52dd58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
71ad56c4a59a59194fe563f5e8fa747d

SHA1
1ead13ec7de4050738351cb65644b6ff510a9cf9

SHA256
619a25e272339d1f1b7eca2c992ceb5f5b816d1c2439f15cac4986ebd78ca83e

SHA512
08878849a562b28dcbd499f0462f955abed69e3498cd6fc226c53d094ef0d70987ac50a3817b10fcca34976c3ef8ebcd079f3a7cda8158a9b20e8c72b0efff88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a22ac.TMP

Filesize
1KB

MD5
51a25ae334eb475673b235bccfad03f8

SHA1
c4a18ff31d5ddad31121b24276cad4ae777ec880

SHA256
3ce342a3092f2967ac3d4903583f27034ae6643987e80c6b47769617733c4ce1

SHA512
a8369639761d605988b15c5120f95635772558b1eb7d057f304fb2639f91abea8f587e07e982b19c5f46bb2a4e6fa65b0d6f87b6c782e2fcd42620d54e2c483c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e531cec1d3a1eeca6997633b1401380f

SHA1
d95f7fbe57890a636e8014a7191d8d276117e54b

SHA256
62f6e0e37f1398bac1db9f4bc7108e7aba8457df6c3a86a0edaa2445d516836e

SHA512
ab6f43a109114a96e462f50f477cd9ee8319fd239f101f0668988aa4f1dc166b34e7b9e71abb62e06647a1d8e82a596a44425d23aee27cadc1d6788f72690654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4e10b32411c8cdf7ce543598d934a9e9

SHA1
10154dac659d4e188cb5a3633bbbc3e566c8bb00

SHA256
cff168f2646e3c0c177907ea07f8560e5780d75f5b149f7084e18b935c263fc1

SHA512
ed6ae2568f8259d4a012271228b00e51fab15073c6016622844ae346905be6ef22381231138a105b14e4f7edd4a54c8942ef892ad30b9a69db65fff2e2c60f1f

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\9b6430b3-081b-4f2c-ab33-0872c2959d89.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
b7443e89f0cb29d51ee6a257750e54d2

SHA1
84127eebf275e781d5276af6fc4d09c5a6bfb7b9

SHA256
8226877d6ab2e4834aea6bc71bd9865b28d0bd1ec2e8b4c23b8acf0301c56f26

SHA512
446cfe25d82f3bbf7badd324cae691ad62e13bd7469e415f47b9141bddf30679219c672937f4f6768796c2936c3b9c557fabbda1fb51c5edbb7c1964bffa17be

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB8C7.tmp

Filesize
1KB

MD5
e79c4fe22502f13ba93c40a144075dbd

SHA1
aa5a305c6c9ea3b14704ab59c8bf44e9a3cc91c5

SHA256
a87857501687426e4bc6d0956587f3f2ce179fa01ede6ef4026d0734a7d97f41

SHA512
50c6b9fc503b07cc8cdbb96ea31e2bed5d3426549f7edd4eec1e29d6c24124c761301b74bf6e672a601a01f013d842774a93c32df99939bb800273d779d7735a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_di0hopvu.jnl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted4_5071\SandboxieRpcSs.exe

Filesize
164KB

MD5
e02bea8f92287f00daa60f4c09d87474

SHA1
a80caace54d58ea9d920d4f5c8491b312a24b270

SHA256
68ac1081ba9d4654ade44421856176beaeb950423ccf343d2f4aa95a3ca81dd8

SHA512
1d5299c3fdd29b30caf3f18312310d009ac18c4615be2569ee4ae3103fb6531a7804dc4d00f57a5ed9921745a2ec329af9317ac30fca900e7106337cae966a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted4_5071\SbieDll.dll

Filesize
856KB

MD5
9eceb4b76ee3fb0896e238a2e1b756f3

SHA1
78c574f340bb3436b25114059a754fee12713a41

SHA256
0e3b5ff54be379ae906f26993f518d69baf560cb4361f1d9c75de729eb1123ec

SHA512
25e035377e101546365a9c2bb66678298e7c9a0820e6ae83f0dba14575bee675a0be5807c3374f6f9b1fe40c5cf4b311d6ded1eb0f217e900579493048f682af

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted4_5071\hoax.html

Filesize
807KB

MD5
8863cd1f7a332c9769f5f46d357bfc9d

SHA1
f6c6edada2b9e3b2e4e4b3dc77a07b95a8fda837

SHA256
d7f179132788986eabe77812f40ccd710c10e11a6ee7adf231aba49f9e75d679

SHA512
4d2031cb4316624a9a773eebfdf1eb0ee2aa91bffdbc6bade65424c089bb48df5aa3dff10076c2f2b67801352e03ae11a172307556ae79a095b2375492747b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted4_5071\insurgency.json

Filesize
38KB

MD5
0e86b6177cbd307bf758525bdd172109

SHA1
6599869930ae754b855c632535d77cb116c54346

SHA256
004fe405f8dc3b5b2922c185581c8972bd985f62714abb6aa2cb516d0536f261

SHA512
163d3c72ced7ab19fd687d41508e2dbfbfae4ac7a12e09d4c4846092d24b7e2b62094cdf92a630540b30ebc18fb6f7398ea52571b42aca54e727e7247f984cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\mezpqzzp\mezpqzzp.dll

Filesize
3KB

MD5
1e83d10f48bf87dbd6020192f27178d9

SHA1
895afda426c921efdd208085118e7e9dac5d1468

SHA256
c8768e5d506f405c8911d10970fb78619ff3a4723293b578b3f00b1a665ea2a2

SHA512
5f983430083019b8261d789f40160184f7459d64dc445f52ad8796ae5df8649169c48f1b754726cd642e68b841eaff45642c84711f5b29d6fff9544e50bd558d

Download Submit
C:\Users\Admin\Desktop\test.ps1

Filesize
3KB

MD5
627cfcce810d5da6c4eb10073178e2ef

SHA1
922c7b18f187a86222e892bdafb05a1b3b4b561f

SHA256
064c367bb66501dc041fa66876fc49df98ddd807969365be1a24d7624d239a1a

SHA512
15192c526d77d6ed72a0d9de546ac080e7e649786fe3591ef8b412766aae7c4829121dcf530a38b3efd7cb8a66a236db37d6a368045daefe03dc27852ed7518d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mezpqzzp\CSC84DC9021594C481DB4BE1F8AB4014B3.TMP

Filesize
652B

MD5
3eac0855a0b5adaa8e96b519b71742c4

SHA1
58b43c1d4d172d7afcb4038065af2bcb2ef102f6

SHA256
b83db6f8e329b1c51ea2f7c23b465a4065b9a3db4e412e86bb765dc79fcfa78f

SHA512
a9570f7fcb7d6d1868014c6211047899cb52d0c210e360bbcb5341c3e2bfdfeaaacd23ddd55399c08d03389974dfedb221d57bd782eea607a8f303a34f9a97bc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mezpqzzp\mezpqzzp.0.cs

Filesize
263B

MD5
7ef2dc814f5c082336d1fbe487a53299

SHA1
47cd4aac3e19115385f1e3e9c9f43736133c5a4c

SHA256
89bdfb37bad7981cb859d457c6da2ac99d1f6b3c8c3324b46c569f2cec1124b3

SHA512
c9e75f7c5b9d4e1156dfd52f9660ee1c3b5e0a8502de4149282d5ec8ae541d4a64a69d8a9f9027768d8fdcb17a89a7613b5a56902f66ed217c8d195e1851ddc9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mezpqzzp\mezpqzzp.cmdline

Filesize
369B

MD5
a09579fa3bb84e5868af2efde0e00461

SHA1
9b8e3a2536177efba399829666a3f15e32080dd1

SHA256
1e4c634398a3136b27a0eb9610b30a887facdc5a957d08c1a5a916cbb2205cd5

SHA512
5c9c4f06e4682302e2af4ed8968676a59f1c9b3508e10891be1e0b92258e8c3964503fda74c17127158d81839924a0f1eda7f40e616fc538c9c01bf38b647fb6

Download Submit
memory/1236-623-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-620-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-618-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-611-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-612-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-613-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-617-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-619-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-621-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/1236-622-0x000002388AB20000-0x000002388AB21000-memory.dmp

Filesize
4KB

Download
memory/2212-199-0x000002D555B40000-0x000002D555B48000-memory.dmp

Filesize
32KB

Download
memory/2212-202-0x000002D56FB80000-0x000002D56FB8A000-memory.dmp

Filesize
40KB

Download
memory/2212-166-0x000002D570050000-0x000002D570096000-memory.dmp

Filesize
280KB

Download
memory/2212-157-0x000002D557AD0000-0x000002D557AF2000-memory.dmp

Filesize
136KB

Download
memory/2212-203-0x000002D56FBB0000-0x000002D56FBC2000-memory.dmp

Filesize
72KB

Download
memory/4108-227-0x00007FF98DD10000-0x00007FF98DE8A000-memory.dmp

Filesize
1.5MB

Download