hxxp://www[.]babylon-software[.]com/download

Analysis

user interaction
yes
max time kernel
88s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.babylon-software.com/download
Sample260729-3m2vaagg67

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
3388	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
105	3796	msiexec.exe
110	3796	msiexec.exe
111	3796	msiexec.exe
129	3796	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298419346968340"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{74936B59-21D6-40D6-B864-3F37E68E4E00}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3796	msiexec.exe
Token: SeSecurityPrivilege	4772	msiexec.exe
Token: SeCreateTokenPrivilege	3796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3796	msiexec.exe
Token: SeLockMemoryPrivilege	3796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3796	msiexec.exe
Token: SeMachineAccountPrivilege	3796	msiexec.exe
Token: SeTcbPrivilege	3796	msiexec.exe
Token: SeSecurityPrivilege	3796	msiexec.exe
Token: SeTakeOwnershipPrivilege	3796	msiexec.exe
Token: SeLoadDriverPrivilege	3796	msiexec.exe
Token: SeSystemProfilePrivilege	3796	msiexec.exe
Token: SeSystemtimePrivilege	3796	msiexec.exe
Token: SeProfSingleProcessPrivilege	3796	msiexec.exe
Token: SeIncBasePriorityPrivilege	3796	msiexec.exe
Token: SeCreatePagefilePrivilege	3796	msiexec.exe
Token: SeCreatePermanentPrivilege	3796	msiexec.exe
Token: SeBackupPrivilege	3796	msiexec.exe
Token: SeRestorePrivilege	3796	msiexec.exe
Token: SeShutdownPrivilege	3796	msiexec.exe
Token: SeDebugPrivilege	3796	msiexec.exe
Token: SeAuditPrivilege	3796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3796	msiexec.exe
Token: SeChangeNotifyPrivilege	3796	msiexec.exe
Token: SeRemoteShutdownPrivilege	3796	msiexec.exe
Token: SeUndockPrivilege	3796	msiexec.exe
Token: SeSyncAgentPrivilege	3796	msiexec.exe
Token: SeEnableDelegationPrivilege	3796	msiexec.exe
Token: SeManageVolumePrivilege	3796	msiexec.exe
Token: SeImpersonatePrivilege	3796	msiexec.exe
Token: SeCreateGlobalPrivilege	3796	msiexec.exe
Token: SeCreateTokenPrivilege	3796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3796	msiexec.exe
Token: SeLockMemoryPrivilege	3796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3796	msiexec.exe
Token: SeMachineAccountPrivilege	3796	msiexec.exe
Token: SeTcbPrivilege	3796	msiexec.exe
Token: SeSecurityPrivilege	3796	msiexec.exe
Token: SeTakeOwnershipPrivilege	3796	msiexec.exe
Token: SeLoadDriverPrivilege	3796	msiexec.exe
Token: SeSystemProfilePrivilege	3796	msiexec.exe
Token: SeSystemtimePrivilege	3796	msiexec.exe
Token: SeProfSingleProcessPrivilege	3796	msiexec.exe
Token: SeIncBasePriorityPrivilege	3796	msiexec.exe
Token: SeCreatePagefilePrivilege	3796	msiexec.exe
Token: SeCreatePermanentPrivilege	3796	msiexec.exe
Token: SeBackupPrivilege	3796	msiexec.exe
Token: SeRestorePrivilege	3796	msiexec.exe
Token: SeShutdownPrivilege	3796	msiexec.exe
Token: SeDebugPrivilege	3796	msiexec.exe
Token: SeAuditPrivilege	3796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3796	msiexec.exe
Token: SeChangeNotifyPrivilege	3796	msiexec.exe
Token: SeRemoteShutdownPrivilege	3796	msiexec.exe
Token: SeUndockPrivilege	3796	msiexec.exe
Token: SeSyncAgentPrivilege	3796	msiexec.exe
Token: SeEnableDelegationPrivilege	3796	msiexec.exe
Token: SeManageVolumePrivilege	3796	msiexec.exe
Token: SeImpersonatePrivilege	3796	msiexec.exe
Token: SeCreateGlobalPrivilege	3796	msiexec.exe
Token: SeCreateTokenPrivilege	3796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3796	msiexec.exe
Token: SeLockMemoryPrivilege	3796	msiexec.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
3796	msiexec.exe
3796	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4508	1804	msedge.exe	85
PID 1804 wrote to memory of 2132	1804	msedge.exe	86
PID 1804 wrote to memory of 4912	1804	msedge.exe	87
PID 1804 wrote to memory of 4912	1804	msedge.exe	87
PID 1804 wrote to memory of 4912	1804	msedge.exe	87
PID 1804 wrote to memory of 3344	1804	msedge.exe	89
PID 1804 wrote to memory of 3344	1804	msedge.exe	89
PID 1804 wrote to memory of 3288	1804	msedge.exe	90
PID 1804 wrote to memory of 1276	1804	msedge.exe	91
PID 1804 wrote to memory of 3288	1804	msedge.exe	90
PID 1804 wrote to memory of 3288	1804	msedge.exe	90
PID 1804 wrote to memory of 1276	1804	msedge.exe	91
PID 1804 wrote to memory of 1276	1804	msedge.exe	91
PID 1804 wrote to memory of 4460	1804	msedge.exe	92
PID 1804 wrote to memory of 4460	1804	msedge.exe	92
PID 1804 wrote to memory of 4460	1804	msedge.exe	92
PID 1804 wrote to memory of 832	1804	msedge.exe	93
PID 1804 wrote to memory of 832	1804	msedge.exe	93
PID 1804 wrote to memory of 832	1804	msedge.exe	93
PID 1804 wrote to memory of 616	1804	msedge.exe	97
PID 1804 wrote to memory of 3324	1804	msedge.exe	98
PID 1804 wrote to memory of 616	1804	msedge.exe	97
PID 1804 wrote to memory of 3324	1804	msedge.exe	98
PID 1804 wrote to memory of 4296	1804	msedge.exe	100
PID 1804 wrote to memory of 224	1804	msedge.exe	101
PID 1804 wrote to memory of 224	1804	msedge.exe	101
PID 1804 wrote to memory of 224	1804	msedge.exe	101
PID 1804 wrote to memory of 1564	1804	msedge.exe	102
PID 1804 wrote to memory of 1564	1804	msedge.exe	102
PID 1804 wrote to memory of 1564	1804	msedge.exe	102
PID 1804 wrote to memory of 744	1804	msedge.exe	103
PID 1804 wrote to memory of 744	1804	msedge.exe	103
PID 1804 wrote to memory of 744	1804	msedge.exe	103
PID 1804 wrote to memory of 3972	1804	msedge.exe	106
PID 1804 wrote to memory of 1212	1804	msedge.exe	107
PID 1804 wrote to memory of 456	1804	msedge.exe	108
PID 1804 wrote to memory of 3004	1804	msedge.exe	109
PID 1804 wrote to memory of 3004	1804	msedge.exe	109
PID 1804 wrote to memory of 2224	1804	msedge.exe	111
PID 1804 wrote to memory of 2224	1804	msedge.exe	111
PID 1804 wrote to memory of 2224	1804	msedge.exe	111
PID 1804 wrote to memory of 4496	1804	msedge.exe	113
PID 1804 wrote to memory of 4496	1804	msedge.exe	113
PID 1804 wrote to memory of 4496	1804	msedge.exe	113
PID 1804 wrote to memory of 1808	1804	msedge.exe	112
PID 1804 wrote to memory of 1808	1804	msedge.exe	112
PID 1804 wrote to memory of 2708	1804	msedge.exe	114
PID 1804 wrote to memory of 3796	1804	msedge.exe	118
PID 1804 wrote to memory of 1244	1804	msedge.exe	123
PID 1804 wrote to memory of 1244	1804	msedge.exe	123
PID 4772 wrote to memory of 3388	4772	msiexec.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.babylon-software.com/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc3d9ec188,0x7ffc3d9ec194,0x7ffc3d9ec1a0
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,3214605729774001058,2084215624860414011,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,18377115352583096318,15964283285503245394,262144 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,3619645554670338978,10190740393595021493,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4071046550160121380,14771829485786684026,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,9491245152094632896,14261439053234615805,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14381063822114286877,1743580448026611062,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,18297512169005372481,14771425032191615690,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,9411354104244080999,16546914082812051563,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12334694651708557839,14401224210551912812,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7949904620055175084,15452287162643169332,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7949904620055175084,15452287162643169332,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4500,i,6400982310212639669,13824617171181221961,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3512,i,13871545873112870011,7727132158561980330,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3660,i,3430026163639839109,7418856906321904586,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,16184187388309873567,1093398043558207143,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,3808927563465643350,7782172850426766954,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13897967074288895812,8040097639688456662,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,11161517412508313615,14258661856860834229,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6188,i,4985260738764846746,13083676737515252644,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15284069305337306687,3783130677966984947,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5032,i,10619821384295686299,3531651323454751645,2097152 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,15011164207289942563,19188740489667813,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:2708
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\BabylonClient12.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,12234006245263379144,10221664048052993033,524288 --field-trial-handle=2068,i,672345759903271739,12862687494791143243,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3360

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 031C355791BC2F84C50BF79845905414 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 baef8cc67f2e15e805d4c8ca1410c5a447176685c2c2d5b02bb1c6c2649fe249
MD5 d34f0bb28d27066d82422ef621cb028d
SHA1 c9dbaca9d2837e52e558a653688877f3d960e0eb
SHA512 286b96b7abd95c7a6cdaa29ee7e2c1cfd04432f6a8a46a13b2fb054371a3f2d418aca0775d67b024ed87dcc1935e4cd0e70ea67386b87815dd137f263ab31634
TLSH
T1257191351286C8E1F3710032BCE9525EBB73B5C9F9A7AEE151D0BC372908FA2960714C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3cd827825951566e5ff01b82e0966c91855e47daf3fcf9db327743d6ad35dbae
MD5 0da4b0cd11703d21ec26791fce490ab5
SHA1 18158768240ef78409971acbfeff30c12b5329f2
SHA512 4a3902967f63e17c527385a7bbb7ecd9411935897438b6611604e33afbee0bb00d56ec929d535e44796a85044014519d787e805f9352fc92b20ea65275dbedea
SSDEEP 48:oEGi0reQxUlono7hpxl5f0O78GRvQxMOgrbtk6zuKfG6SnXVXSCwkXd4mmTvvKSb:GDn43XRpPvxSKOFRSCYvyDjMWabs6H
TLSH
T1C391A53595C2DEE0EB3200317CD9551DB67374D9F5936E9291C07C3A240EFD26513BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5849e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5849e5.TMP
Size 3KB
SHA256 0135dcd87a6b3937434fdc8cbecd8d05b14e30ea5b7bab638aba17f335de1c7f
MD5 5d5f53a587746f9bf4f52aab8ad0f9aa
SHA1 687badb1f429609f5e077dc2a8ca6b8bb4f1b341
SHA512 9c49b29e823ffd486ed2e325cc8e216c76f45c43b25c45b5ddcbfb21798069bda03eb8ad20870622cbfacb81c6f20e91b3c659fadf5166b4df599c6d823e7c87
TLSH
T1A47170351286C8E1F3710032BCE9526EBB73A5C9F9A7AEE151D0BC372509FD2964715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 610aa4b907f9dab7677406c6dd79f0abecf6719462712a9aa74fdecbcca87e58
MD5 74d94ce09db2582be6c486ece8b61b9a
SHA1 d0062a17cb186caee40f2415376e68c140fb4a09
SHA512 a10670046f099de214c5ac1a301f3b156bc8f7b46450cb8588d8cab9e2ba13ab98732d9dc1af13a961847c679313bffb3bd51064c233ec298372514529053b26
TLSH
T1205189F3C3E9826D991512F0AA282E27CF1D09A1832C3C59C5D4EE5BB3F2470D280A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a1e2ca59-59d2-4642-bd19-0cb69dd44fa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1e2ca59-59d2-4642-bd19-0cb69dd44fa2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d566ab451bfdd43e0870d496066f66f8605f08dc88908592449032e69736d0e1
MD5 851de76512612ee47c8b791c16ad333c
SHA1 85c2604d9394eb78d89de7b7d76e62b4e75dad5e
SHA512 d1fb020026856d30bd379c4a6c2e33635d7f1c2a802a327f20d5b5b1f7e86da6081b88cf0353cae417041816aaca18b162e6a5caf972db68a91db835d14eeb6a
SSDEEP 192:sxZCRWzyM/jK1Ml8Mkf/fWsAVxIdpJH9g6+WNGYIwpJLIgrJ:sxZCYMf/fWsAV6JHDGI9
TLSH
T19D42F7166B345977CCCBD219FA55BF53D6F94572E2940E44A9FCCA0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5659acecd638e0dd5260e8c982ccb9748cfcdaae3977737a27af199ff196c1ca
MD5 4c13749151bfcd306c2d6876693dfe26
SHA1 99d880067c12840f6482fbda6073b5e31f959565
SHA512 cbf8efb9ae468052f6dcd18de676d1d8ba83838d0b862696c24388950ba18ab1272f11b65a05e66b2bae26360a8d810e9abafb023379f3cfefcfad4bbd9d0d5d
SSDEEP 192:sxZCRWzyM/jK1Ml8Mkf/fWscgEIdpsfXHW6+WNhYH/YIvnJLIg56J:sxZC4Mf/fWscgdqHbG/3A
TLSH
T19452E516AB345A778CDBD209F945BB53D6F54562D2944E48AAFCCB0C04E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42a70b56d127950e587f86e1fdf919c2e57eb5d18ef9026040af7669a8821559
MD5 b86806bc113f02f56b67a761feb84f66
SHA1 c857650e8de0b90d45359bfab6c9fde5c35df077
SHA512 026ed2c522bd441532c1daeadae1e09d3a3c7ffdc45df7b9c2250e8c23533c48fd6561dbd72127e81a7da00d0022a25d64859e9e77b7602db62b60e4f61880e3
SSDEEP 192:sxZCRWzyM/jK1Ml8M9f/fWscgEIdpsfXHW6+WNhlpXYIenJLIg56J:sxZC41f/fWscgdqHbdXOA
TLSH
T16752E516AB345A778CDBD208FA45BF53D6F54562D2944E44AAFCCB0C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d60d60fd2892fe8e4b16ef841bb3c3bc9b9e83c302b7a9f3a297b96eeac4583e
MD5 11a4f5dff68df39065d38e8f5628cb90
SHA1 65a618545544f1c717991f93671f06473d68f079
SHA512 ffdbe56f98110c61ec731f3fba3e78282fdf8382b34b1bbcae9b1382d2f3e70fffe48e74e2f8765672c9bfe93f3433e016eeea26d0a2e3d333cd53de1acbcb9d
SSDEEP 768:GssqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9VropDh:GssqxXlWvJD6Tu1ja54LAs9upt
TLSH
T120D21B3B690CCB7D4F840E5CEC266FD76ED801CBA6988D5447FA884C02CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9651345dbaccae1f18502f5d8f34a2b1bd4a95c97357c0992285ea0568679375
MD5 e4d09462e2cb6bd1fafb661b0f8e956b
SHA1 8f09828e7a4404a68d89d48140a7e5aba193be33
SHA512 83c0df6f175f67ae918a2dc77e9cb9805d689dd5e3c8ccdfb8ebb00e915d396c8b8a06e665df4785cc27891a109863e877c15989c6d1ee83a077d0c2b2e92f97
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2AG:ExH3ZFDND
TLSH
T100E1251B31360662387E2948B2A6C93B4F4232637018A57F7FB951B55E6EE120DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bc6dc99-f2f5-4cac-84ea-8447ae777dea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2bc6dc99-f2f5-4cac-84ea-8447ae777dea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0b535de3bf0704c3ec3f67740629e0d330cde5e446c6e3041de59ec8019e875c
MD5 fdae1e7703e04e7cf962940a4f973973
SHA1 17cd8569bfdc9d88c4de1f9f6b5366d074250c4a
SHA512 a9e8e4222c28f4ba25d69e5a05dc88d4cdcf95c0f0204d842ae9f00378293e37f95413e00bdb3bbfcc80c321fb6b6cc191cdd564a1c6d635e7bdab9831855e30
SSDEEP 384:+AZcIhsN171H2EybvM6VRN5Oj9z9d+2fukQOObjI9G6w7gc:HhYvIH5Oj9z9dlmkQ29MR
TLSH
T1A8927D36AD384C339DF6A555F88736174EF891B7E7C86B84E1DCAB0D06DB9AC030A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0e91da12eb261357757396c8f8b26c171862121a3655a01445ba93c142c311ae
MD5 4aee347ea2d02ce7911ee07449628040
SHA1 b11d2a73a61f07beab87a271e750fd57357b430d
SHA512 177cf4aab8921730fc454f397bfd113f30dcdb40957d4f76d4530a2e3a97ba6faa18c11e19fcb39b4934f7cb131084651f4d7f4c9b276ec1bfc3238ada8671e6
SSDEEP 384:wvZcInsN161H2Eyb8i72VRN5Oj9z9d+2fukQOObjI9G6w7gc:2nrk7UH5Oj9z9dlmkQ29MR
TLSH
T174927C366D384C339DF6A555F88636178EF891B7E7CC6F84A0ECAB0D06D79AC030A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b9f5a690b4e32802a618f94d6645c7e6e3d5e758e5cc38897bdfe039d4185c2
MD5 b1d0cae77c9a7b18f079676eb08b05f6
SHA1 48114fee64cf3163d3ccd3e448eab1b466dbf30a
SHA512 a2f712accad8d55c5970b56ab1c4974707eae962996fd0194bb4dd800c1bec32cc66c890fedda4b5e5f23662b879ca6f0133b6481aaaad7c2f41b2b68d4b085e
SSDEEP 192:QONw6JkRnQmiUyQom+RN5Om5o9nz9d+2fueVc+qpOU6:QONw6UJSm+RN5Oj9z9d+2fuJQU6
TLSH
T143121A366D385C375EE26945F48732174FA8516BEB89AF90E1DC2F0C02EF99C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc11aedd6b6ce465bbe7dc6fe568ea2610d1678cddb6f2ff0d70a1d2078f7560
MD5 26fe2b300d7ee20ae19c9e691f2b2647
SHA1 9a4e66e0beb1bfc54958328ae6e2dfe69968849f
SHA512 aed7871f7e8aecb070fa030787a606d4d45e9c7ae4499046abf711b87b543293077737089b1fc16abb0af17e0693683385803351fac28c6fa1793f3b5cbd6c70
SSDEEP 192:tONiD6JkRtQmiUy/oW+RN5Om5o92h3MRXU6:tONiD6UrTW+RN5Oj9+8U6
TLSH
T1BD02E9356D385C779EF26E09F98737175FA4207BE9856F80EAE81B0C01D769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 967434dc5c9ae7dd5a73a469fa6c7813a7538323b33ee2098669c13566725907
MD5 a176c37f375603ac24a1420d672d2065
SHA1 2ff742435ed8cdc27e38bdbd52d161471d9243ed
SHA512 6050fc31dddbe2941c678a9d6c69dba946095840d2d66e1abfc87990097b570a16f53604d95bb826faca0d3efabfe0dfbd227fae44a8637c562e56c3c98fba03
SSDEEP 384:wAZcIhsN1e1H2Eybvi72VRN5Oj9z9d+2fukQOObjI9G6w7gc:BhL17UH5Oj9z9dlmkQ29MR
TLSH
T141927D36AD384C339DF6A555F88736174EF89177E7CC6B84A4ECAB0D06DB9AC030A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2e874a1aea304652d0e1a3cfe79c8df1afcd30ed58a8cc7d718e077d5e713aed
MD5 640e75648ab24696dc3b538b69d8699a
SHA1 c335242d19368adcd3c49443ef4cba60f45bafa4
SHA512 2372c71f2d67edf89b605c7b5a183ea64d7f23faab23894e920fa413aa4df8de91b956c7678429c474f9898ecfa471baca4d1ae49f86109a6e30678580aea114
SSDEEP 384:YziFHZcI2OsNP8TUNTUlIl61H2EybGi672VRN5Oj9z9d+2fubQOObjI9G6w7gc:3FvjawgmhR7UH5Oj9z9dlmbQ29MR
TLSH
T19AD218F658D74836D9AE5B43E77E2D078EBCC167B6889A40B3D85A0CCD960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa6a10111cf7ee0944c381a31d086513228d1775669adacc53a41b643fa5ee5b
MD5 a80039c869887948841872d9d2c22fc4
SHA1 b0d2d4acfd52498c4bbb6a0b9b1681c978744c91
SHA512 2f7f25cda447e191489dcc67d57ea8a5c60d07f8fbf0216717bd2629863a275902054977ce101ab7a2688f91044d3dd5394cc4adaaeeaee6ba3ad7c1834b574e
TLSH
T1E941285CB6E91108B3B36F5A9BF6A46E547FBC772E06D45D00010E4F0A62B40C862777
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF71D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF71D.tmp
Size 421KB
SHA256 3b53053d5fa16cf295c6c802b6994dfebf476e7675a475af02ea0d30a1a5498e
MD5 6480fcba16736e3403d6c0ad769ffe25
SHA1 dbbe89051854351bab03bf4e62c2f863d1fe0be8
SHA512 bd5bd6de378968da6bf7a163052273aa21c12ad369ff39d7095bec0dc5d97d3fceb721d113c682d7b0e7c3c91a15cd0d7abd27acf7348357b02beb90f38ec037
SSDEEP 6144:cImP8xTWofhHqJP7hHKd92FZxphRKVaMdcDAOrpnjb/r0MJ:cIa0px0dA9YZXPtBxNJ
TLSH
T111948D11BAD1C032C17E1634B92AD2AA51BD7DF06E79C22BB3EC176F1E706416631A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BException.dll

Path C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BException.dll
Size 142KB
SHA256 02c5e8e8541645d16d68cb986b895b75d83f135aa8da4a8177e5534b9a86b7c9
MD5 d7c8a5e488306d17b368b3edd6c92fff
SHA1 d5e3d2f00a17c8e7d9b067fa3aef56d1c8e59902
SHA512 d44eff21b9559d972e459e47d49d788e11d75e30517ba1a6c8e07f08d1bd24ffd76fdb73232024db33a590cb8717079e7af8aa848768963a98a4fbb4a20e0d3b
SSDEEP 3072:vqwXMJI0UQh8tQvfUmaqnr75EMMz0RVVKLgCR:vqWMYQhIefZcARWf
TLSH
T1E1E38D1179C0C472E1BF1A395871CA655BBE79B0DEB48A9B63A8033E4F745C06E31A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BabyServices.dll

Path C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BabyServices.dll
Size 922KB
SHA256 8b614ae0babdaea704e2a6aca233333132a23ae463fe9390d769ba4110e5be4e
MD5 a80876290a9ddbb9b24ad6b17ac805b8
SHA1 a748e945053c8358654bf72f4f1bfeb5326440e2
SHA512 7d05b15be914dac1115a66f6092cb160d54ff4dbafc185fc7f9f52408d0c2c45700132385109f2e2c47caf0ea3032f28ce8b259b434f129db9b46bcd4aa1562e
SSDEEP 24576:CJd2/hwfhMsQBWEvVAb9m1QEZ4tywXV53QqeT:CTu6g13alX33QqeT
TLSH
T17E150612B6D08535E2FE06301CFB82283775B897DD77830F739C523A6EE07585A68B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3388-444-0x0000000002AE0000-0x0000000002B07000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads