redline | hxxps://bit[.]ly/3JjG9ct

Analysis

max time kernel
114s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
03/04/2025, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/3JjG9ct

Score

10^/10

redline defense_evasion discovery infostealer trojan

Malware Config

Extracted

Family

redline

37.220.87.13:40676

Attributes

auth_value
99db4fc4c325a4d794f51354d6bff7ae

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/5576-1943-0x0000000000730000-0x0000000000760000-memory.dmp	family_redline
behavioral1/memory/5744-1956-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Redline family
redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Synapse Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Synapse Launcher.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Synapse Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Synapse Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Synapse Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Synapse Launcher.exe

Executes dropped EXE 2 IoCs

pid	Process
5076	Synapse Launcher.exe
460	Synapse Launcher.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Synapse Launcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Synapse Launcher.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 5576	5076	Synapse Launcher.exe	122
PID 460 set thread context of 5744	460	Synapse Launcher.exe	125

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_521995836\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_990807450\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5776_72278556\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_521995836\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_521995836\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_990807450\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_451974929\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_451974929\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_1612141418\_locales\zh_CN\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881923527930348"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{5B3B52C5-028C-4B60-BAE4-E08DDC8F99E1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\synapse-v2-launcher.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2736	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2736	AUDIODG.EXE
Token: SeRestorePrivilege	3108	7zG.exe
Token: 35	3108	7zG.exe
Token: SeSecurityPrivilege	3108	7zG.exe
Token: SeSecurityPrivilege	3108	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
3108	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 2184	5776	msedge.exe	78
PID 5776 wrote to memory of 2184	5776	msedge.exe	78
PID 5776 wrote to memory of 3796	5776	msedge.exe	79
PID 5776 wrote to memory of 3796	5776	msedge.exe	79
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 2028	5776	msedge.exe	80
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81
PID 5776 wrote to memory of 1128	5776	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bit.ly/3JjG9ct
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7fffb6cdf208,0x7fffb6cdf214,0x7fffb6cdf220
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1976,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2484,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4808,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3864,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5116,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:12
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6140,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6080,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6696,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6704,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6808,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7160,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7264,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7320,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:14
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7440,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7096,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6240,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,2781629831833696617,13192241069863719234,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:14
  2⤵
  PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4144

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap28704:100:7zEvent12732
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3108

C:\Users\Admin\Downloads\synapse-v2-launcher\Synapse Launcher.exe
"C:\Users\Admin\Downloads\synapse-v2-launcher\Synapse Launcher.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5576

C:\Users\Admin\Downloads\synapse-v2-launcher\Synapse Launcher.exe
"C:\Users\Admin\Downloads\synapse-v2-launcher\Synapse Launcher.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8272581d8cb38484cc8cb6afbdd0d37e

SHA1
2baa96a0439003aabaad1ce5619ea0a581cf261a

SHA256
025356bf819ea8a5da44ac2c4510bc380a9448247a30665577430ca7a44ca297

SHA512
60574186c595b0018d9223afd38e59378b1b00ef4f39be17ef2d7613cdac5b8f9e6dc3f2efefd559a0e4e8d64884d6ea155e874df13f170bb6dfbb41a0104959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a4ea0d6f2b1ced257cb7a06743eaa364

SHA1
b81e0940f14b4ae3727b8df5d2bb169bd31373b8

SHA256
c818ac22ffc0fc074418e2c5ccb5038a2faee62e265366110af81ddc39e3c553

SHA512
1323433173043a66d0973dff7b2811d4a83f2a2c23fec0f2a29faefa8b78638fa50dff829a8fe34fe437c9c614b704012bda9b584614ea527c149cbabefc2b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581c5d.TMP

Filesize
3KB

MD5
47d2004f1aebf6b4962e1107fa3706bf

SHA1
f1bdaf92c48617fdc12a789f50ca6567e9898fae

SHA256
61d0f7504c9d9a69c38d2c9b2cadf1fb8f521619b596e877e6a7176eca158107

SHA512
5ba10bd4038425145c8a215336a9c0e58e0a54fd2bc37344a8ecb785f00aa11f61a5ec6efc32fd70040564dd465aea6f03f4baad1ab5ac9a9b5a4fbab4e01fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\00\00000000

Filesize
2.6MB

MD5
807d7f1e0fca5449d1a65b4cdea85373

SHA1
02572e98f568c83a011ab083bc7b826832b0db75

SHA256
d935d806a254cd47dbfa7275e3c72fbed074bd6f7304c813633c4a5acfdef820

SHA512
8937efeb1b311508b58e897736eb19e699f61ea06f80bf6eaa0e55b663a51c0d0536144826582940a6d5a31d27b09f1e4667e5d03bf22d0b1622e1bdb57a23d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log

Filesize
7KB

MD5
789af2d20251dc089215d8da9e12c995

SHA1
6f521b7b6648b71cf0b4173579b8464ee178fc11

SHA256
adfb5b6d5eca8be9e9893dc531e471f977f0976d8a9b59a1b0613e71fb5e6b35

SHA512
a10d6f4d71dbbf24d2c6bc51a71e6f11ecaee40c643bead5c276e22346d2913963b082433d5f5ec53f77a1f2a9a667d048c7bea0a0d30c9204e680de647f781c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG

Filesize
375B

MD5
afda4d0efc2c933a74143e31f0df131e

SHA1
0ccd4f3e90f4a9ff70ecb8445ba12f6d614490f6

SHA256
0a7e67d942febad0d2adc282eac4f1f74cc796832905cee3191adf897919744f

SHA512
73dac17090905f2db25119721337730c4ca7a675f9bc06b983f5346db35e2df762c8a17143ff770b77db464479a57e7059e576962938014e8585d7772d198315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG

Filesize
375B

MD5
c4e487b93591a2794a82e29f9c30797a

SHA1
c00cf5347ae77bcbaf6ead6fa59770d13255efb5

SHA256
3aad50f3da2c28ed3e65d613749c5ddcdcee56c9554d50664823bb678d6f52bd

SHA512
5cf69358e0cce8573f59cf8114f0cffcba9476c25e828b58e140c38630a47b1cf4d45e9943c315974c30ef3c82436147df6c1049e8f3d2deb47ce86e94475d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG

Filesize
375B

MD5
f3ebe060600f2e1233f7ff6f899fe46f

SHA1
cb1f7b1dd5822c3fb79b926775554a5bcc4273b4

SHA256
8f49cbed4f8ee1263a6fd023ec1edeb8828c518054f3adaeba9264886defd629

SHA512
5f0aca3e28a29a3cd9f79377c1d3b466f087c47e498e2ef4e08012f3c574918bfdbe34428d21597c4901ab343bc41f850cc7e25834fe0a78e4e5f7cc5d0d8561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
335B

MD5
dfb6b6eeb0d9544d9796332bd03ced71

SHA1
da2199ba4afaccf45e48f9a642b326d0d3bd124c

SHA256
1ec4a2f134a38d038f4cba3695a67a4e790c3077705246f552dc3a675e877f66

SHA512
1416757691eae87d60f62aea22a1b0a8ed486f6eb3e11b6f85325140407aff1cc8b78d8f51e054f4db996c1116c2b70e64139c75640fee006b8fc693e7b41d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a298e8c7c99d965aeb277162a89f9ccc

SHA1
3062e507c3e28d4a8cf591d85c49a86dd4c13669

SHA256
b49fbe18fe64440762d3436d63a847be8d797b1dca8659c265c49a95480cb983

SHA512
c8d149657e8890c08e93b126825172dde63c6c82ef18a1323843e778d48982f38441bdf452a92ead5e948a88af80fff46c82f5bea1b092225044be665e02e63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
402869448dd1e9f3d661ed30a6efc442

SHA1
638a15046044e78580fdaf3787d6dfece636374f

SHA256
403164e4e1537b396e6aeb065a0fcaed58a0bbda173b6107a09f40376a91209e

SHA512
6fc1e7eb6dc183fe7d7eaec74849581b1090d11eef175cb9a3d2d00c56a729affc9b31c07c7d671fcd26f65fe1d2f2fa5836ff61b160d83015d9fd63e756d80e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ceb0e8608930060f250ea96bdaf5faa7

SHA1
204ac7402a97f62cde177d33e0c88e97af0e193f

SHA256
23cc55fccda8320e52bddf68fa6d54a85ba70c60052c1be23e2a6040d7732c46

SHA512
1aa39f02fe929165306421869c21872733df9667096eda9d0fd83d94db8f6cef8f7767e1db5183a00b0dcf4c4a8f6e94cbaf508aa93de891048a9db7f872b68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f73e0cf827b70baf990bd8687764452a

SHA1
2ca329b72c93653f24e3c3db81444f16db94404f

SHA256
dde446d76a992a93a0416fa3d116b5d5b3e4e889edf86af7c82937f61deef501

SHA512
e19d3ca9601c7fd94e5fb99afde68294040e783a540120e25c928a9d48a221c5dd9a62773e809142daef592b327999b2c84fdc6796983ec46c447c5b6779afc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581f6a.TMP

Filesize
48B

MD5
a16cda8d2a16354dfac0739ae19d5984

SHA1
bd601f74e7827a2042cd2a23f5fee894ecbdf3d1

SHA256
68516d3e89be0bad07a780c25ee87d9ee47ef46b0d07e02c2fb7ac65008f4ac8

SHA512
86cb4be7c4fb0d9241eb7ef61286dc2f6474a4f99dcaeb4a665fcd2f0a8dcd331a1758fee3e42a4b1ca84245286a0fb00a3e92787b55f84a1f07800b94f7a1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c9d4301fd492f4fff93c677713b45d59

SHA1
228d43e7a64ea51342a7ba3d82d0ca24d7679031

SHA256
133c3f4d12d127cad1b3a93ae17d620954854c714ce3f48c48b0fed3f23fafa0

SHA512
8437523d28804de09cf41b53b500b949437fd41f1395116ec7a2aa562f2279b4f7e2f44a03af1c053f13ce8102e59acfc0ea8e697c830113b64e5cdaceef396b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
d829c8f70da9724c5e5919ac7eb8f42c

SHA1
76d9c768448fa29830eae8a6ba54fee58da6df77

SHA256
62cd421d704ebc069ccdc1fd18e20ee6166cb2822d2e0f338292d3f1b2ebeadc

SHA512
356e187f5d39b9dae6216371c7f22ba7dc8f7e97249f49f837eb2bcbf5d5c2dd373015d340e793d536501b33fe7fc4c68801be178e6d1886081599441bf0fd75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
daaeee954594d5465a3965fd75103c81

SHA1
ec31fc60f835c88edafc69d6518ea4d8fef26a5b

SHA256
3e99400f150b582728d5d0d969ac732ff4b12b5ba718ce10e71900d3146529ec

SHA512
317edc9410f740ddf9a32466f2e5afd8594cc79b790fbe86aa732ee36cdd2d516807f1bbf91e4c932633f1148d54cdd4cf70fad4383c0dafb0ec3a8deb1b4808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
d4e07cd9473ce5b51e6baa95c4e72afe

SHA1
c0abc5df2b6c8d77326b82be3edb35e55a19b372

SHA256
0d648ac6459b195580565ac749bb911d6833d0ec664bd316b44bcc5a8992cd41

SHA512
7372d376ae50c16a7db3a54548bbf33fa944f0a3fbc57189c41f32f81abdd0dc2bb22fea034424bbdd730a16ee9a95f4322b23a91c2708deaf1a0ac49fe3173a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
bb5af45c7f7bb041ffdebca5791a8dbf

SHA1
7eeb3d813eb5892fc87eecf87c2a5428b4c9b2fd

SHA256
97f0e172391ad590e722ad6af662de75a35ded09d2712f3bb10236256fb4990e

SHA512
22538cfba097985bd313949774806ec1aa26ac85d95bc8f850fdf2f1d5bbee43fa427851c82b078a3c26d74444bf21f5e4c26438a2ffd584172724874802b9d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
224ba4ae9e5dc6a440588955053eb131

SHA1
437b5c1c89feaf0caf30f42d4d1cc01744bda1d0

SHA256
aa766856a57e57fbcc5d6b7e9702965f3bcb66fe008af00d51e40b90d5fff10d

SHA512
9c3f78e53cff6b2b0a7006a8ca04c23e45fc2c3d268371f5b6b0bd5fce7d8dbcd639717e018069807c28b5375ce88d326e86b06f6cefa15fa128a63d97bb4027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
79add85f98fd573cd94b252455471659

SHA1
e3630cbfd291afc6e6398f635465288c4a1a8ce1

SHA256
54eb2515cae91be3853cf0cd9600a0054e02dd2e6262b1e6379bc25363806d05

SHA512
5b04d7e409fa090b6c62929e5a9ec3d7d2658a36a20edeb2529151059df24585346a0a0b9f63023e196db19181b5450cd967433b5d8e9cd6efcb35fd6818f647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
23de331fdc4eb41fbb021366dbca2daa

SHA1
3071b9a06961f11bade38cef706ff0a2a190746e

SHA256
e395cf13e90d2789f73fe07f83de43eac621d51bd72bc1c9cb83c4b1daa327cd

SHA512
0cb4fbc42a7823398327025c99a6da4d8e822ce17d333960960b9289212f3318dd5c6b4b2f76b42124a1be25c4b8ccd2de8050a938e5c55095d31a5d0e9311d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\Synapse Launcher.exe

Filesize
2.2MB

MD5
233e8d9210b15691a3ff334889ae4518

SHA1
63a48bb47c4c910625fa142aed2caf90c15781ca

SHA256
de2aa03f8fb3593c4f2c90709a9d7846ff0ac35e9768ca47443c3e0997b0fa53

SHA512
9776beab41be2c821c0aab5c1715da65f024bf72dbcdd9ad5f10abf3263ecd5bdf0c6831b45266baed57bf2e2de67abdd405d0c22b4114c5bcdae663b69e406b

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\mode-csound_score.js

Filesize
14KB

MD5
67d3027a53dc9dea93e8badadac2c08c

SHA1
e7b8064b0c9aafbcfc27b39ed66f96eeae054e63

SHA256
dfd544612c4b4c146234c397c610062ef0a64d84ca61bb146a3d74017b93bb40

SHA512
091fab4c78f777f27afe3f10c7ff4777babbdcaef75ed99cb12b7dfd831f7ee9837d418f9932eccac3691abd508a8bf64753f1ac7e4bdda85b9792876400c7ea

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\mode-django.js

Filesize
101KB

MD5
f35de187177b0165615f713868e14448

SHA1
918a10274d31f09a0fc96b1b5d0dd35d6c0f136a

SHA256
624dcb5438d0d5bf3c630e938da5f0bd2d8bd904fe4316afea82ce8b7f25d56d

SHA512
fec3ec6a120729367801800ed585971ece19c032ff03bad38074d2ff0f4310ea872a48dadd80c9d9be7fcde07fbacf8b67ccc4052dddabcb4f38a1398fbb84a5

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\mode-ftl.js

Filesize
50KB

MD5
71451c50ed393d0071d352ddb2e56330

SHA1
cbfc8767bb4baceab37805257997c84f4264bbea

SHA256
2437cbce03f95681d4d31f50d2c5079ed35289bba9f13b1f62da20c73c3f06e2

SHA512
219f6d3deee708706ac4e8fdf4f7161a3cf4b6b719763680783e385d9525c0553fe4bba46157a5610e434c8fb40d88e46e54688705925710c4be782f80986fb4

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\mode-glsl.js

Filesize
21KB

MD5
8ca9be0b4f85aa607d8af3c05c15b20d

SHA1
11f4bcb7b70f1a5bc6eda16825a8c40d81f4b616

SHA256
69343926d5bf317dff9a42193db72989f8464518508a83f642f027745b44e217

SHA512
c279c05f3d04ab75275b4fd61999d4d8b005e956b5d0a1447d00030f15b061621c680cf7ec462cda3c0b669e1b957e9edd2aca64debf6258c8e123ed3f0c9712

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\mode-sh.js

Filesize
14KB

MD5
37f7cf0e0a639840d67e81e0a3d257dc

SHA1
4e59399b4b5dd9275ba58fc5c7640822af8891c2

SHA256
61f9a37f096997d0f8a4de024358c443943e8eecb2a8d023dba992212e3d1534

SHA512
f4940712bd359338eef2498b5658938a1e3cdbc967e1b17bdd13b6136e6661785abad4537daa2136274b8628cc622035e7447c0fa986f0db77f58f7d1ea56588

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher\bin\ace\worker-css.js

Filesize
269KB

MD5
efb7f98bfc7e9c92c7a5eacd72ece9e6

SHA1
0b6c2de65deb556163893762146c88e7451a3945

SHA256
53468a5a21fda1bdc6838d73255f0f0b3d7030c745077d09d4cdc41b20796f5a

SHA512
2ca94b561e2d13ea7f91ea3087c2c4a19ae3862b48ebfcd934f9f3c95eae3e49f8d6cdd69d8254a88985e3c57ffc3935581ad615dc8fb473720cc64dce9e50cf

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_451974929\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_451974929\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_521995836\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_990807450\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5776_990807450\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
memory/460-1962-0x00000000000D0000-0x0000000000304000-memory.dmp

Filesize
2.2MB

Download
memory/5076-1930-0x00000000000D0000-0x0000000000304000-memory.dmp

Filesize
2.2MB

Download
memory/5076-1948-0x00000000000D0000-0x0000000000304000-memory.dmp

Filesize
2.2MB

Download
memory/5576-1951-0x0000000004E40000-0x0000000004E52000-memory.dmp

Filesize
72KB

Download
memory/5576-1953-0x0000000005020000-0x000000000506C000-memory.dmp

Filesize
304KB

Download
memory/5576-1952-0x0000000004EA0000-0x0000000004EDC000-memory.dmp

Filesize
240KB

Download
memory/5576-1950-0x0000000004F10000-0x000000000501A000-memory.dmp

Filesize
1.0MB

Download
memory/5576-1949-0x00000000053F0000-0x0000000005A08000-memory.dmp

Filesize
6.1MB

Download
memory/5576-1943-0x0000000000730000-0x0000000000760000-memory.dmp

Filesize
192KB

Download
memory/5744-1956-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads