hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
55s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260722-zcsbbazxex

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
270	1404	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292260975505727"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{BCBBEAE3-5977-4B60-8CF1-E0664935F95E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3624	4816	msedge.exe	88
PID 4816 wrote to memory of 1404	4816	msedge.exe	90
PID 4816 wrote to memory of 1500	4816	msedge.exe	91
PID 4816 wrote to memory of 5892	4816	msedge.exe	92
PID 4816 wrote to memory of 1500	4816	msedge.exe	91
PID 4816 wrote to memory of 1500	4816	msedge.exe	91
PID 4816 wrote to memory of 5892	4816	msedge.exe	92
PID 4816 wrote to memory of 2308	4816	msedge.exe	94
PID 4816 wrote to memory of 3696	4816	msedge.exe	95
PID 4816 wrote to memory of 3696	4816	msedge.exe	95
PID 4816 wrote to memory of 3696	4816	msedge.exe	95
PID 4816 wrote to memory of 2308	4816	msedge.exe	94
PID 4816 wrote to memory of 2308	4816	msedge.exe	94
PID 4816 wrote to memory of 3416	4816	msedge.exe	96
PID 4816 wrote to memory of 5796	4816	msedge.exe	97
PID 4816 wrote to memory of 3416	4816	msedge.exe	96
PID 4816 wrote to memory of 3416	4816	msedge.exe	96
PID 4816 wrote to memory of 5796	4816	msedge.exe	97
PID 4816 wrote to memory of 5796	4816	msedge.exe	97
PID 4816 wrote to memory of 5784	4816	msedge.exe	99
PID 4816 wrote to memory of 5784	4816	msedge.exe	99
PID 4816 wrote to memory of 5784	4816	msedge.exe	99
PID 4816 wrote to memory of 3580	4816	msedge.exe	101
PID 4816 wrote to memory of 2432	4816	msedge.exe	104
PID 4816 wrote to memory of 3236	4816	msedge.exe	105
PID 4816 wrote to memory of 2432	4816	msedge.exe	104
PID 4816 wrote to memory of 3236	4816	msedge.exe	105
PID 4816 wrote to memory of 2820	4816	msedge.exe	107
PID 4816 wrote to memory of 2964	4816	msedge.exe	108
PID 4816 wrote to memory of 4908	4816	msedge.exe	109
PID 4816 wrote to memory of 3160	4816	msedge.exe	110
PID 4816 wrote to memory of 3160	4816	msedge.exe	110
PID 4816 wrote to memory of 5484	4816	msedge.exe	111
PID 4816 wrote to memory of 5484	4816	msedge.exe	111
PID 4816 wrote to memory of 5484	4816	msedge.exe	111
PID 4816 wrote to memory of 4264	4816	msedge.exe	112
PID 4816 wrote to memory of 4264	4816	msedge.exe	112
PID 4816 wrote to memory of 4264	4816	msedge.exe	112
PID 4816 wrote to memory of 2940	4816	msedge.exe	113
PID 4816 wrote to memory of 2940	4816	msedge.exe	113
PID 4816 wrote to memory of 2940	4816	msedge.exe	113
PID 4816 wrote to memory of 5556	4816	msedge.exe	114
PID 4816 wrote to memory of 5556	4816	msedge.exe	114
PID 4816 wrote to memory of 5556	4816	msedge.exe	114
PID 4816 wrote to memory of 2172	4816	msedge.exe	115
PID 4816 wrote to memory of 2172	4816	msedge.exe	115
PID 4816 wrote to memory of 2172	4816	msedge.exe	115
PID 4816 wrote to memory of 5020	4816	msedge.exe	116
PID 4816 wrote to memory of 5020	4816	msedge.exe	116
PID 4816 wrote to memory of 5020	4816	msedge.exe	116
PID 4816 wrote to memory of 3504	4816	msedge.exe	117
PID 4816 wrote to memory of 3504	4816	msedge.exe	117
PID 4816 wrote to memory of 3504	4816	msedge.exe	117
PID 4816 wrote to memory of 2028	4816	msedge.exe	118
PID 4816 wrote to memory of 2028	4816	msedge.exe	118
PID 4816 wrote to memory of 2028	4816	msedge.exe	118
PID 4816 wrote to memory of 2304	4816	msedge.exe	120
PID 4816 wrote to memory of 5404	4816	msedge.exe	121
PID 4816 wrote to memory of 5404	4816	msedge.exe	121
PID 4816 wrote to memory of 5540	4816	msedge.exe	122
PID 4816 wrote to memory of 5540	4816	msedge.exe	122
PID 4816 wrote to memory of 5540	4816	msedge.exe	122
PID 4816 wrote to memory of 1748	4816	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,1398577319622234553,7463295248788532108,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,6405716822972626680,7719754042154863595,262144 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,4567915718993749178,9141648409952029328,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3724,i,10866408174959651575,15005147846727382847,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3708,i,11164503601131973113,6678438931012308597,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,117635991290569810,15019358724485376055,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,13774014835758354741,1848154236011902616,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5372,i,8927589815122319727,16725900070730835234,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6738727106414560903,14940156044343719978,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6738727106414560903,14940156044343719978,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,1871798952126541152,10018434475795764951,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,16183780462291178718,14750281184083163941,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,13368635342513047857,5993428539551441586,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,17890186813422480946,3597693915012919673,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,9000347073249879940,714466170404662417,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,13200315720873068843,14795039291078492886,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3572,i,17222570770772193624,4818535311875724551,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3188,i,15166953254421443809,7393987273294651673,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3812,i,9255667835044171496,6302743941746698361,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6980,i,3365185964473235063,13774260101082639841,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6808,i,2373615166284529507,12308382229310275116,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7184,i,11146835630221015462,6513685287329562477,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7428,i,2510684888263003072,17711582359008201144,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7792,i,18015462915442817942,3551371583702954737,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,13829461285712128798,6838161720380359850,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,13829461285712128798,6838161720380359850,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17536910075114294871,8470001024197416753,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7932,i,3004347410413535335,18255316914698097085,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7904,i,301689035363429416,6750758719563059029,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8544,i,13362525383993653829,4063605396028497915,2097152 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,9131046675670258734,4827736344015626351,524288 --field-trial-handle=2560,i,16271813547574914847,4445004383340790866,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:14
  2⤵
  PID:3744
- C:\Users\Admin\Downloads\BootstrapperNew.exe
  "C:\Users\Admin\Downloads\BootstrapperNew.exe"
  2⤵
  PID:5856
- C:\Users\Admin\Downloads\BootstrapperNew.exe
  "C:\Users\Admin\Downloads\BootstrapperNew.exe"
  2⤵
  PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
MD5 eaf55528b0f5937bd8e8f316bd1cc084
SHA1 95f22f3a4fd8bbaed3b1d846bffc9c7d91b6d0f6
SHA512 b662ed48f9545b4a39b0ad121df043fc73d049473c7747eb34fbe2727c62d672351c2fe4b14fc252c8ac19d14a1ebe818b4f6ff523e7a14d1a9a94b9bb4e0b50
TLSH
T19C0199C38D3F044D1D039540DF59CA71375170E1781702A7A6B03D01A84B93D563D854
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 727B
SHA256 3d2b1d70a2fc2982e09eb77655016285b078c08b9e89bc5effaa5428254ec8fb
MD5 931494c8e84dd5a004921114195e0f29
SHA1 da50f1471be8310c05d89d86c0c4ac07448e2d4c
SHA512 ca4d74caa6e668691de771c4c8f6468aa74356552b53e30bd1e72bd8be97211c60202977c3969cf1bfe7a30594d64a85b284497556b6ba90bd0b3d7f797c2ff8
TLSH
T114016562012A2800BD024C9ADCF8ECB46191268C016F244A72735CF194CABF93F21725
MD5 SHA1 SHA512 TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 e69872a5a7394ca48950a50e44cfbb4eca5645d7a07c679269ded9ca65030d07
MD5 455051373b15dc2ece6434b855c89aca
SHA1 d7fbe96018c22401292dd7c76e1c766d69499299
SHA512 768b0e187630a279393d5216a67ee6427f2545563a04547a5e4714da0c10e4d55bcf1ad006e61a43780fd3ecfa941d26818b2a63bcc7b4470350573c5bccaa9b
TLSH
T1E4F02B1424EB022FD076567E87E552B55E65E4127909B29C00A51215EE03F056E21E24
MD5 SHA1 SHA512 TLSH

Submit Download

A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
Size 478B
SHA256 cc8845fde0b2c79fcee79934e01c0fed63bb01aef2c55d73ecf36ac369593909
MD5 a6c1ac0173071d0ceac7da03465b23f3
SHA1 101e3d05f166e600d2a9cf44a7ef2456286bd3b1
SHA512 fbb8d024123029eff4cc8370cc48e7c7be89ec9dac08cddd121c001f732acc9b617c5388e7186453faa82dff287927d0169a35d0628d30dd37b24ee08a04651a
TLSH
T118F0AB4C2AED827FF071EF79C6D4A3138E66B0633B1063B105921B1A9E03F429C660AD
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CMD_Softworks\BootstrapperNew.exe_Url_sc4n1t1o0huekm0beulwmvh15i4ecwfr\1.0.0.0\user.config
Size 842B
SHA256 86a8d26331e8759c0110fa56486663bbc092eda6fb72f5a8aab71f317347ac2d
MD5 6697ca15ba69302821682dfd716695cd
SHA1 a638fb95fb2e1a79287767f9ea2bd9c1287a16aa
SHA512 75e2e5adb887d3c05bb2a31444ed5583c51bbc93648eb3f2a595b3c629760da8fe00376ee7743ae440f8e0a2444c457e2e23191bae02700eccf9cd7f9cad75fb
TLSH
T1C701490062C4BD9F45631F36DA518704CEB1439B91362528B67E63AB8F3148B078335A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 21KB
SHA256 827c2a2effb07cc4b1c55258223ce5af3e42f35643f91893b49ef2d8e16bbddb
MD5 a862dcce22578fc885f0d8350012e9ad
SHA1 c4c70bf38b6b83ec579d61b5e36d739928b7d80c
SHA512 8639a7c6ba1a99f394a2d7f9f7f5144affac8047a34d8653a1d2e257415177828ed49b36b33d062edb7cb9e6ef89bfcbcbe717a69c3120744c2db719ba451df4
SSDEEP 384:ncS/kaADMv3H5OuPEjUAFH0cythGyUCS3OEigedJYCBObMrvoFGt4lVDotOqInx4:ncAn4O3HE8AFkddci5dJtMbuowt4l1o3
TLSH
T16AA2D07D3903F1609FF9906846FB9A2F437C7D1E07A0D9925C6B98234D3F2890D629E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 57863e01155212e7d323ca633dd218f05bdb500c5dc19ca3ddc10441778ba510
MD5 3fddcf83976cbce7858f490e6e313a01
SHA1 a1163fdd05956f581e4f1ae28ab76020a117c16b
SHA512 6404a5f7c38c941fd408643041e019d05bef5009394da5d7c47e5d6ddeea795663ee3fd4c833394bd5199ed30e2263a0f77ca03baf98ef39e598142b630dbf7f
SSDEEP 96:p+3jHxqQXhSwpXHUnc3hy/ntXIChooIb4vnLCj5iAd:pSRqQYi3U48/ntXIChooIbUn+jAAd
TLSH
T1D0C1AA1463D65DA2CB3FD23D00F8584572F075754C0BBF8E821A2E3AC6EAFA480E8643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b02028552b835d26d59f856ff32cd41fb061b457bd39e4adbabe024b082628a
MD5 52d5db413336f8642b9359278d67b959
SHA1 6704f3f66a64a7a93b0af0d8299d725a67015ac7
SHA512 6fc5e6126c964367c026b164d7f1450f172c7320973fe7d44de117b0b6b3b2541d62fe0432f94a97e4ad1662a86b76f97921177b1eb6071a1de2b7b7a7f6c768
TLSH
T1C361291463E718F1D72D627240F1549832F0A67A8E07BB82C05F6F3CCAA2F3490E8267
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d5c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d5c5.TMP
Size 2KB
SHA256 c57d408d2cde7735eedd16e0d3ec81605dc7b372cddc4228de362af699b660df
MD5 d380c891b0a1ebb66b3122b66a3b0ae7
SHA1 403d5052b1c1c5feda2301aa28df7bdd15c86282
SHA512 3c5635a76f6c4313a0dda5a754218cc36ec8660f1ebe99a86db864326bb4312ce9ead3a2980927e80de85bb00fcd68363fa8f52a7ff849da55a5b62d868cb566
TLSH
T1A251F81463E718F1E72DA17254F0559832F486798E07BB81D05F6F3CCAA2F3491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 0dbee0fe93d9440df25b38c513e59eed6311bf1f4e1b66ad1865efcc40d2099c
MD5 36d6595ff016853b81fd05b8f2e9aa31
SHA1 fa406ac7285b5eaf07347a1a80ad61cf705b8dbd
SHA512 7a3abbcabf96f19f28179730a311dd831f5c4cabe07e98331472a6a094af90b8a5df2e143ac8bfc1116af4d11dc0dfdc16621313a47cd1741589ba531d2a433e
SSDEEP 384:DePgfLZwsLsxMcmAgihe4+UrJxgBe8ize2JAJfedzFXiZla4/GNSYlEC2gWIvC6i:qI6+7TbMFFs
TLSH
T1CB82A1F7C3E8852DC82125F497247E2ACF1D192942283D66CDE9EE5FA3E1472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0133950fd12a567de3509535df1bd5e78063ec536a21e6c4f871c8eb04de2c60
MD5 d1994c615569b0cd583f9b8798352ae5
SHA1 b91f1995b017932f013d0fcc63f6c7e879d4c3e0
SHA512 cc3618d00168996751b62654bb8ae6f38012bd4ff2d2a36f61155dcf2d144c4aedf23bc3ef74cacd40f4502df9067e5e2402daf8bed4bed741a8d0b7413df5a3
TLSH
T133D0235312187475D57D3D819055BC4FC72641140412EDD810D0BDD9053187D4A47648
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fa0297e107698783c179b3c35cb3ca8b7445590672997c276376bab5c6660283
MD5 ddd5db1f0f6601665b85fe7b0e41dc07
SHA1 c88fc3ae90ddd50ad96f87be968f2d33840b7353
SHA512 1345e5aec6fbad75613e330353eae1a23c376c06f934c5bf24ecbc5cc0ec185eba14d2642199d7da777972b65c60a72f1157dcf39a9b31743d92beae9488edfa
SSDEEP 384:sxRSum4u/fFsY0jZ8L7/umZAlXRShgMF/:suum4u/fr0jZM/uNRSB/
TLSH
T1F362E7579924D9778DCBD119BA35BF63D2F5102299911E8CB7FCCA0C04EA6EE220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 deaa8049d69398ed8fc6cdccfbb9a2d239d5accff3ef6a2f4c6470dc8c69d4f8
MD5 72bde8da4d4e5a8b129c3674b7fc0175
SHA1 14155b080500f9d0acbdadcd89878de0d987cd94
SHA512 d116b5ee5e24190da988c47aee68505ee8dcd427bdb5eab3c3dabf6440a7b45a57a67e73557af358ecaa18474f540264eb4f26ba928bf0372016a9c76934688c
SSDEEP 192:sxR1Rybu/fFsO0ZKCA94/2zoA8pjho/Si6+WN9v8/YD9F6SoGvRIgIJ:sxR1Wu/fFsO0ZZ8OG/uS/FShs
TLSH
T1BC42C717AA38993B8CCBD21DBA55BF53D2F95032A1D01E48B7FC860C04EAADD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c86bff8221470dfad8543a5553c4b947dbba07ada40e2d794b266d0a0036c15b
MD5 067c094b4fd3e1dfd431af1576a7f0d8
SHA1 10e3f11587098b15ac813c559f497a75d25fbe85
SHA512 bd8ca599cb6b08bd9aaa8174a5fd5b32e2d49b40aff74d7da9c0491150483b751e6c4197400df32cf4e075ae79f8084ec257bf9ce4a28c38c4c71138316d6ee9
SSDEEP 192:sxRSRyHcB1u/fFsY0jKCA94/1oA8pK9g63U/Si6+WN4oBO+MjXYD9X6SoGvRIgDf:sxRSum1u/fFsY0jZ8Lh/uAlXNShgMF/
TLSH
T10162E8579924D9778DCBD119BA31BF63D2F5102299911E8CBBFCCA0C04DE6EE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 36079819fbbe048632b4c098b1d52b0e305db20deb7edeaf26aaf8d287c7526e
MD5 7794520089bbf26207a375cd1d70e879
SHA1 1e1936deaaab59e9f486a9c26990b7b0cfce92c8
SHA512 7da5f7f9df16af3daa747d7491ae6d205ce0498816077d583d27de21268f31ca44fc0a5564b2d795ec9bc088007108423944d2af72251f747a0547c6534b44b9
SSDEEP 192:sxRSRybu/fFsY0ZKCA94/2zoA8pjho/Si6+WN9MjXYD9A6SoGvRIgD4J:sxRSWu/fFsY0ZZ8OG/uWX8Shg
TLSH
T1B242C717AA78993B8CCBD21DBA55BF53D2F95032A1D01E88B7FC960C04EA6DD630741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 acd8f0168c1f243a234c2e438351298ad4a39509e75cde4afc0b72fd961734ac
MD5 76342e4d29ec9986a18ae4e304cf9e19
SHA1 63da05c27a6364d33cb73a56377ff786b6e0dd00
SHA512 f564a776acb7ad32ee1c7ede864d94841f7487b857af638355519c5940c0e01c4e63c7b1a00470fcff0d4e4f41f00dc239f4b373b682adfde76a3266e5150062
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRc6ropDh:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VV
TLSH
T17CB2EA2F600DCB7E5F800A9DAD196FD77D9802C79B588D4047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bf6feba4c362d7c971995eb2cc26c2be349f9933a147518fe29d40ce9c320676
MD5 53edb49d6085f86e439d29ac253a349b
SHA1 d2204f2008b73e1eb9158510b54c90b5170746bb
SHA512 3f4fe9d9aa3c9548c037b36f069363013e7fddeb8ce749f0fe13b61af0152b2a092b22c934d7bc71ace6c4d63f6adbb1b375c723825411e6f3cd386ab5bca6d0
TLSH
T129A002E503741482C30882BCB1558EC57320EC105985221940FC96558C51145955341A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a37ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a37ea.TMP
Size 48B
SHA256 1de23897e2c84446c41360e11abcd71f6ddd1de631706655dc295555baa6b1f2
MD5 6d579c9a9888710980f7d2b5d505ab73
SHA1 7b87c1cf58e6fd23854a0c48bc17acef12336e7e
SHA512 0fa07fea015b1c8c262fe9ed44178a59167b3a6619a9d34beb05fff21f90f5559457afe2bd9d7a9bf415d1df00a94933ecabcc3fc330e6bc9310b4916081e0a2
MD5 SHA1 SHA512

Submit Download

0b45658f38c9d5a3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\0b45658f38c9d5a3_0
Size 194KB
SHA256 8d7c047e089e44670a6dffd3c6c276ca3395c5b28bf3ad63aba5d7dd35959e53
MD5 11861a0cac8a47aaf15b6726c43fa7a9
SHA1 a5c01a921d7a8045680077131ce6868f32189b11
SHA512 dc131f537bcb8256a1550ced365860fe5be88e80c605083409823924fc6b396e1e06f15846904f2cd9fbf126231daefafda1f9e27d0b101dc755e41915ad611e
SSDEEP 3072:MegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:MegF1cc9zByRIZa8HlI93h
TLSH
T19A146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 005072e289619b0c8954da47c932c8412a1545d9e363643a8e3e513e939a630d
MD5 89b1885f36b77a6c2ca4287f9bcbc724
SHA1 4fdb0fe4bc1a0b66ad2c47135cb962a3b1f8d6a2
SHA512 efc84564dc50e4f48974546a0e9ec7e3334469462d00b834f29a7e468de54aa5705c503e411be3a6f5c67e71156f55680dce7aaf06caedcf50c111ce57076cd6
TLSH
T1B6B0021841986977C891137761DA12E871F37C2C331A4B63A4DF14B7ED3BB4CB25A40B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4a68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4a68.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 082569577b2b98d912d81b1fed51539f6a12b6ea2cb6fe01a458bf31aec770b1
MD5 a66222db62b907eda87cc1029c1bf8b4
SHA1 0f2038437b45417a256459c0ce4cbefc3dc3e20f
SHA512 e8fa68e5e7ba0febb564a42dee7e94e0f1c35c7f7b39c2d3b94ce6b3a60ac9e5ee4e2cec64e723dc119fe9d60240fc283d5f4b9abde7733b18cff0fe3f4414d2
SSDEEP 768:Orv+4UNbdh3/AcVi0KYrEnjN3Gac1FnDZI:Obsbf3NdQnjMa0+
TLSH
T1A203AE31A9789AB38DFBD281B14776037EB4169386C50BE4D6C97B0C06DB8E8530BD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 672cb079fe8199f9f487a8b207f7a72ce0a9dbfc3a7ed914ba8b1e66599b5e8d
MD5 635536f2ab6fa09c0f9daf5a1186824a
SHA1 68f208b37983d3c14cf43caa1265cd3f9697b352
SHA512 94f2ecc90121b388dfd27c3d0ca1246acd8fdc00fc176c9d3ba28f15b12e996ed17b858ff04789e3d16dd72eb64b3b99547ccd74d900918557e705b9f1628e91
SSDEEP 384:GtNn/s3n9SM38N7HxugZjgt2WZlf8hyEGoH77jaFIy2rEoajo4cdR8eHhVODjYPd:Gj+9D3IAJtHi0K/rEnjN3Gac1FnDMj2v
TLSH
T13AF2BF36AD759DB34CEAD285B5037742AEA047A385C40EE49ADC7A0D05CB5EC9307D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 884ef8498273290e8b765bfb12707c835ff805da871839a97c69a4fe700280a6
MD5 ec8f1dfb9b0c5c0f79a6c60cebffa123
SHA1 18300caba5dbd05f2de0fcbe1557b46927e3848f
SHA512 37d9929b9fca19cb5272cc031b2fe972c602bf9885fa4f5d9c50b7052967a8736f139dd5c34e3f430ba58e563b7789e8c4bf5779ee340f269d503242427f2cf8
SSDEEP 384:ztNn/s3n9SM38N74xugZavcWZlf8hyEGoH77jaFIy2rEoajo4cdR8eHhVODjYPNv:zj+9D3JAlVi0K/rEnjN3Gac1FnDMj2v
TLSH
T1B3F2BF36AD759DB34CEAD285B5077742AEA007A385C40EE49ADC7A0D05CB5EC9307D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f90f2587a9d4edd896c5a17f94b709525fe7886d104e4b2f7d2ca2184cdb0d02
MD5 0958b3f84ef0dd2ef456edf1ec0a619a
SHA1 04bfb58aaa383ed9e4fd459db4bb00ff88f82fd6
SHA512 2974c5c124b0f85ff7f9f2cb5853bf89b972a4efd84d5f50796e77862bd2ceea79400290d2ffca4affd333c7c10d47417881a9ad50d053c5dd8104542fec4f1a
SSDEEP 768:FFXj+9s3mwgdAR5i0KErEnjN3Gac1FnDMj2v:+9s3N7QnjMa01
TLSH
T1FB134BF659D78976C9AE8787B73E2E019EBCC253B5800990B7C8690CCD875BFC306865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 084470dab53ad5fa1cdca13b2a9bb46f667371b671ab4c0f596aa9af0608a274
MD5 6275bef31d11eb7edb73c662ad3860f2
SHA1 90161942bc8e589f762c9586d0e7bc3a274f7abc
SHA512 889d193088b94b5a10c2bdc5c3ed6ec3822b8e8b48faa1a717f502723c68846b061be295a3bad5299d0f76a4d0c936001435a40cc5a5a234e95dba1b1611d7db
SSDEEP 768:FF1j+9N3mwgtA55i0KvrEnjN3Gac1FnDMj2v:M9N3xoQnjMa01
TLSH
T1D503AE37ADA4C9B78DEAD785B6077642AEB002A3C5C04AE4D6CC6D0D11CB5EC530BD76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 71a78cc5930374b05ad4c9bc5c28c51b3e47e87ed7eab2b40ddcf8d972f60d45
MD5 c03ca0a9a75be70ca1c8e7e0614ab28c
SHA1 f82b7a16b54d7bda84ae92986ec016aba3103455
SHA512 e13101894e47c166ae5a20defac04c4a2c001b21a8cb16be442a83ac28193a9a31d6484ee1af371f231b6a36500d6d5462816d0255a111212fad5789d3d25bd1
SSDEEP 768:FFKj+9s39wgdAc5i0KWrEnjN3Gac1FnDMj2v:99s3hhQnjMa01
TLSH
T1A8134BF659D78976C9AE8787B73E2E019EBCC253B5800990B7C8690CCD875BFC306861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1fa1ef16a1a1b125f520de5f3fd6663d716e78f1acc0bd399ca0270c630a3d7a
MD5 770affcb5d7a8c8a9abc5cfd540fbd85
SHA1 bf89af188d9ff87443e36f356958a5c9ec07323c
SHA512 9be8e648fb77f731ba1e2761ccbb352fad3befe7f87e1d35137b24167ae51e00314d3d018092c453c70bb3621ad2e4060c0b787a2f3cb971625cd1ccc8c04b40
SSDEEP 768:rrv+4UNbdS3Pmi0KUrEnjN3Gac1ZnCeVH1SCz:rbsbg38/QnjMaBEH1V
TLSH
T1E403CF3669A88EB38CEBE385714776037FB4125385940BE4C6DD7B0D069B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6f21203ab91ba37506ad958afb8d0133e1c13e3e56448290917e36258ba8671
MD5 f804563ef6b6e4c21290eb363a0ba6d7
SHA1 4b56f8e3cf353c045c80b760c42c425d33a633b5
SHA512 8874d3a1d83da76d2b3e2bb234968c1d498a4cec46a3a0918470349119c994f71dd0ffe4aef49e4ae31d29f45b077356a9db74f3b30a04efbf23e4317653b84b
TLSH
T14AE00201E30900EFE034077014D327303BF2C0700273034F491001793C537001F94780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3970.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3970.TMP
Size 392B
SHA256 eaeb28d95550c1af258032d9d7941089a21644d476bd911d7ba448b54cc98a04
MD5 4f1f50b703b20658de40273a2813a234
SHA1 0d1a680d8437a92da59323d352ce566d9cc08669
SHA512 58ec1cece1ab4d99623652eabf3071c32018d5897d33605cedcd3e8b10280854d01acb59587fd815b1087ec2f165da957251f792e2bb264656c8aff3752582af
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

BootstrapperNew.exe.crdownload

Path C:\Users\Admin\Downloads\BootstrapperNew.exe.crdownload
Size 8.3MB
SHA256 82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316
MD5 c9f1c55b26e7f781b65a96ea8190517d
SHA1 dad71e6ac2ad9e3ce30152f993d0c765008c6b5a
SHA512 aaef6d78bf342a8ba0d04aa9653ca2336e7e17c21159c7dde0f9df9c31e2eeaa625ed821f9a71e0f36217ad9169f030a437215a4952c906a959b0efbf8ccb17d
SSDEEP 196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+
TLSH
T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-727-0x000001EC7E9F0000-0x000001EC7EAA2000-memory.dmp

Download

memory/3360-728-0x000001EC7EC60000-0x000001EC7EC82000-memory.dmp

Download

memory/5856-690-0x00000262B6590000-0x00000262B659E000-memory.dmp

Download

memory/5856-689-0x00000262B65C0000-0x00000262B65FE000-memory.dmp

Download

memory/5856-688-0x00000262B1870000-0x00000262B1878000-memory.dmp

Download

memory/5856-687-0x0000026297510000-0x0000026297520000-memory.dmp

Download

memory/5856-686-0x00000262967F0000-0x0000026297036000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads