hxxps://carousell[.]ztwy888[.]com/i-erDzQ9MHAYh1/

Resubmissions

25/08/2026, 13:34

260825-qvgg4aap215

25/08/2026, 13:28

260825-qq6w7azsbx5

25/08/2026, 13:20

260825-qlexxasgkh5

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://carousell.ztwy888.com/i-erDzQ9MHAYh1/
Sample260825-qvgg4aap21

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	46	https://carousell.ztwy888.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a30afa4d7c0463db	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2784	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321384988792748"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5DB28D86-3A5F-47C5-8202-1F88284D42EE}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4484	WINWORD.EXE
4484	WINWORD.EXE

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE
4484	WINWORD.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3952	4244	msedge.exe	85
PID 4244 wrote to memory of 2784	4244	msedge.exe	86
PID 4244 wrote to memory of 2428	4244	msedge.exe	87
PID 4244 wrote to memory of 2188	4244	msedge.exe	88
PID 4244 wrote to memory of 2428	4244	msedge.exe	87
PID 4244 wrote to memory of 2428	4244	msedge.exe	87
PID 4244 wrote to memory of 2188	4244	msedge.exe	88
PID 4244 wrote to memory of 312	4244	msedge.exe	90
PID 4244 wrote to memory of 312	4244	msedge.exe	90
PID 4244 wrote to memory of 3016	4244	msedge.exe	91
PID 4244 wrote to memory of 312	4244	msedge.exe	90
PID 4244 wrote to memory of 3016	4244	msedge.exe	91
PID 4244 wrote to memory of 3016	4244	msedge.exe	91
PID 4244 wrote to memory of 3348	4244	msedge.exe	92
PID 4244 wrote to memory of 3348	4244	msedge.exe	92
PID 4244 wrote to memory of 3348	4244	msedge.exe	92
PID 4244 wrote to memory of 5080	4244	msedge.exe	93
PID 4244 wrote to memory of 5080	4244	msedge.exe	93
PID 4244 wrote to memory of 5080	4244	msedge.exe	93
PID 4244 wrote to memory of 4568	4244	msedge.exe	98
PID 4244 wrote to memory of 4460	4244	msedge.exe	99
PID 4244 wrote to memory of 4568	4244	msedge.exe	98
PID 4244 wrote to memory of 4460	4244	msedge.exe	99
PID 4244 wrote to memory of 4444	4244	msedge.exe	101
PID 4244 wrote to memory of 3552	4244	msedge.exe	106
PID 4244 wrote to memory of 3552	4244	msedge.exe	106
PID 4244 wrote to memory of 3552	4244	msedge.exe	106
PID 4244 wrote to memory of 4028	4244	msedge.exe	107
PID 4244 wrote to memory of 4028	4244	msedge.exe	107
PID 4244 wrote to memory of 4028	4244	msedge.exe	107
PID 4244 wrote to memory of 1104	4244	msedge.exe	108
PID 4244 wrote to memory of 1104	4244	msedge.exe	108
PID 4244 wrote to memory of 1104	4244	msedge.exe	108
PID 4244 wrote to memory of 2016	4244	msedge.exe	112
PID 4244 wrote to memory of 2016	4244	msedge.exe	112
PID 4244 wrote to memory of 2016	4244	msedge.exe	112
PID 4244 wrote to memory of 4420	4244	msedge.exe	113
PID 4244 wrote to memory of 4420	4244	msedge.exe	113
PID 4244 wrote to memory of 4420	4244	msedge.exe	113
PID 4244 wrote to memory of 312	4244	msedge.exe	118
PID 4244 wrote to memory of 4836	4244	msedge.exe	119
PID 4244 wrote to memory of 4444	4244	msedge.exe	120
PID 4244 wrote to memory of 5528	4244	msedge.exe	121
PID 4244 wrote to memory of 5528	4244	msedge.exe	121
