hxxps://cdn[.]discordapp[.]com/attachments/1532548557176049825/1532549714631983337/NullWare[.]rar?ex=6a79c7e5&is=6a787665&hm=9786e1bad1f8c7a20fef0fab1dbd19e7a2e7bc836dc063d182ce8afe543eac44&

Analysis

user interaction
yes
max time kernel
24s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1532548557176049825/1532549714631983337/NullWare.rar?ex=6a79c7e5&is=6a787665&hm=9786e1bad1f8c7a20fef0fab1dbd19e7a2e7bc836dc063d182ce8afe543eac44&
Sample260809-2wc2vazyev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307897542014813"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{BC964B8C-7771-4957-A44B-C657FF9049E2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1232	3800	msedge.exe	89
PID 3800 wrote to memory of 2852	3800	msedge.exe	90
PID 3800 wrote to memory of 3132	3800	msedge.exe	91
PID 3800 wrote to memory of 3132	3800	msedge.exe	91
PID 3800 wrote to memory of 968	3800	msedge.exe	92
PID 3800 wrote to memory of 968	3800	msedge.exe	92
PID 3800 wrote to memory of 968	3800	msedge.exe	92
PID 3800 wrote to memory of 5340	3800	msedge.exe	94
PID 3800 wrote to memory of 5340	3800	msedge.exe	94
PID 3800 wrote to memory of 5340	3800	msedge.exe	94
PID 3800 wrote to memory of 4304	3800	msedge.exe	95
PID 3800 wrote to memory of 4304	3800	msedge.exe	95
PID 3800 wrote to memory of 4304	3800	msedge.exe	95
PID 3800 wrote to memory of 5576	3800	msedge.exe	96
PID 3800 wrote to memory of 5576	3800	msedge.exe	96
PID 3800 wrote to memory of 5576	3800	msedge.exe	96
PID 3800 wrote to memory of 5604	3800	msedge.exe	97
PID 3800 wrote to memory of 5604	3800	msedge.exe	97
PID 3800 wrote to memory of 5604	3800	msedge.exe	97
PID 3800 wrote to memory of 5884	3800	msedge.exe	99
PID 3800 wrote to memory of 5884	3800	msedge.exe	99
PID 3800 wrote to memory of 5884	3800	msedge.exe	99
PID 3800 wrote to memory of 1472	3800	msedge.exe	100
PID 3800 wrote to memory of 1472	3800	msedge.exe	100
PID 3800 wrote to memory of 4136	3800	msedge.exe	101
PID 3800 wrote to memory of 4136	3800	msedge.exe	101
PID 3800 wrote to memory of 5024	3800	msedge.exe	102
PID 3800 wrote to memory of 5024	3800	msedge.exe	102
PID 3800 wrote to memory of 1676	3800	msedge.exe	103
PID 3800 wrote to memory of 1676	3800	msedge.exe	103
PID 3800 wrote to memory of 1676	3800	msedge.exe	103
PID 3800 wrote to memory of 3532	3800	msedge.exe	105
PID 3800 wrote to memory of 3428	3800	msedge.exe	108
PID 3800 wrote to memory of 3428	3800	msedge.exe	108
PID 3800 wrote to memory of 3428	3800	msedge.exe	108
PID 3800 wrote to memory of 5580	3800	msedge.exe	109
PID 3800 wrote to memory of 5580	3800	msedge.exe	109
PID 3800 wrote to memory of 5580	3800	msedge.exe	109
PID 3800 wrote to memory of 8	3800	msedge.exe	110
PID 3800 wrote to memory of 8	3800	msedge.exe	110
PID 3800 wrote to memory of 8	3800	msedge.exe	110
PID 3800 wrote to memory of 616	3800	msedge.exe	111
PID 3800 wrote to memory of 616	3800	msedge.exe	111
PID 3800 wrote to memory of 4764	3800	msedge.exe	112
PID 3800 wrote to memory of 4764	3800	msedge.exe	112
PID 3800 wrote to memory of 4764	3800	msedge.exe	112
PID 3800 wrote to memory of 4080	3800	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1532548557176049825/1532549714631983337/NullWare.rar?ex=6a79c7e5&is=6a787665&hm=9786e1bad1f8c7a20fef0fab1dbd19e7a2e7bc836dc063d182ce8afe543eac44&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffeec69c188,0x7ffeec69c194,0x7ffeec69c1a0
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,7839169612372160078,16748547237585981308,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,17723379995665186822,4257072369617287862,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,7885089620336804249,7905645873338724612,262144 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,1822158731767522817,15482852695059798206,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3716,i,12891503836243209637,829852898410011389,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,10330996550373300675,7152634672459372600,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,15002428640018763258,2850454783459555675,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,1036710848674709528,9882457993260097464,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,14456351786025264154,3490915854009706858,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,13288152216696710998,2293470644928542004,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,14867977191135359148,5385455679410284243,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6316,i,1864879723461039065,14928286043637482258,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,7262506992317266160,18187268271144053847,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,7262506992317266160,18187268271144053847,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6412,i,17370484026486039353,4014395095014384032,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5196,i,11322249557844829397,17742191212945961699,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5212,i,17185587609352461391,9485775930949977317,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,2486343865260971867,15935765648614790247,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3932,i,11563151535150364061,4557807392349535378,2097152 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,16243223103260805778,1084384579072385716,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,7876180389950223685,17933029281564048069,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11383440652897547865,18293330791885275841,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,15871526440293006266,9132276855390779454,524288 --field-trial-handle=2372,i,8463685189339335117,8420494916759881457,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 406KB
SHA256 c9ec15f6b284850a9e9c19a7e64a22154929e0f9e15a44f9f7e394111739fb9d
MD5 9216d5af8ede8d6bad7e05785c4f1536
SHA1 6196a652118779feec14a3c1d560d8a85fb296ac
SHA512 4707760777c417037805268bcd345cea67cdbf895ea01a002a157f9442c81520dbff93cee7047922e1513321e90db2bbc4d62365a5cbe51f308f484d7aedbec3
SSDEEP 12288:O+3o7mAmn/5Y8dgX4V+1iOF8MB/noCWnm3LMZT7LDkwFdqM:OrKAmxDgoV+YlMVn3kKLMZTbkwh
TLSH
T1879423FE7405ADD11AAB541F91A0DF9284D045E178637B997EBF4CE8A84CA27C4C8ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 68KB
SHA256 096265551a5ee356be7ccefaa40a7de3929105288e029cda15c965cb65b55eaa
MD5 f6709d44783ca7b4b921437ca7dd2727
SHA1 a0c6e731ea03274fd0420c360b5f8079ca719138
SHA512 34b45e20793f4de99caac1c28fca40953d4bc2902ddf4dac70c55bc28ae28cf01632095b20317c8c661832fc1b971fdc2eb05450ef8fcdafe74a5084589ad52a
SSDEEP 1536:GeXJHPV3M/Ib+Npon9pSlmtHf+SxQBEnhB35LsKMCoNx5p1WFK:GYV8xNan/rp+SxQSnhB3aKMCix5fWM
TLSH
T10C6302D8DB1C78A3B3A11891398B31876F920AD1DB0C79167D7F521E5B623EF4071B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 77KB
SHA256 f6419bb8a7143a2d4aeadfacd1aa7346fad4248fea46f30307556e707e361c0e
MD5 5fee10d43a603d19328c4813ca52f826
SHA1 2da1f3fe5299a70f197637ab7a628d834547abbb
SHA512 543c4b9a60a04697b28ae92589f7da4d61f55d2a05448715d23579caa94e2bb81c43997547af470fd9e92d1108561fbae12523b2c98e3ef385d93030ce313d41
SSDEEP 768:Ih09NbhjvT7ZfAy3U3zCebUBetygauhyJwoDPlxmb4mJXn8nJOFiJ2gun82GC/6u:IaXHtAtHUJwYmB8kFbn+AWJ+zCe
TLSH
T149730273EC76A544A2A9E13484121AEFE279E3C7531C2F77195136AC2C2784EDC31A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 16KB
SHA256 21e567d667f0debde217442964c11e53ec074908e61083aaa85c30e0991c4a6d
MD5 27868df963f84e26a3661e1aa6155378
SHA1 8c03f2ab06d038181b2752d844478359f63efcb0
SHA512 4fd7028792d5738dac9143d0bfe1c43104060b1911c6ffcfa157c50ecc9b3947d99fa600e06ef64fc0ce956da77d75dde57e94bdc82eac3d24fbcd64d7b57c70
SSDEEP 384:j+AQhCvTMgiBK2+y9NV7LBKKSzIq21Jp6I/FlRlrzLtFTiHX:C5bgOKjILHaEN3zLtFTiHX
TLSH
T1C972E113E1B1415FC87412B7A69C1F5E0B22649CD4D97CD39632AD3A0A5E864A71F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 72KB
SHA256 e21ce53d43bd9e404759b9a267e44c63106a423e70263f87d9e13ccfad4f61f3
MD5 1d4e7b902aa7d072fff5861353725adf
SHA1 3ab24c6848aa072854995d7f477604f2474fd6a6
SHA512 4667de5c55d95d200c604614114228180b0bec7b1e2f4bc204de5e28048301dd956ac0105516cc734757da33643cbef9ef42a2a04ca7ec6810200fed1f842d05
SSDEEP 768:U8XRyk5xUzO+ZR6lrxcgNbZcHTnGWRVmcrODcgAhR0C35hYNeJET+KoASRBqFqTE:UKRfo0rxzbcbzfSDccNaAJ0W9nKr+wM
TLSH
T1DD73023BCC97140DC7999B27A829A32EC10892C6A01F7D3B46C4347975233C5B667DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 37KB
SHA256 3b2ed8580badeaa0a72cc2435885d89e8e95d14d662a798fdb30daa14f0b39cc
MD5 a3d35c02bc5e98da4319006448bf7a8c
SHA1 0c93016beed5ce6b98a79b6f50d53b6616e3017e
SHA512 6f57027640e34ed172d6f5bad941c7a86ce0015f23e9fae130dc95fb4884bb1980e016871d0ee411cacd87984f2008f3192db0d770a67d65dca543a722bf6243
SSDEEP 768:a0/oxezMrWj8UT7KkM3loDswetvC5XPK1P9ELxPILst7uBvYrXgX/5t:5QxNruDMloDV/CfEjtaBvcEt
TLSH
T1900301F6DC6B045A86377FC030FF82CA6A0F67141A97E080202B899F719DF5657D5A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 71a10fab26666d8ac4b0b98f04db5d0969e629be949ab9497c5b5bdc5650ccc1
MD5 71a0b6af676f958f86df3906dc05af61
SHA1 e2e4077083c07e95c079a6bf588a9531decf67ff
SHA512 7376cc1fb6f1c87ec82ae6f0c062cf7eac3f58f41fe5d2ccab0f4c4e64c538e75ab53e4b71d8f070308a93a5fe53deb07edb07ca44eb0d10b8522d40b2cf2d05
SSDEEP 384:sxRtbdfm1E/fX3sv6Z8akay/5l8/TSdGlrtXfv:stdfm1E/fXS6Zoj/58TSArVfv
TLSH
T15072E6566624D87B8CC7D559BE36BF53D6F8102398915E5CA7FCCA0C04EB2ED221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1a705ff2433db8219db3c96c67b6e57d4ae480f8152fa13af51754307aab0ab2
MD5 f62ab476af433ac6e1af0234d33c8eb0
SHA1 fd3185ef04acfe9fcdd2a4034992b0c1cfb55ca4
SHA512 bf26928cdf153f759704ad691afd83b9afe029f77e8adce3a5ed461a38d1c58f77d8d16eb8328a88d6f2dcd31f62cf411165ce6c09b283aeb207a5144cd0442e
SSDEEP 384:sxRGbdfm1E/fX3ss6Z82uGs/5ldXGSd+lrtXfv:sWdfm1E/fXp6ZdU/5HGSkrVfv
TLSH
T1D272D7566624987B8CC7D559BE36BF53D6F8103398915E5CA7FCDA0C04EB2EE2213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 05f541faa97a06084015910f5c6a135b4abf6a525a395a6fe8b4a6c405fb1e9a
MD5 be3cd4f358e3d913654639859d14897d
SHA1 33c7b8da0258441b9bb2fd2b008906c517ac50e3
SHA512 074f23b5c44e681988c10544e10e7edef93d86a1be653bdd00e4428e8695c0ed8948177aa1b4374d07f60b0666e07c3d2241489935bdf7b121931d42e62e1e0b
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcyropDa:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VW
TLSH
T1D6B2EA2F200DCB7E5F800AADAD196FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\369817fb-be28-4879-96e6-773b44ac96ff\index-dir\the-real-index
Size 360B
SHA256 f44ee2758a1a5af3003393c0eae7178dade35d01a502756eedd2d77ca8141dee
MD5 fc0cf8679159ef03607b04bf5fe134b2
SHA1 f1c2d818c893a791168273f6b3fe3854c30eb130
SHA512 a1119f5283ed60d326069dae7616cf2150d07adddfccde5fbc4076b01413e669ab4d37fd81c010e36cf1b5a390703aa50b3d5c4037c8fbe5212d9e8dd5b75b4f
TLSH
T1F3E0EB8A9C920907CA337C360B73502F333B06FE2504EE1610FD001D9B01E3C860120A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59576d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\369817fb-be28-4879-96e6-773b44ac96ff\index-dir\the-real-index~RFe59576d.TMP
Size 360B
SHA256 6141a28ec9f0737d7b917292d19762e38e1d28e682734f3dd81883cd18fcff4b
MD5 0a8e96662c1cd132c94b83f1e44026ee
SHA1 9a17590c0a183c375fbfa26d501d6b12fa988f82
SHA512 393bd55e09bc50840c1b94a2c167302b35f2bd11cbb45b3b4cb12d829ca86ad6dd8ef8da7931825beaec3ddd03c8b059d85bb9df2f034d0433b02564d5be098e
TLSH
T164E02BCF44915E62C92659361942512A333F0C242509DA1A209E545F16217BC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 e278c666a725e994adba4cd710f6237b35dd97e37d589328432ecf9aa1adbcd0
MD5 c493c8f7728ee5d8318a432259ecadf7
SHA1 d394b19170666f80ac589c3186f2b5d414bca344
SHA512 5eebda4b8cc4a0f8fbf6d0df81c09d2495113fe4463fd609daec87d64447c8fafc74134a10cecddee601ce096091039d4da146341c82b2162fe6225bf1eb220a
TLSH
T1C4A0021003C1505BD12221B52DD6067513908810F3401A566091068ACD91C60468741D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 192d6b47d757ccf17a7c4a81acf7e8af11549a09a65d8f6b7516413632b37257
MD5 de24e491fe452374087d3dc5337b6030
SHA1 2041ee0f83d7c47bf5436a86cb95ddffbf551a29
SHA512 60ce9194e3ddc095f1cb4c50e5737e5248383d1a9bf80a10db7466e8f0b5b5cbd030150ebeef1c859c8ed33ce57d1586c1922f82b247164dbaebe1671091e3d6
TLSH
T1F8A0021816C00003E41256B02EDA416522544A59A349630551A10669DC52575454310C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d1d4642fb70fbb0f3a02485ace69130b036ef7fa62410a99cbf822bb5e066285
MD5 139140670d84d5df0c94c126ef3d7f49
SHA1 5a7a8b0378647f199df148eb9776eb0fc0e450e3
SHA512 7648d2e2ac5e3aae9521a3799756da8b29a7534cb9bea0010c2cd7090519db43ea693aab5a288414652939ccc13b7430c5c3a22ff21f34e1b3c4ef1ab9d18a9e
TLSH
T127A0022DDF5C884AC162067091B2029C6F149CB9460533114CAC40A4886A68255E3664
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59adf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59adf9.TMP
Size 48B
SHA256 de0151716d23b20fe6749d4f72d14c5ae7071c6f52979ebcd0aadf1aaf0685b0
MD5 6799ea482d8c52bf169fad7c9d3a386a
SHA1 3c9532395c1c32298869c8d7ed40b75cf38ac44d
SHA512 8e8c1d31015057cf55b09f2462bbfca80f4e9aa26500cfaaa98a8b2f5366fbe164a6809e82c807bf42ebe2f4416d0c200704b360289acf97336f360525f0e86c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c5b001433f8c64105512d12e80d9d3f6964fd99d560da42350e21a8f261c0218
MD5 889420333423294ffc83569c17a793f2
SHA1 b52186af420756816cf00650e51b95b16686c0c5
SHA512 abc150d628a65d98b08b1a06b6fbcadd8fba9b031408bf31818f592912e8fa931831206958419e8dea39cf1d1cae68258f88d84cabb323d14e3b5b433e731d9f
TLSH
T180A0029531401951C4418E709085C2C5B228BB680132BB017595408C8A553928302100
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a42c61b83eb08261359c82e54df677fcef48ed22f7255eb886376a16b9955921
MD5 c8c71e5ce3bd4a1348bae718b5f51552
SHA1 35a38cf7d076a1109d31ffb46d6c3a9a2580c683
SHA512 fd726a2feb5cb87d2ca6e50acdcc239a9e7e07eb306da6bd81f82c2edc1c75aceb1012b2da7bc578697eacb7ae250d2118d5d09af20f339bb4b69f833b241431
SSDEEP 96:KREWELEaE2EQE4E4EeWEIEdEFgEWEeK4ErgEEEecE+EWE1E0EmE/HEmE7EKEmEgX:CEWELEaE2EQE4E4E5EIEdEGEWEWErgEI
TLSH
T132918941317F12413C7EB90885E8A82FC6827463705CA4AB7F6901678FAAE175FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 30ec528eb70e1f5497fc76969f81cbe8f438d3c2bc9e59ae7525126a87d9a714
MD5 a833f5dff75c7230ef3f29b385ce3702
SHA1 e27719115d2ea1b875df380f8ff4cea89aac50b1
SHA512 2ed221ab8eb2112fdadd824f33960849b71ae9f3de5c8424e39aea90eb939013b6ee2a852acfd55644b37a745cc1e30c35b9ac107488030e16146422d644ca09
SSDEEP 768:rrv+4UNbdS3Hmi09rEnjN3Gac1Z2seVH1SCz:rbsbg3U9QnjMawEH1V
TLSH
T11F03CF3669A89AB38CEBA385714776037FF4125386C40BE4CADD6B0D069B5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e56869184ee4847b6653e95a11b61d7e653d873d74b339543e8f3e930ee06bdb
MD5 3decf2cff23593faed2790fdfba1bffe
SHA1 3819f12c897ed9caac041f0c12680879c8c7ec30
SHA512 ed22c403a84b4e96da0eeab013ba6bba34bb984a6eb14bad1cb1454c4e7245e6ca5d5648226ad8c0dd06b63ebd51d41f7527aa91c5c7768d07930dab09f2ba54
SSDEEP 768:7rv+4UNbdS3QWmCHi0VrEnjN3Gac1FneVH1SCx:7bsbg39xVQnjMaYEH1X
TLSH
T11C13CF3569A89EB38CEBA385B047BA037FB4565385C40BA4C9DD6B0D06CB5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1309faf72b783d6f7b81b9ad44fdff842f1c3a75d920f7360b526b10ece59073
MD5 63f3288221940142ff630a15d0fe135c
SHA1 18434982e6a86d83a84b3cd0bc7379ad3fe0f8cc
SHA512 0a43e0d4dfa4ca7800b8a8d6453bd4b48789b19343a2e3a488d12e41b773bdc155c1afd2202b850844b6ddf3a14f8efd6666e3b1254f7984cd47cb9df517ddcb
SSDEEP 768:Drv+4UNbdS36ki0WrEnjN3Gac1oneVH1SCz:Dbsbg3PWQnjManEH1V
TLSH
T17E03BE3169B89AB38CEB93857087BA037FB4565386C40BE4C9DD6B0D06DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1e4fdd9e78c8ee0b8f17a261db2a53492892b7d3321b7bf144345dcfb93847db
MD5 0838a977f294d76f22b5a07894d42f32
SHA1 cce902135612759c4eda52a250ac82d3ca883ae4
SHA512 db84e05d9711eb940bca3900a6edcc96eecc2a41b87ae5b5d44593cb79153d0c3d7c992441dab5e44f53ff8115edacc7365462fbb4a8a527b12aaef05b509c9c
SSDEEP 768:Hrv+4UNbdS3DWmCHi0VrEnjN3Gac1FneVH1SCx:Hbsbg3CxVQnjMaYEH1X
TLSH
T17813CF3569A89EB38CEBA385B047BA037EB4565385C40BA4C9DD6B0D06CB5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NullWare.rar.crdownload

Path C:\Users\Admin\Downloads\NullWare.rar.crdownload
Size 4.0MB
SHA256 c80128c41195b86eba61747741ac31d5942eb76f1a450c8562e493fc9788119c
MD5 3565b0468ef04e7d73d372a47dc55dd1
SHA1 707b6a8b5e2af213c273dc4efb3db6e0c2ce9b32
SHA512 0f415aa615d29f57e1a4509bbe56a6f691d89ee3b3840158c244a8450e3d8a6ad8196983fd8a1d1a61b1bf350400f01246d557d66b22b2a07a9afc64f007a9f5
SSDEEP 98304:kBjNfI2jiPYFRqtyZx13oPMlPcAUjPVCi1bcdimO6ZZsJJenJ8fJaPLq:kBjB0YFItyZUPdXjt4dY6ZZsJJenJ8hr
TLSH
T17B1633559D9700B14A26F8AC7974CBC5DC78A642A0D0E5FBC2DF4BE3284BF13A625732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads