hxxps://switchrom[.]net/super-mario-maker-2-nsp-xci-rom-37/

Analysis

user interaction
yes
max time kernel
81s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://switchrom.net/super-mario-maker-2-nsp-xci-rom-37/
Sample260427-ppwjdsbs21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3756	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217666787495420"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{D450370D-A1A4-4A3E-9D36-659F420ECD92}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{03EF0532-B0F4-46C7-95E8-9706EA44B5C5}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 4184	5280	msedge.exe	85
PID 5280 wrote to memory of 3756	5280	msedge.exe	86
PID 5280 wrote to memory of 2608	5280	msedge.exe	87
PID 5280 wrote to memory of 2608	5280	msedge.exe	87
PID 5280 wrote to memory of 2608	5280	msedge.exe	87
PID 5280 wrote to memory of 1784	5280	msedge.exe	89
PID 5280 wrote to memory of 1784	5280	msedge.exe	89
PID 5280 wrote to memory of 3684	5280	msedge.exe	90
PID 5280 wrote to memory of 3684	5280	msedge.exe	90
PID 5280 wrote to memory of 3684	5280	msedge.exe	90
PID 5280 wrote to memory of 4972	5280	msedge.exe	91
PID 5280 wrote to memory of 4972	5280	msedge.exe	91
PID 5280 wrote to memory of 4972	5280	msedge.exe	91
PID 5280 wrote to memory of 2368	5280	msedge.exe	93
PID 5280 wrote to memory of 2368	5280	msedge.exe	93
PID 5280 wrote to memory of 2368	5280	msedge.exe	93
PID 5280 wrote to memory of 3260	5280	msedge.exe	94
PID 5280 wrote to memory of 3260	5280	msedge.exe	94
PID 5280 wrote to memory of 3260	5280	msedge.exe	94
PID 5280 wrote to memory of 5540	5280	msedge.exe	95
PID 5280 wrote to memory of 5540	5280	msedge.exe	95
PID 5280 wrote to memory of 5540	5280	msedge.exe	95
PID 5280 wrote to memory of 2020	5280	msedge.exe	96
PID 5280 wrote to memory of 2020	5280	msedge.exe	96
PID 5280 wrote to memory of 1252	5280	msedge.exe	97
PID 5280 wrote to memory of 1252	5280	msedge.exe	97
PID 5280 wrote to memory of 4580	5280	msedge.exe	99
PID 5280 wrote to memory of 5692	5280	msedge.exe	111
PID 5280 wrote to memory of 5692	5280	msedge.exe	111
PID 5280 wrote to memory of 5692	5280	msedge.exe	111
PID 5280 wrote to memory of 4100	5280	msedge.exe	112
PID 5280 wrote to memory of 4100	5280	msedge.exe	112
PID 5280 wrote to memory of 4100	5280	msedge.exe	112
PID 5280 wrote to memory of 2656	5280	msedge.exe	113
PID 5280 wrote to memory of 2656	5280	msedge.exe	113
PID 5280 wrote to memory of 2656	5280	msedge.exe	113
PID 5280 wrote to memory of 5248	5280	msedge.exe	114
PID 5280 wrote to memory of 5248	5280	msedge.exe	114
PID 5280 wrote to memory of 5248	5280	msedge.exe	114
PID 5280 wrote to memory of 2392	5280	msedge.exe	116
PID 5280 wrote to memory of 5272	5280	msedge.exe	117
PID 5280 wrote to memory of 756	5280	msedge.exe	118
PID 5280 wrote to memory of 2320	5280	msedge.exe	119
PID 5280 wrote to memory of 2320	5280	msedge.exe	119
PID 5280 wrote to memory of 2320	5280	msedge.exe	119
PID 5280 wrote to memory of 5200	5280	msedge.exe	120
PID 5280 wrote to memory of 5200	5280	msedge.exe	120
PID 5280 wrote to memory of 5200	5280	msedge.exe	120
PID 5280 wrote to memory of 2056	5280	msedge.exe	121
PID 5280 wrote to memory of 2056	5280	msedge.exe	121
PID 5280 wrote to memory of 2056	5280	msedge.exe	121
PID 5280 wrote to memory of 3972	5280	msedge.exe	122
PID 5280 wrote to memory of 4940	5280	msedge.exe	123
PID 5280 wrote to memory of 4940	5280	msedge.exe	123
PID 5280 wrote to memory of 4036	5280	msedge.exe	125
PID 5280 wrote to memory of 4036	5280	msedge.exe	125
PID 5280 wrote to memory of 4036	5280	msedge.exe	125
PID 5280 wrote to memory of 5152	5280	msedge.exe	126
PID 5280 wrote to memory of 5152	5280	msedge.exe	126
PID 5280 wrote to memory of 5152	5280	msedge.exe	126
PID 5280 wrote to memory of 6008	5280	msedge.exe	127
PID 5280 wrote to memory of 6008	5280	msedge.exe	127
PID 5280 wrote to memory of 6008	5280	msedge.exe	127
PID 5280 wrote to memory of 2564	5280	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://switchrom.net/super-mario-maker-2-nsp-xci-rom-37/
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb38e5c188,0x7ffb38e5c194,0x7ffb38e5c1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,12051921224582181112,2624176103332481815,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,5976157812037723449,6451161156993788409,262144 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,15140227702937742002,3002627857302930112,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2526139407805701526,7268512763385907386,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15640675491224926675,12414656195486494325,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4788,i,1574455029757303623,11161407524957928971,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3436,i,16404013228136233455,12296604437378670358,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4860,i,15972863303020524713,348387199084112392,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,12996446499679547058,11918961562073649403,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8162875797974266040,3444387001043018720,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7217382280925733959,16659635584298380399,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7217382280925733959,16659635584298380399,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6652,i,9606423314751339272,10872455500597346928,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4768,i,5351563338076281262,13690157770190688659,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6776,i,6963792860985854570,10182762388048211224,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3988,i,3481886161559919032,6207281043608279440,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,4619265418903043026,13595690212430597194,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,699324897101763008,6365190965932020059,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,13518889291672117217,17590889574775870274,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7080,i,11001221962975329175,13376098438973183464,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7072,i,14029092349879261465,15274740625613607027,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4300,i,13049188123684574477,10162619905450452823,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,3316189944412535151,18060605436799933654,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14980791652725415245,8860901755276806902,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7520,i,6245259692093439331,5416771960101516519,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7476,i,5407570002596017322,10074890444204917000,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6408,i,5712998315563474809,6128994278824080153,2097152 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,3861828903987111125,11939429418734626814,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,12441969556323929705,5935852975568690443,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7824,i,10883311366337198930,8761198557792854780,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,17672500738503345627,10407222004807560071,524288 --field-trial-handle=2328,i,2195989301031643333,1017601371411299754,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
  2⤵
  PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5280_1956791831\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 33f6b8a9f8418c603b7f6942772bc4340f42f145b17ac02e3bd417fe7ab64436
MD5 f9e7be74e6904a7c6432c92135d9609b
SHA1 4368ab1a30283d1ab12acebe49799066fa0e5051
SHA512 ab6c20110203aff1e1b5d68e751105a9451736d9336354becadc1c5f091e72f49600675a0a8a093516544588c355ee3652bf8212f36b34f1f4c11b5d706d6278
TLSH
T17CE02BAADC219C2B48FD072920124687EB52135B2B50880F7B3DC10C8FB0637659AC9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6b9e37cce6c93469eb5f313476f8b4ea9df18e54b1a861b0f812f0215c994748
MD5 e37b99caf572e648b63cead60cbe180f
SHA1 025c33fd822786075573daf9099303a5f7fc4323
SHA512 f12375c8c5878f9af9d4065d17e2eb4bc5e009a1f0d249c7726f60835b8fca87e4d8b715ef70753aa32770f6354dad8e0c4ee7a51f1b01878af29c59da8aa4a0
TLSH
T1BF51857CC00BD47CEBF558B099E4F087FF2CAB5C061A1E6A7CB0047D9956632114672A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d15c848d015c5bd954de48007c463c96871d6dc74c2bdb4be49bcb045c38833f
MD5 77be849f7d2c280dc1b5863bb68ac72b
SHA1 2c67a6cddbb6e1b0616019dc25e191e9f6aa584f
SHA512 bd159528db26a256d03cd6c561fc488ac5938f05675dad237f49e91631607f39fa87e79cd1a19cf16b48a8e34b2ec57900edaedd652f5bc470755719e0bbff8f
TLSH
T18761A76CC687D5EBDBF4AA705CE0F90BFB3AAB48011F1E26BCF4443D59426B22401629
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584810.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584810.TMP
Size 2KB
SHA256 b22f5ffb2a391d478df55b2250912643f13d38519d6f524ec102635a126845b1
MD5 03f1fe7d7b954ec2b266eb06f52347c4
SHA1 598d1f661c3e9316bef9a70be3449160660c40c2
SHA512 4c41ccc7e86ba445bf3886587f58204cb821e83ac50c3d225e440363aa76abddf18da9c7d7bdc424769c1c2ce054106876c49f5753cb628be5b3a33d2de6e2c4
TLSH
T12F41947CC007D07CEBF558B099A4F047FF2CAB5C061A1E6ABCB0003E9A42632554572A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 eb2a865ba0be2a0ba627de10840337f4f878c2dd0636592e5872beaf31f8e37e
MD5 f1924d24693cb78750e57c9723834dca
SHA1 608093084ab9f39c1716ca2b6237a8111488bba7
SHA512 3e600884c0c4d4d17c5b56c1bb47b1c870833d02c1f2145a95e2bb76d53c94dca835af147c4ae76a3f67029a30b5cdf7e8e30d01bf0cb33292376e689fa5901e
SSDEEP 384:D8xGztdtXde4prxJOJQDxWwg0JpGbLY82JW6JXahGbkGyNwCYdA6nDEXRrp3QEVS:JIiNLsuFv55b4s41ssY42jTz/b7
TLSH
T11182A0F7C2E4CA6EC81552F16A147E1FCD2E0929422C3C6ACDDAAF4B97F1471D24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b2d970a3832f616aa3ee3f1a545ba2e3fe2b2708e0c2edf98b13d0ec120033de
MD5 c7672e5ab165c93fa5e972e3e592884a
SHA1 589cae489c2056e55fe7c26f188b3d085ca51c4d
SHA512 f586b1e8cf247e207a772120c7a29cd17a067bd731932a520575dedfb063361050f6e64d9e107f6374b871198b92892e3f83f41cf3856435c7ecd129ade0a0dc
SSDEEP 192:sxZ+RUyMqZ/K1Ml8Mkt/f5skaspD/Z4vAzodpStyHW6+WNDJu/zNKiy4NaLIgj2J:sxZ+9Mt/f5skrzZ4vjnHb4/bNwjC
TLSH
T16B72F9156638997B8CDBD319F645BB53D7F9492392844E44AAFCCA0C04E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4a2c8056e5ee044c700119b26f266beeb4d6958e742f4298b2c77930de48234a
MD5 3d0f61385b69c5fc5c533135faaf2d11
SHA1 14eb50a77dfa2f5db8d6dce843062102cc52cb86
SHA512 789246e6e3df97a5790fdb11ec9ea8ea7f864686e35972c66a503dd687f0e45db4a7f7d9ebeefb70675f437bdc877a557a1a1cf98f46a062bf8ea33a5224f2b4
SSDEEP 768:AasqZl+7pLuL/BlWvBDkT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqEx4Llhf51Yrou:AasqZl+E/BlWvBDkTu1ja/Ex4LXB1jAz
TLSH
T189F20B3B6C0CCB7E4F800E9CDC2A7E9E6DE8028B96D8895447F9881C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 827b3106a6fc46c1a2be064842acd4ccfcab0fc17b03a3f3f962064731ec2111
MD5 aea007d624ee7185a0d24e826db1a66f
SHA1 19db3c64b55d25dc64536722611b742991271803
SHA512 9d90972578082568a8fc4a40b41e536cfebd2e593e38c5394f3b8ff1a14051e95b7ade9cc8efc41c4ce6dd0dbf35bdb9864b07da0694b244a98420b743bced84
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnA:+BOVglYXrbtZqRvJLr6pp
TLSH
T1CFC25D11723B03803A7E254E9594F46E62C230A37098B42B7BB944A64F6BF20DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 237B
SHA256 e79ce16a3175c9bc4183b8c0d8a7b7918d0770c1f7841875a17f19c4257fdb13
MD5 74ae0e8d312332b0a0355a22f74a4db8
SHA1 5d16855882456e90743f6e39d109fd547935ab42
SHA512 6bf085690fe3cf06ffe044002ef6545a7cb00429a32a05496d2507b36d58c98fb9e67bc2820f81be8c6bae026bdacbd4b2395eb3ac24ac800bdc635975a205d5
TLSH
T1E1D0A7EA42314D1AAE30AAD93064315DC12ADC9E8C8898F99985714768F8D21E606674
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 153B
SHA256 342fdc788e0d5fd903cb59739746e464477fc299ddaf9ead3f0c9432175c6759
MD5 e1eb3f1da5f1f6704b2d652830a5a994
SHA1 f9842d70990485bfa15e3a84fe1a818d3ec0bf73
SHA512 8401ffe2a6301afda8db2a05a04576f148ad4d649e69bda9857aef7918cd7092503c2852f628649177077312e3f9d6a9dfc80483f3ac36bd20d2bc8dae28e0a0
TLSH
T18DC08CEB0524494ACE34A9D83014322CD21F808D88C4D9E8A989004168B8C229802638
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586ca0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe586ca0.TMP
Size 160B
SHA256 db7883c327699aeb630f87c7c7ff4658cd9a78ee7d1ecd6eb0a1960830ec91ef
MD5 4cf0512e00493ecf414428f327dc34c6
SHA1 71c228a733db1aab330a65b3581e710adb170334
SHA512 36eeae6e55fe2222aebea39c43d1f3681a04fcc85cd6e96dd4662b9eaecc4ac9a2fce9fbc549624b574dc6c96076a607cada7e211a58ac0c57a01bb55526b91a
TLSH
T1A0C08CEB0624094ACF31A8D83024325CD22F8C9E8CC4D9ECA98A300168B8C229806538
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d661be71785eddf702c1eab48278ebe7547e2498329eddca0869a10a013912c
MD5 4577b7ff8d0df2b869af8787af8bf419
SHA1 ece3b70b54856eda1764bd7025f68e52cb45cc29
SHA512 8a55887cacbfcf27810f8e4d736212e65f29d91ac3a8dc259d8fde2e0b87bf966ef8913f622a4baec0293b9112e129cbe60c13897e6a2600482cd23720d5c404
SSDEEP 384:nuviFavqMg3sNR8TUNTUlIm2RihYs8rmvffYpir25QEBS7o1dKuiNVX2rN1k+rvV:u6Fayv36wgTiAKYpA2emmo1tizXaX
TLSH
T190C23A35E898C9ABEDE69F8AE7097A07EFE00657D5CC0AD8DAD81D0D10D71DD2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8862852e464a07655dad468fc06fe34048b5055ed2e5761cd48296e1f6ec9fd5
MD5 0e41d930ff69ee4a394a9cccfc109744
SHA1 f64a54a9af980ff107d6d026b600ae8f7614a139
SHA512 26999be0723311221ee632bf9a16d36bc1bec22461c3bb35bf1b3d0efaf2f5b67372893a963a6b6b7a0b03e217287c6e688a01e4c42653c0d56e0f4da0614c66
SSDEEP 384:npiFJjccCs+Bt0S3lsNs8TUNTUlI436eRiheEsr2mvffYpir2P0ctgnpvQNvUC3L:AFJccQFDwg46oicrJYpA2cBVqT7T
TLSH
T140C24A35E8A4CDABEDE68FD5B34A7643EEE00157C5CC5AD8EAC91E1D00871DD130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a6eb824b380e9dd8e8ba62c9f6d21061f724394e65c7f1dfbec9705c90915dc1
MD5 6d0da12b85e5277bd6591cb3ffee9d2a
SHA1 b09be1754fe83d5330ef8a16571b5ee011e5b969
SHA512 25cbaf266ebf4616eb83bde366a006efa8a814ba445ddfc35431ac80894e771da6074182db5d7a21e4f44e662df9bc371dbeb95ca13c2f42b0ed3da185a4bfca
SSDEEP 384:n7iFavqMg3sN48TUNTUlIm2RihMv5rmvffYpir2P0ctlnpvS7o1dKuiNVX2rN1ki:WFayv3TwgTimKYpA2cSVmo1tizXaX
TLSH
T1D5C25A31E898C9ABEDE69FDAE7097A47DFE00697C5CC0AD8DAD81D0D10971DD2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f49be49eb233e52f9489b3f2c99548918f2bd717e203417164b0ec1c2d623725
MD5 174d4819107e710e2dc31db86f2b712d
SHA1 0d788075aa44429eedc5f78c91f1cff7618a302d
SHA512 4ae624691f8c0c7ae5a9e796040587c2a889156acdbf2a8e9f476065fd9394e066698166d27090cbf07fd09736758093322c41ed2d3a9c63378dbed3baf7a4fe
SSDEEP 384:nyiFavqMn3sNs8TUNTUlI436eRihRjENqmvffYpir2P0cttnpvUS4vrN1k+rvI+N:5FayI3Dwg46oi7UdYpA2cgVUS47f
TLSH
T17CC23A35E8A4CDABEDE78F9AB7497A43EEE00557C5CC0AD8DAD91E0D00971DD130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c71910f9e3834163b0da9547740a846acf046d031a6491d287c0903d4d49b34
MD5 f17337d024a20911aef6e462b1a80820
SHA1 23b2a32d1649855905070e592917ec66b00c6fae
SHA512 dc10a04f87ee34d7aa435cc67e8ef1f993796fea2d9acb6d580937eac85db98ea36a16f1f1f3bc63ba40f4c4da9ac11b47f08f1b2281ddeaff7f2987edf345f6
SSDEEP 384:nyiFJjccCs+Bt0S3b3sNs8TUNTUlI436eRiheENqmvffYpir2P0ctgnpvQNvUC3L:5FJccQ73Dwg46oi9dYpA2cBVqT7T
TLSH
T1CFC24A35E8A4CDABEDE68FD5B34A7A43EEE00157C5CC5AD4EAC91E1D00871DD130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 bce99a28cbc4e4f77d14180b369864d450c1584663fbd16205b93dc197301633
MD5 b4afc659e4a7fdf740051fb138402f2c
SHA1 a1b85208e2f20c969a94af712873c33be206b72d
SHA512 09a25a2aaf0138fdb0cf36d67cd835ab9a4754703f806b912f5f8320d38f1fa1824f866a59fdbe3403810b406c6fe2cef76be6826377d033cd41021a280449ea
SSDEEP 384:nQiFJjccCs+Bt0S38xsNs8TUNTUlI436eRiheYsr2mvffYpir2P0ct1rpvQNvUC7:rFJccQODwg46oiIrJYpA2cWVqT7T
TLSH
T1EDE2C4F1A8D78976D9AE4B87A37D2E429EBCC153B5885994FBC41E0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a97166a89f478d91ee69217a10b33092a4940077ce7369af5f35eaeed020eb15
MD5 2845a2f2b34bf8a7b9dfb427a34f2bec
SHA1 4a5a8071275afbe80d8ddbad8d196a586efdef03
SHA512 57817b9e6f72ccd8ef64fec511c454fa7e361f3494249e8e8d07a42b906bd1810f16d561663afe6102b601e06bbcee3436a9501a4dc8827b85e6a9ce3b8f8b15
TLSH
T17A413958A6E91044B3B7BE56ABF6B82E48BBB9772F07D05D00110E4E0676A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-205-0x000001C84F570000-0x000001C84F5A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads