Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://824wildebee7...

windows11-21h2-x64

10

Resubmissions

03/08/2026, 21:05

260803-zxg13sbr4s8

03/08/2026, 20:42

260803-zhdecafd9910

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • user interaction
    yes
  • max time kernel
    467s
  • max time network
    622s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/08/2026, 20:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://824wildebee7598st.rivnoa.com/e66549763ncampment781/
  • Sample260803-zhdecafd99
Score
10/10
adwarebootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://824wildebee7598st.rivnoa.com/e66549763ncampment781/
    1⤵
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb93c7c188,0x7ffb93c7c194,0x7ffb93c7c1a0
      2⤵
        PID:4492
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,17158346516774320037,5896021258182286345,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:4640
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,16423552472546193063,13708634579487026906,262144 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        2⤵
          PID:4824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,14196333223542296217,1844712032471169480,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
          2⤵
            PID:1836
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,14314907719304790192,14834150776307176795,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
            2⤵
              PID:1112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,6096413857643607001,5043351634166516046,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
              2⤵
                PID:3356
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5589211867730316250,10169817893582412996,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
                2⤵
                  PID:4992
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11103038962487718604,4313843651238468823,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
                  2⤵
                    PID:4628
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,6699997664781195452,5778482743876119754,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
                    2⤵
                      PID:840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,1689944784813856057,12190468927380798524,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
                      2⤵
                        PID:2652
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,8669896788343097425,1959172665768765148,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
                        2⤵
                          PID:4984
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,11103253866026120473,1675941581925682291,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
                          2⤵
                            PID:3668
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13107517470538585087,5533624747745010989,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
                            2⤵
                              PID:1116
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13107517470538585087,5533624747745010989,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
                              2⤵
                                PID:4884
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17202862385969144880,9255960751880484366,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3608
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1132
                                  3⤵
                                    PID:4052
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6404,i,1725782669305433625,898849203337590490,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
                                  2⤵
                                    PID:4980
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5068,i,6862269966837430263,5297332628717215521,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
                                    2⤵
                                      PID:992
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4380,i,8407151019202298516,8830177072714348966,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
                                      2⤵
                                        PID:4632
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,3519340986397322047,2807106157847778882,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
                                        2⤵
                                          PID:2032
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6892,i,10009345527321879345,16916419331903800301,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
                                          2⤵
                                            PID:4488
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12431855800865586897,16702982891884617343,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            PID:3676
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4260,i,3235118794183270054,6366865467244384255,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
                                            2⤵
                                              PID:3008
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3976,i,2747113601958514209,16880017457961271010,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
                                              2⤵
                                                PID:1280
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,626444465976713824,676626332725027126,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
                                                2⤵
                                                  PID:804
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,12638246252620825005,8110735193051285205,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
                                                  2⤵
                                                    PID:4516
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,13285613556087655431,14616342895792118870,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
                                                    2⤵
                                                      PID:2692
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3968,i,15391017014551505198,11556576989355306114,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                                                      2⤵
                                                        PID:2320
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4552,i,4667964008647451355,9176068584455182623,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
                                                        2⤵
                                                          PID:1072
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7300,i,7946288349860366733,1976330869831022264,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
                                                          2⤵
                                                            PID:1632
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7416,i,12281357744696432571,11296879461725675314,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
                                                            2⤵
                                                              PID:404
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6876,i,7479776260110069730,17841920180153458317,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
                                                              2⤵
                                                                PID:1332
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5028,i,18151195022519598581,2877867801250946443,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
                                                                2⤵
                                                                  PID:5024
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6324,i,10732603168030529261,9957535026411293652,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
                                                                  2⤵
                                                                    PID:4988
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,18256446387102436644,5953476745381497407,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
                                                                    2⤵
                                                                      PID:4388
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,1815664302377751075,16041485072542375660,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
                                                                      2⤵
                                                                        PID:1452
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4244,i,16920936511921885641,18244770799764511394,262144 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:10
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3760
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1956451125354603373,4011304132687135577,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
                                                                        2⤵
                                                                          PID:1632
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,7452302861155407088,7840578171657608988,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
                                                                          2⤵
                                                                            PID:4400
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,814888918022644604,1658028660022681742,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
                                                                            2⤵
                                                                              PID:4388
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5523770067155311741,2289730780435985928,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
                                                                              2⤵
                                                                                PID:1644
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1074578430512738324,17300854740382014742,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:14
                                                                                2⤵
                                                                                  PID:1728
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7904,i,2517875215661282878,6342878525581643056,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:14
                                                                                  2⤵
                                                                                    PID:5404
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7872,i,4720901140497183822,10748864483985297424,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3352
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=2968,i,13143111770671078867,2129855639538645601,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
                                                                                      2⤵
                                                                                        PID:6056
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8052,i,2094331247779942940,4314446410200886570,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3008
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4196,i,8517638490936890800,1509544181785574649,2097152 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2708
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,8337516579087452064,4903563002444534330,524288 --field-trial-handle=2288,i,9078127604852693557,8286454185531551352,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:14
                                                                                            2⤵
                                                                                              PID:2492
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:2828
                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                              1⤵
                                                                                                PID:4964
                                                                                              • C:\Users\Admin\Downloads\eDocusignPDF.exe
                                                                                                "C:\Users\Admin\Downloads\eDocusignPDF.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Drops file in Program Files directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3784
                                                                                                • C:\Windows\SysWOW64\NET.exe
                                                                                                  "NET" stop HeartbeatRMAgent
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1712
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 stop HeartbeatRMAgent
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4964
                                                                                                • C:\Windows\SysWOW64\NET.exe
                                                                                                  "NET" stop HeartbeatRMUpdater
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2752
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 stop HeartbeatRMUpdater
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1188
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-prep-x86.exe
                                                                                                  "C:\Program Files (x86)\HeartbeatRM\hbrm-prep-x86.exe" "C:\Users\Admin\Downloads\eDocusignPDF.exe" "C:\Program Files (x86)\HeartbeatRM"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3044
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall delete rule name="HeartbeatRM Agent"
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3824
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall delete rule name="HeartbeatRM User Agent"
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3160
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall delete rule name="HeartbeatRM Updater"
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1620
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="HeartbeatRM Agent" desc="Allow Heartbeat Remote Management Agent outbound access to the cloud management service. More information available at www.heartbeatrm.com" dir=out action=allow program="C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe" enable=yes profile=any protocol=tcp remoteport=443
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1252
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="HeartbeatRM User Agent" desc="Allow Heartbeat Remote Management User Agent outbound access to the cloud management service. More information available at www.heartbeatrm.com" dir=out action=allow program="C:\Program Files (x86)\HeartbeatRM\hbrm-user-x64.exe" enable=yes profile=any protocol=tcp remoteport=443
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:8
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="HeartbeatRM Updater" desc="Allow Heartbeat Remote Management Auto Updater outbound access to the cloud management service. More information available at www.heartbeatrm.com" dir=out action=allow program="C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe" enable=yes profile=any protocol=tcp remoteport=443
                                                                                                  2⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3464
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe
                                                                                                  "C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe" install dir=C:\Program Files (x86)\HeartbeatRM
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:3508
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe
                                                                                                  "C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe" install dir=C:\Program Files (x86)\HeartbeatRM
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1620
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64-temp-0.3.246.60325.exe
                                                                                                  "C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64-temp-0.3.246.60325.exe" checknow
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies system certificate store
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:4800
                                                                                                • C:\Windows\SysWOW64\NET.exe
                                                                                                  "NET" start HeartbeatRMAgent
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4768
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 start HeartbeatRMAgent
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3508
                                                                                                • C:\Windows\SysWOW64\NET.exe
                                                                                                  "NET" start HeartbeatRMUpdater
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3804
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 start HeartbeatRMUpdater
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1524
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-helper-x86.exe
                                                                                                  "C:\Program Files (x86)\HeartbeatRM\hbrm-helper-x86.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4304
                                                                                              • C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe
                                                                                                "C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                • Drops file in Program Files directory
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Modifies system certificate store
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2096
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -ExecutionPolicy Bypass -NoLogo -NoProfile -NonInteractive -File "C:\Program Files (x86)\HeartbeatRM\downloads\scripts\84006c7a-ac67-4c89-9952-bad3e326a549\script.ps1"
                                                                                                  2⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3344
                                                                                              • C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe
                                                                                                "C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Modifies system certificate store
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3208
                                                                                              • C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe
                                                                                                "C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                • Drops file in System32 directory
                                                                                                • Drops file in Program Files directory
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Modifies system certificate store
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5028
                                                                                                • C:\Program Files (x86)\HeartbeatRM\hbrm-user-x64.exe
                                                                                                  ./hbrm-user-x64.exe
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3488
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -ExecutionPolicy Bypass -NoLogo -NoProfile -NonInteractive -File "C:\Program Files (x86)\HeartbeatRM\downloads\scripts\225d5ace-97c3-49a8-a8b0-dc8740fdcab4\script.ps1"
                                                                                                  2⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1116
                                                                                              • C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe
                                                                                                "C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2408
                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                sihost.exe
                                                                                                1⤵
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:4680
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                  2⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Modifies visibility of hidden/system files in Explorer
                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                  • Enumerates connected drives
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2760
                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                1⤵
                                                                                                • Enumerates system info in registry
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2432
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3004
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:5776

                                                                                                Network

                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                      Reconnaissance

                                                                                                      Resource Development

                                                                                                      Initial Access

                                                                                                      Execution

                                                                                                      Command and Scripting Interpreter

                                                                                                      1
                                                                                                      T1059

                                                                                                      PowerShell

                                                                                                      1
                                                                                                      T1059.001

                                                                                                      Persistence

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Active Setup

                                                                                                      1
                                                                                                      T1547.014

                                                                                                      Create or Modify System Process

                                                                                                      1
                                                                                                      T1543

                                                                                                      Windows Service

                                                                                                      1
                                                                                                      T1543.003

                                                                                                      Event Triggered Execution

                                                                                                      1
                                                                                                      T1546

                                                                                                      Netsh Helper DLL

                                                                                                      1
                                                                                                      T1546.007

                                                                                                      Pre-OS Boot

                                                                                                      1
                                                                                                      T1542

                                                                                                      Bootkit

                                                                                                      1
                                                                                                      T1542.003

                                                                                                      Privilege Escalation

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Active Setup

                                                                                                      1
                                                                                                      T1547.014

                                                                                                      Create or Modify System Process

                                                                                                      1
                                                                                                      T1543

                                                                                                      Windows Service

                                                                                                      1
                                                                                                      T1543.003

                                                                                                      Event Triggered Execution

                                                                                                      1
                                                                                                      T1546

                                                                                                      Netsh Helper DLL

                                                                                                      1
                                                                                                      T1546.007

                                                                                                      Defense Evasion

                                                                                                      Hide Artifacts

                                                                                                      2
                                                                                                      T1564

                                                                                                      Hidden Files and Directories

                                                                                                      2
                                                                                                      T1564.001

                                                                                                      Impair Defenses

                                                                                                      1
                                                                                                      T1562

                                                                                                      Disable or Modify System Firewall

                                                                                                      1
                                                                                                      T1562.004

                                                                                                      Modify Registry

                                                                                                      5
                                                                                                      T1112

                                                                                                      Pre-OS Boot

                                                                                                      1
                                                                                                      T1542

                                                                                                      Bootkit

                                                                                                      1
                                                                                                      T1542.003

                                                                                                      Subvert Trust Controls

                                                                                                      2
                                                                                                      T1553

                                                                                                      Install Root Certificate

                                                                                                      1
                                                                                                      T1553.004

                                                                                                      SIP and Trust Provider Hijacking

                                                                                                      1
                                                                                                      T1553.003

                                                                                                      Credential Access

                                                                                                      Discovery

                                                                                                      Browser Information Discovery

                                                                                                      1
                                                                                                      T1217

                                                                                                      Peripheral Device Discovery

                                                                                                      2
                                                                                                      T1120

                                                                                                      Query Registry

                                                                                                      5
                                                                                                      T1012

                                                                                                      System Information Discovery

                                                                                                      4
                                                                                                      T1082

                                                                                                      System Location Discovery

                                                                                                      1
                                                                                                      T1614

                                                                                                      System Language Discovery

                                                                                                      1
                                                                                                      T1614.001

                                                                                                      System Time Discovery

                                                                                                      1
                                                                                                      T1124

                                                                                                      Lateral Movement

                                                                                                      Collection

                                                                                                      Command and Control

                                                                                                      Exfiltration

                                                                                                      Impact

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      hbrm-helper-x86.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-helper-x86.exe
                                                                                                      • Size 8.6MB
                                                                                                      • SHA256 387ef65fa7961beebb83c6231d422c70e0db64d2f1aece591cf6295eed43b7b5
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      hbrm-notification-x86.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-notification-x86.exe
                                                                                                      • Size 3.4MB
                                                                                                      • SHA256 53a3da8089155e9ef5b00aa0eeed63d85105c1577812ac45d7edc0dd2307f570
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      hbrm-prep-x86.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-prep-x86.exe
                                                                                                      • Size 3.5MB
                                                                                                      • SHA256 09f90700c3e8b21931a571b4c488ddda0301130eb0c01d5ddec912b8a8698362
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      hbrm-updater-x64.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-updater-x64.exe
                                                                                                      • Size 7.9MB
                                                                                                      • SHA256 f131f3856d0565414c9620a7c107afef54c06e3e841374042b8dcc4b11c0d790
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      hbrm-user-x64.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-user-x64.exe
                                                                                                      • Size 9.9MB
                                                                                                      • SHA256 9e588c9eb462ab5be3e810367559655435311ae3dc4b9c6cb1a9f9714080b371
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      hbrm-x64.exe
                                                                                                      • Path C:\Program Files (x86)\HeartbeatRM\hbrm-x64.exe
                                                                                                      • Size 10.2MB
                                                                                                      • SHA256 0518dbc3420722234e192586edbc465ac47d1b538296bbd8c94895c46882d940
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      1e670ae7-24e1-43eb-b0b3-25a90d6b21f8.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e670ae7-24e1-43eb-b0b3-25a90d6b21f8.tmp
                                                                                                      • Size 19KB
                                                                                                      • SHA256 093ff47f9aaa97981f5311bb9988b08055dc561b55d0cd3129f9f70fadda2560
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      blocklist
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                      • Size 105KB
                                                                                                      • SHA256 cd3fc096a0c1f4abb9359a82fcc139397cc0e6d5cb03ed43d03fbca92a3836d0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      settings.dat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                      • Size 280B
                                                                                                      • SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      settings.dat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                      • Size 280B
                                                                                                      • SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      LOG.old
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                      • Size 331B
                                                                                                      • SHA256 068019074b0c25dc7524407b9fe61f928895c6da67236880d6a1c4c077f74b30
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      LOG.old
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                      • Size 328B
                                                                                                      • SHA256 6e69c909b8ef703411ed9e15a8bd7bd5af73e06df033a68c06af3b7847788dae
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                      • Size 6B
                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      f_000091
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                                                      • Size 203KB
                                                                                                      • SHA256 06427d55eea05f6f4905f2c311cb87fd2f7cc03c7ea15743ab8751cb834467bc
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_000094
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
                                                                                                      • Size 16KB
                                                                                                      • SHA256 5dd1c64a38698ff8aeff573794977443121235af418dd9d2c79a5314189da2aa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_000095
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
                                                                                                      • Size 56KB
                                                                                                      • SHA256 631ac6b47af403356db81376220724c58604074ae4e6312f775dc5783ab6ce61
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_000096
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
                                                                                                      • Size 60KB
                                                                                                      • SHA256 fd394cc3c5cbc059b945afc60e24a873c79e4e9f9ba018e12f0133b74a344cac
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_000098
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
                                                                                                      • Size 17KB
                                                                                                      • SHA256 d4c57ba2e64b7635750400d7c23a27484df6c2d29e84e0868c3d5d4614418620
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009a
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
                                                                                                      • Size 72KB
                                                                                                      • SHA256 f85f421527528f92927ea93b9979c306ec54682fc95c5e76eee0ea5110f0667d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009b
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
                                                                                                      • Size 512KB
                                                                                                      • SHA256 02b0a8ad7f3e9727b28cebc2ee1663712b990da7cc10dd96025420be6315dc94
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009c
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                                                                      • Size 45KB
                                                                                                      • SHA256 666309095c122720faf3c6a0924290992f7a107e90c9150c824d9f78fa7a70e9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009d
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                                                      • Size 256KB
                                                                                                      • SHA256 66e6e211d1e357491f93e54918d9c19378a55502f6c18c6ca3c9358c7314cae3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009e
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
                                                                                                      • Size 256KB
                                                                                                      • SHA256 542ac655cca6f4835f0752937b8144fa3620dfec1b42b5277470217010a621c0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000a8
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
                                                                                                      • Size 36KB
                                                                                                      • SHA256 57817ef6d0681f1ddfa0d3e07cf28a53dd54b949514c4a1b232fcdbadb67c596
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000aa
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
                                                                                                      • Size 16KB
                                                                                                      • SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000ad
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
                                                                                                      • Size 32KB
                                                                                                      • SHA256 86f85b9dd51076915b738c24c1169cb84593190a6c7c03552676da1be871293d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000b8
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
                                                                                                      • Size 16KB
                                                                                                      • SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000b9
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
                                                                                                      • Size 18KB
                                                                                                      • SHA256 ad2483a56557a1ca259dccec7279591abc39b9565f3513c676384dfe060fde4b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000f2
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f2
                                                                                                      • Size 373KB
                                                                                                      • SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000f4
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
                                                                                                      • Size 51KB
                                                                                                      • SHA256 5ac2113c905417b069a251b16dbdb01d43d80e0513ddd2f86e004bb8264ceca1
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      temp-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                      • Size 7KB
                                                                                                      • SHA256 f3e26d2c28ee8c7529771982c06e26004b7de989d1e01bd8f0197b0767c90d00
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 3KB
                                                                                                      • SHA256 60f978f79e2d3c7965e6c70a38329f39200cd06710e92feb69bca7ad601c158b
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 7KB
                                                                                                      • SHA256 6ab6203cb4d3728283056f6f77d0ba8a7b9c8771b2cf0f5e08ee175d5d60dbd0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 7KB
                                                                                                      • SHA256 d7b7e1315ae698edd1d2101998888a9bfef1c64f1f9c6fa8058b0ad6eb3ead14
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 9KB
                                                                                                      • SHA256 92e80abc94733beb567b552198728b9e380aa36b27221d834d4f42cbebfcd21b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe588e41.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e41.TMP
                                                                                                      • Size 3KB
                                                                                                      • SHA256 a30f31924adcf8922cfa30fb5554bd597924c1f8c806a3bda280af202a08c632
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      SiteList-Enterprise.json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                      • Size 2B
                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Edge Profile.ico
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                      • Size 70KB
                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      CURRENT
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
                                                                                                      • Size 16B
                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      MANIFEST-000001
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                      • Size 23B
                                                                                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 11KB
                                                                                                      • SHA256 35d8f4932924b6e5771c3d6913e34c5b8d42c80dfe7b11bc3cf77934f4ece9d2
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 12KB
                                                                                                      • SHA256 af3cbfc08ce25a09f734a1422cc0367187da42a4e04c8424c1b686edf3b86322
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 111B
                                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 11KB
                                                                                                      • SHA256 acaf43faf388b7c5c773b70ffd2bb3378a63b8c8ef7c611d753aa3bfd8718918
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 11KB
                                                                                                      • SHA256 fc832167ee4d44aa2574b7c5519245ac1c85a2b1b97f7257af4f7e77e784e46b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      SCT Auditing Pending Reports
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                      • Size 2B
                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Sdch Dictionaries
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                      • Size 211B
                                                                                                      • SHA256 4b3d2146a8cad1160a54020c45036d6b5949ff9cc3878fc5d785fd562e5b2602
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      Sdch Dictionaries~RFe5fd579.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5fd579.TMP
                                                                                                      • Size 40B
                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      ca55b8cb-ebf9-4676-bc08-85b59b2cbec3.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca55b8cb-ebf9-4676-bc08-85b59b2cbec3.tmp
                                                                                                      • Size 9KB
                                                                                                      • SHA256 fbdcaf8f4901d9d5c9184723a69a343c92894bdf9397abfa18730909813ef4f3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 18KB
                                                                                                      • SHA256 712915e1a339650eccb29370413f0ed0cf3c9712f7186c4b68be04eaa2e85b99
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 19KB
                                                                                                      • SHA256 985f7e543d4b03741c4ae858d2462010df934471b1b73e2b92a0637c222ffbf9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 13KB
                                                                                                      • SHA256 db95a7044d9ef8b26e9553743264d6253275ab8781cd0dc09f0aabbc90544b00
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 16KB
                                                                                                      • SHA256 8e94c6df83622850ac8bb33ba4d4405fb59d8da7695ff92999153ef2c020190f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 18KB
                                                                                                      • SHA256 8d342c320b8ecfa15f10da7019696015c2e23f5811247482c92587e5cbbca9fc
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 35KB
                                                                                                      • SHA256 2442937991af58f1375485ddce20a42a0819c6a7f76fa582311706eed910406d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                      • Size 14KB
                                                                                                      • SHA256 fbd13c193d8afda4ee83fe0f1f0082730f38f45503a9a9f19e363fcfd4beb071
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 1621ce7925fd68d6cef6ba2b5601f1cb2ad3d9dac8c4d236bc6b7016c4daf4bb
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
                                                                                                      • Size 96B
                                                                                                      • SHA256 776dbfb9d37b56e444a953df8735c77dd7ac50db2d8cb81ae318045ed3a6fb0c
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 891df8ca3af6f5e6e1bc5ca6655141666e30fb98ff7fa7d4038958c524845c12
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
                                                                                                      • Size 3KB
                                                                                                      • SHA256 011322ec24c1cdfec1797b95c32497b10d64814b959a72110b77be9d33789dc8
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
                                                                                                      • Size 1KB
                                                                                                      • SHA256 eb251ce033bf943dd7f14fdf8cb42ed05afc7b831fd1695537681938e898e3c5
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe58cb98.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe58cb98.TMP
                                                                                                      • Size 1KB
                                                                                                      • SHA256 e8e3c165dd9010a0cf6c181b7fda59087de2e4052bb080adb262321d37cf21dc
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\554608f1-ec6e-47a1-9a8c-5517b75338ba\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 c5dbbffee41df42a051da76fa116c0b10e54923673162477b1c46f3684c9d0be
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe5fe7aa.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\554608f1-ec6e-47a1-9a8c-5517b75338ba\index-dir\the-real-index~RFe5fe7aa.TMP
                                                                                                      • Size 48B
                                                                                                      • SHA256 89a54b5ba20b52620a0335b3c26911ce77d5b52b0c567a4288e226b85da7bdaa
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea296b60-5595-449d-99c6-42362a704d49\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 e3b0709db542e311059405aaaba2f242db856765b845ef442c8698eb01f187e2
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                      • Size 481B
                                                                                                      • SHA256 58e3113728c9835cb0c396109cb6b3cd7d1b4958648a34097b5d9e200c438658
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                      • Size 476B
                                                                                                      • SHA256 e5f1d6e84251334aca65b1a3bb9338cd7b3ce6e9d529c4adef24127ceacc57bc
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                      • Size 371B
                                                                                                      • SHA256 728c0558e8674ffe5921aeb9037ca4ebb3a775a7ba957683bd3c26cd8e3436e2
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      67a473248953641b_0
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
                                                                                                      • Size 168KB
                                                                                                      • SHA256 f95205e37449cc627f2b01f21ba2b21b6dda2ff0a6cb29be48603c524ba81633
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      ba23d8ecda68de77_0
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
                                                                                                      • Size 127KB
                                                                                                      • SHA256 d54045495a8143b528950924650c60bb51122721ec4ad91a31258f95d58cd154
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                      • Size 96B
                                                                                                      • SHA256 2ee5c8822ce333e537989e95e4434f1ddd9c596e23178d9582790bbe2ba9a996
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe596392.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596392.TMP
                                                                                                      • Size 48B
                                                                                                      • SHA256 e1d57959bf68378f4c9a6b50d37222d90cc8a79d0ef5800e479459aae98ca870
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      sync_diagnostic.log
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                      • Size 4KB
                                                                                                      • SHA256 531ef0a70eac90d9c5577632556f325b3bdc1f5ef592c6316f565af153cbcf64
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      d058f861-1df5-486a-a58b-b9cd17913f1d.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d058f861-1df5-486a-a58b-b9cd17913f1d.tmp
                                                                                                      • Size 31KB
                                                                                                      • SHA256 c17d408a0e4898d64a48a776561cc5ced1e1e2bb1be37da921403bfede0bcc92
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      OperationConfig
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                      • Size 22KB
                                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      OperationConfig~RFe592706.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592706.TMP
                                                                                                      • Size 3KB
                                                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 27KB
                                                                                                      • SHA256 118230f17def9d060f7ddabe0ce231832ce3b9c41ea5dc62d6b1735b3c023002
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 32841855bd4f98e57e1a6a78e3dc73d84f9b28d8de8b501533cba0e0f25a2134
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 27KB
                                                                                                      • SHA256 d469eb979e914d1abede0a88f29135cef8121b41f76d07f4d8f13401da8b1692
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 2aa465f96d91d2e535f22ab2503d30a65676c90dc787b01e6ce12405935cf5d6
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 f91f3f9974bd873d8536a778ab7253589a1e4cd8fa46697558c44c9064dffb6b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 19KB
                                                                                                      • SHA256 b2a237e880a3954e95a3719e57394d6d8e9ac74c793d0d1f479ea3e9a58f952f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 20KB
                                                                                                      • SHA256 e46bbcc3b299068f347b37329b891f085bc1ef7e216d1d953c215919a8bf167e
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 99ec350229a1cf3c1d69ad4905250b97c51535ed05850db9b0317d7adc11cb77
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 8KB
                                                                                                      • SHA256 2ed73c73507d8c2aa99302c6a666ce3a383721e69c0999b2f13595a07cc77fc4
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 cbfcd300d3f71714bbdaf00093a7abdb37cb36aec1cddcce5e6cccc5eb534729
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 8KB
                                                                                                      • SHA256 8f143f2086394900f3cc1c8146c3f9f58f4a32b6cb25cb8d62a70fdb1ece5c65
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                      • Size 28KB
                                                                                                      • SHA256 49e00d66b6822b631a4055a56464f6f97c71ba5e6bb19af2af95966def5af6b6
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 cc985b7117e6690af47914a72c2f0f510a0c7df4f045873558e60fa21ebd5201
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 973a56a9c28f7891cea2650aee73e8d2a3ed08dbd70371ba469d0b39c68ae796
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 68525787f05792f396b0f77fb92a2b9dcba5246a7ff1177876f298c8ea6236e4
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 1513897b767da733688e8d24eb662e8cee0a386f24c7c0df8dd55baf96e9e494
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 6a16a3595a66dda21ef24424d50d0edb3dbd391b19f1cb5b85d4a6fd6121e9a2
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 2d475d99e826a7ba72463553f1096b9ebdda294b7aa6866e5774619778ec2a60
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 52037d01d16d199855a01960b15d8b5935902a19f911fa89df03d402d59ba655
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 44785c7277b6b779f0e78de6b8a7cf517459c76e79db925bfca6322b0bf5b7e9
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                      • Size 392B
                                                                                                      • SHA256 e8ade40dd5ccad782fd0bec60c7292fea2cfb7687230222748428abd2f816e7c
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      RevisitationBloomfilter~RFe58bc17.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bc17.TMP
                                                                                                      • Size 392B
                                                                                                      • SHA256 ca3bb8e4f4ff00bd54e9a821cd8c56a4a3e713e7f7bf49ec6c8bd49d1c0298ce
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      metadata.json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                      • Size 13B
                                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      AppCache134302637080639500.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134302637080639500.txt
                                                                                                      • Size 83KB
                                                                                                      • SHA256 321632cedfc31046b4a788be1543cde0afc0a5e9273bd593abe0ecca6791bf20
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      __PSScriptPolicyTest_fhxmhhs4.egx.ps1
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fhxmhhs4.egx.ps1
                                                                                                      • Size 60B
                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      AccessControl.dll
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsk71A4.tmp\AccessControl.dll
                                                                                                      • Size 15KB
                                                                                                      • SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      System.dll
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsk71A4.tmp\System.dll
                                                                                                      • Size 12KB
                                                                                                      • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      UserInfo.dll
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsk71A4.tmp\UserInfo.dll
                                                                                                      • Size 4KB
                                                                                                      • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      nsExec.dll
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsk71A4.tmp\nsExec.dll
                                                                                                      • Size 7KB
                                                                                                      • SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      nsProcess.dll
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsk71A4.tmp\nsProcess.dll
                                                                                                      • Size 4KB
                                                                                                      • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      eDocusignPDF.exe.crdownload
                                                                                                      • Path C:\Users\Admin\Downloads\eDocusignPDF.exe.crdownload
                                                                                                      • Size 14.6MB
                                                                                                      • SHA256 7db5b3263943b24c0e36f8aefb88f8f4cf983fce35972252d438e29f82f3d4fd
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      eDocusignPDF.exe:Zone.Identifier
                                                                                                      • Path C:\Users\Admin\Downloads\eDocusignPDF.exe:Zone.Identifier
                                                                                                      • Size 570B
                                                                                                      • SHA256 e730e9fdd9b47c2cac78d6bff67297910ab39b2932ec65887313c35b5702fbf0
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      memory/2432-1866-0x0000019046E00000-0x0000019046F00000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2432-1845-0x0000019046E00000-0x0000019046F00000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2432-1905-0x000001917B710000-0x000001917B730000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2432-1912-0x000001917B6D0000-0x000001917B6F0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2432-2007-0x000001917D800000-0x000001917D900000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3344-1681-0x000001D2446D0000-0x000001D2446F2000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3344-1682-0x000001D244CE0000-0x000001D244EA2000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3344-1683-0x000001D2453E0000-0x000001D245908000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2851-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2222-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2143-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2098-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2153-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2081-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2545-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1834-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2766-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1801-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1784-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1768-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2155-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1751-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1720-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1719-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1718-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-1717-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2223-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2144-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2890-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2156-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2205-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2915-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2157-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2919-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2920-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2921-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2922-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2923-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2926-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2180-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2951-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2158-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2159-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2976-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2986-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3488-2995-0x0000000000310000-0x0000000000D48000-memory.dmp
                                                                                                      Download