PID 4244 wrote to memory of 5528	4244	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://carousell.ztwy888.com/i-erDzQ9MHAYh1/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8464264152612387406,4737685685520168838,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16686207229196651760,16212590922965882316,262144 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,10586441709189575274,2204654485307056179,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1141464438917209483,1178325474744256749,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,12438949551801724645,15564201310253445919,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,17719361525035841965,14848210168900209508,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,17670066696602106890,12268452628372458384,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,7893520740344133381,11736763023458750014,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,10016319418753560284,15659918857941689723,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,1314462604936580639,17603679902792729846,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,1314462604936580639,17603679902792729846,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6276,i,12972427301254812584,10909213737312020418,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3984,i,9293879929078436990,303353432251874254,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4520,i,6020549024325109105,10869112706256308492,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3692,i,602345866907837474,11835317791520374858,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6892,i,804215247776346100,18229929609587030918,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,8353790182295683240,5088972373538248362,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,13124005547877754644,1721027413036355980,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,14865663421969940589,5855149583455301682,524288 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5040,i,982026844886334540,1582707690150044608,2097152 --field-trial-handle=2612,i,18209122883463139533,13852113222156486311,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\ImportSuspend.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9dc5fdec25bc39388cdc468824614732fd4c2f8ff5232dbc465e2860852314ee
MD5 46e6db79ba48552335ccd6a36d7d8ab1
SHA1 30e54b31caa092ebb1eb47db9d3b6eb0ce6cb825
SHA512 1dde2d6ac748efd61dadfd7e1c7907832849e09410ed7d08aadfd0c332c0554eacb552b4ffa90c57b3a19cbe9ed744976841e5708c1f4d1735cc7f350ff3442f
TLSH
T15FD02314A5B8FFE0ED3215785335CA553BCD7551A103531ED18519770CE21C241E5FE0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cb251c4ad8acc8d4b3bf4b0caf7230e79580985ece84af267f4675ea5c7c484d
MD5 a1ae4a78586a445857efcfeaf78fdff3
SHA1 51674422dde046de6dfb014ae03fd2a699dab222
SHA512 166a24a79f111bcbb38aad135c9852f319afc409c9f89f61507652e0858830d88412837f1ab94adf712989e73fa1854b41aa6e8f4fe1c080ce2978d611962064
TLSH
T1BC71B3D403C5759EF7A23973D2D232903770C1CA0E477E480154A8FC9AD6BF5AB16C18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588085.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588085.TMP
Size 3KB
SHA256 a8653899924d3ef7f76b826c464611525945b1392321c1451f6810d33067156b
MD5 ecfe1caa39a14daff969842d5c1d93ff
SHA1 b7ed7dbcea56f1481e965191276278cc58deaf0b
SHA512 5c71c6193a03317ab596dfc7705b7a85a76b78f9810f75766126be4db384c304b3e92a0ed694fae547f7b2bacde2aaa7b27d399a8817e626fc7c7166a74bfe31
TLSH
T1937193D403C5759EF3623973D2D232917770D1CA0E437E490154A8FC9AD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3e594823e8b062263e2e1f1cc1c9e3d248d150f1b9f176b43ffb1ec465591356
MD5 2874d7be81d79c8b1935d8496588c1d5
SHA1 eaa45790c0fa77f44538e69f2989d58a1b7abe87
SHA512 3928936c6db7dd7cd4e457973f1b72cd1ffc91a8265364c8efeb507ac6640139c7a59258c56f0abcfe2be6cbce26a205a83d888f382b3e685f2e505f3641e03d
TLSH
T1CF519CA2C3E9871DD8152AF09B687D2BCE6D0914421C3C6AC9D6FF4B53E2075E10668F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0810847f806732c416d46c81a5ec5cbd5ddc2d65de01120b5adf3dd5f902d0e9
MD5 d32374f16ff26f3548f23c9e81bb3150
SHA1 528c265af1d61ed7a11e2a742605d0d96aa5d3bf
SHA512 26286d585846f464c1761b7677575860dc0e8489fd818f2854fc36f6c61a32726c8904db93cc84b812c4f890eebd014e867c354aa731316f12241ba5970e1dfa
SSDEEP 192:sxZdRhyM/jK1Ml8Mkd/fcsEji5IdpuMzHW6+WNZoX/YLt1D5ZIgrJ:sxZdHMd/fcsEjiSBHbu/m9
TLSH
T1EF52E912AA346977CCDBD309FA45BF93D6F50472A2941E449AFCC91C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6ee2b1437602b08cfd3b1a2536df6ad5b04ec63f05d700870a689e39805a6555
MD5 ce9b9ed0814d440eadb7ec82dca582eb
SHA1 c3d8515c056d6b8447126f946041b90ccf320dff
SHA512 9965a74f2e09017d570722f3f1213836b2ae6713d15f0be5ba93bac7910a5574b94d65d50403b2749da1cd159c8a43383a3915c5ac4ef27565abc5f1f62c3d33
SSDEEP 192:sxZdRhyM/jK1Ml8Ekd/fcsJCWpVLK3IdpuM1HW6+WNXUoX/YLZ2nXZIgbPJ:sxZdHKd/fcsJCWvLKYDHbf/Bt
TLSH
T1B362D916A6346977CCD7D30DF645BFA3D6F41422A2951E449AFCCA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 da7dd7f4af15960dfd4daffce5282bdde1ecb13de6055a3b21d657ced5ebae27
MD5 68dfbd1303a896e4f946a1ab80c093ca
SHA1 dfd3995a44e2cd084b1407edda548707dcf09227
SHA512 d721fc1f53ab7d94ea6be8380c1bcf2aae3c17838d8ba5874cb1eaa2be95a121f7c9a49cb5ad0bf810958566345ccc82939b2991ce8c9c2590d11cd331fe1061
SSDEEP 192:sxZdRhyM/jK1Ml8Myd/fcsJji5IdpuMt4HW6+WNZoX/YLt1D5ZIg5lJ:sxZdHad/fcsJjiSH4Hbu/mB
TLSH
T19652E916AA346977CCDBD309FA45BBA3D6F40472A2941E449AFCC91C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cfdc2fd6b1e0b322467243699f9684b019ace7abbaafcfb420ae25c54db6ed6b
MD5 c3c9b81dce1e8903952043a759419067
SHA1 4ef0c6d984dca69e094a68ab49d17b5130b5fa26
SHA512 887c1d9528840208acf17ea32e86a1e5eb3ba86790b0e4bb6f553d1b92a71604c0cd5fbd0a41c44bfde6ebf8ece6cc3486ca3a31c495ffa4d8da27245ef6bc08
SSDEEP 768:CMs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNFroA+:CMs6pD1WvxzUju1jahILIsN+A+
TLSH
T1D8E2FA3B680CCB7E4F841E5CEC2AAF966DD801CBAB94895447FA484C03C77EE512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1901ccfdd9230468f6e58eafdd62358aedc0ffced30fc17937596bfd2faf044e
MD5 03f3df29ed520bb99d5f0ab22418ab01
SHA1 721af77b727a15a88ff64c9bc86ce987b3a2b6ac
SHA512 a20a855ef0c98a6f90ad6267b1760edde84845e0978d5e4384462f27b63082258da06733662be33c8d0ad3d6ef23dd1d332602498a83e2377bb5db905186156e
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyF9IVK2QwHytnIlKUU4fyxsInKxWsd4Im:KUAAKtePW9OK2QSOn2KUUiisoKxWq4F
TLSH
T13BC1174736B702123C7E290C93A497279782B6633018ED6B7FA860B15E66E344DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 eab118c6a26a6c79963095a4f98a7b09ec92954b67c7c60b89f61dc22771a2c7
MD5 907dc06e566fd83de8bb17201d7ed37d
SHA1 f317d5c2812926c4ef6f0c418ecfed7d17cf9d16
SHA512 c829be1c0dd9826c5163584dcc118f80441715f6b214ea0c42ac6aa407c5f0d9073683df062172047989adcb02d747feaf248d4fd482c79623706a7437c99a18
SSDEEP 3:MsEllllkEthXllkl2zEklDI:/M/xT02znDI
TLSH
T12B4404047FC00C45C50110304011C3501774D4310551574774D10433FDC55D04C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a108b966d42d0a73c19f3e76a5ef5025c7261e636e008c781b0d68dd208bcf2
MD5 a04b33366b534f0bd8928b3de4b87ef6
SHA1 1b433b589ee56f25dcdeebad879058493b30e67b
SHA512 db3c8ac8ee778f0fd3341064e1db13b75e696e559c91634ae9b17e648d6ffaa28edecdd663f59420bed7aa4d829534203f95a265a4ce7527584e39936088e711
SSDEEP 384:mZcIhsN5qCb2O7ua9gO2MHWIOiv1+aRoH:0h+xTuOBhOitlRA
TLSH
T1B6828F725C785C7628F6D245F6463A179FB88067DBC93E50D5DCAF2D00EEAAC130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 68ca07ab1f381c8b4c2eeade8d593ca766191d8f2211e9e2de5b602f03483003
MD5 89d06d90c7088624d4369650f1d6559e
SHA1 0816e276804d93829a93f2e12ee1c38ed2be613b
SHA512 c661a58fc9a814c4dbf2dd320e28495ab86ead699112355947c345b5e860e1e86f788dce87975da2074dfebdd9bec56d837b131a85b17f97988a027d1ca8040b
SSDEEP 384:YZcIWsN5rCbCO7ua9gO2MHWoOiv1+aRoH:mW9lTuOBFOitlRA
TLSH
T126827E725C789C7628F6D145F6463A179FB88067DAC93F50D5EC9F2D00EAA9C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a9ea8047ac749714da5a4a138d2e62a1d1c169df1e875a8d8b942dc27e637eb0
MD5 09cb2e28578434c2823f8e95e2abd21b
SHA1 7a577e87edd5315a26a8316ac427014d43d11651
SHA512 11edab2d7ea0d5fd350610c17a7e500152593610c95872bb1b442d5c1fbe9da579c1e2525d867a899c6945b029ee2dea65a91181595eb3457218df9ccfca3c25
SSDEEP 384:rZcIWsN5eCb2O7ua9gO2MHWIOiv1+aRoH:zWuxTuOBhOitlRA
TLSH
T19D827E725C789C7628B6D145F64636179FB88067DBC93F50D5ECAF2D00DAAAC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d92d0859084c2892130268e2e0ce41def4ed44ad8293ae4884f1b650eb53c919
MD5 9accbebe888dc49f65c6d93364be46ec
SHA1 7ae5c3049e749ba28500d898b4c3f2aab1a6bc2d
SHA512 09b3b70b3f085a93d9149598debca937cb68c9a4d05c20fa9e6af6a2bcf6aa3c3cf5473f8954d26920ab7890b93b7593c14ae77e99ef2ceca1c726dd9aa9d6a4
SSDEEP 192:qON3EV6O7+3hQmiUytfGttb05O29h2qgGVeU6:qONC61eGt9gO2Ms4U6
TLSH
T1EA02E9356C386CB74AF3AE46F9873B235FA5112BE9A52F84D6E81E1C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a9218bfd13a45e6ca95abab9b407bd4badb1a86105234992d38c38d1e8078773
MD5 d472de1061782630f9604fadc3f6da76
SHA1 93e9b121b4578f5e815021f5d0cc1ea6c1921774
SHA512 6ec4e5f65dc7f35cf73338ff9901158efbbbb2acf8cc0fefa364fc38ffff611826fc0d9c62278022a49b840b4e470fa7d4b5487622bef0484856560f829d6a4c
SSDEEP 384:LZcIEsNYrCbCW7ua9gO2MHWoKbASt7eN/brCxKBb437/p8iv1+aRoH:TEY7TuOBF/Skr2KBb437CitlRA
TLSH
T123B24BB1D8A95CF714A6E0C4AA42F5176DB81037C98D5E0CD6F8BB3D309FAF82756412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47c67f45e75197ce6e5a072b8ff7b7efa97069f84140f9bc81f45ad30381781c
MD5 6e16b9575d1b919855bde2e16fa39029
SHA1 3f0ecccc1b4514927f466bd1f3261a99b1313c4b
SHA512 8ce10e8f8506dfc91a0a758b42888d552e8d4933e36fe69f2af4c0f482311c979a76f6276e15cdf00a9a47e214821e73cb6203c974386b71ee5134f68f9581c7
SSDEEP 192:SONU6O7+32QmiUybfuttb05O29h2HoN2cNeqEjU6:SONU60qut9gO2MHWXOU6
TLSH
T1C4121A36686CAC775DF3A545F58736238EA44127EE8A7F80D5DC2E1C01EFA6C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 adad0c272f4676afd6a30a99a3f4f94a84a00f55d9ba74c24697747dbbd3a48b
MD5 94c630f2b8310bf8fe66849be7749bb8
SHA1 73c3a6470289ccccb9d1ff0d1a301ac6bf76e56f
SHA512 09eecef74fb4824822c2dd43c2d3dff0eee90ba78b46ffaf29584a20657650d2d261e87d52647e8b7da5f711ff23daa8178f664c594953623878bfffa1bb5136
TLSH
T1A2411458BBFA5148B3B76E06ABF6B86D487A79772E06949D00110D8F0A73A40CD72737
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 218B
SHA256 180d09e99ad619197b86e6ebd1cbe2befc54b4c2cb6a82b0c793c4b79ca87fc6
MD5 d521dab36b67c88a7860673ff5bd313c
SHA1 6e34152b650e1570d23f007b4c790cd70789eefe
SHA512 ea92606db1cfd3f4dff0810184544f4c8b85bf9e83c4228c36325ec1dbe52e3ac6b8401d96c3bde5b7a0d9e7c87a45fe77183ba1eab521f651a24aae27969ff5
TLSH
T12DD0C957F31AE3F1933C04943E7A5EE88BF38898E38D402016DD0D581FA09872097518
MD5 SHA1 SHA512 TLSH

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4484-217-0x00007FFC78ED0000-0x00007FFC78EE0000-memory.dmp

Download

memory/4484-216-0x00007FFC78ED0000-0x00007FFC78EE0000-memory.dmp

Download

memory/4484-221-0x00007FFC77D60000-0x00007FFC77D70000-memory.dmp

Download

memory/4484-220-0x00007FFC77D60000-0x00007FFC77D70000-memory.dmp

Download

memory/4484-219-0x00007FFC78ED0000-0x00007FFC78EE0000-memory.dmp

Download

memory/4484-218-0x00007FFC78ED0000-0x00007FFC78EE0000-memory.dmp

Download

memory/4484-215-0x00007FFC78ED0000-0x00007FFC78EE0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads