a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

user interaction
yes
max time kernel
66s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MEMZ.exe
Size 14KB
Sample260930-grepnasfne
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{161D832E-F9A8-45B8-95AE-EDB91D6B83C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
1496	MEMZ.exe
3140	MEMZ.exe
1496	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3448	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
3448	MEMZ.exe
3448	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3140	MEMZ.exe
3428	MEMZ.exe
3140	MEMZ.exe
3428	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3448	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe
3448	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3140	MEMZ.exe
3272	MEMZ.exe
3140	MEMZ.exe
3272	MEMZ.exe
3448	MEMZ.exe
3448	MEMZ.exe
3140	MEMZ.exe
3140	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	taskmgr.exe
Token: SeSystemProfilePrivilege	4592	taskmgr.exe
Token: SeCreateGlobalPrivilege	4592	taskmgr.exe
Token: SeShutdownPrivilege	3448	MEMZ.exe
Token: SeShutdownPrivilege	3428	MEMZ.exe
Token: SeShutdownPrivilege	3272	MEMZ.exe
Token: SeShutdownPrivilege	1496	MEMZ.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
3684	msedge.exe
4592	taskmgr.exe
3684	msedge.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3272	MEMZ.exe
3448	MEMZ.exe
1496	MEMZ.exe
3428	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
1496	MEMZ.exe
3428	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
3448	MEMZ.exe
1496	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe
3448	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
1496	MEMZ.exe
3272	MEMZ.exe
3448	MEMZ.exe
3428	MEMZ.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3140	4588	MEMZ.exe	81
PID 4588 wrote to memory of 1496	4588	MEMZ.exe	82
PID 4588 wrote to memory of 3448	4588	MEMZ.exe	83
PID 4588 wrote to memory of 3272	4588	MEMZ.exe	84
PID 4588 wrote to memory of 3428	4588	MEMZ.exe	85
PID 4588 wrote to memory of 4816	4588	MEMZ.exe	86
PID 4816 wrote to memory of 3504	4816	MEMZ.exe	87
PID 4816 wrote to memory of 3684	4816	MEMZ.exe	90
PID 3684 wrote to memory of 2108	3684	msedge.exe	91
PID 3684 wrote to memory of 2464	3684	msedge.exe	92
PID 3684 wrote to memory of 4868	3684	msedge.exe	94
PID 3684 wrote to memory of 4868	3684	msedge.exe	94
PID 3684 wrote to memory of 3356	3684	msedge.exe	93
PID 3684 wrote to memory of 3356	3684	msedge.exe	93
PID 3684 wrote to memory of 3356	3684	msedge.exe	93
PID 3684 wrote to memory of 2820	3684	msedge.exe	96
PID 3684 wrote to memory of 2820	3684	msedge.exe	96
PID 3684 wrote to memory of 2820	3684	msedge.exe	96
PID 3684 wrote to memory of 2364	3684	msedge.exe	97
PID 3684 wrote to memory of 2364	3684	msedge.exe	97
PID 3684 wrote to memory of 2364	3684	msedge.exe	97
PID 3684 wrote to memory of 2204	3684	msedge.exe	99
PID 3684 wrote to memory of 2204	3684	msedge.exe	99
PID 3684 wrote to memory of 2204	3684	msedge.exe	99
PID 3684 wrote to memory of 1428	3684	msedge.exe	102
PID 3684 wrote to memory of 1428	3684	msedge.exe	102
PID 3684 wrote to memory of 1428	3684	msedge.exe	102
PID 3684 wrote to memory of 556	3684	msedge.exe	100
PID 3684 wrote to memory of 556	3684	msedge.exe	100
PID 3684 wrote to memory of 556	3684	msedge.exe	100
PID 3684 wrote to memory of 4848	3684	msedge.exe	101
PID 3684 wrote to memory of 4848	3684	msedge.exe	101
PID 3684 wrote to memory of 4848	3684	msedge.exe	101
PID 3684 wrote to memory of 3772	3684	msedge.exe	103
PID 3684 wrote to memory of 3772	3684	msedge.exe	103
PID 3684 wrote to memory of 1108	3684	msedge.exe	104
PID 3684 wrote to memory of 1108	3684	msedge.exe	104
PID 3684 wrote to memory of 2548	3684	msedge.exe	106
PID 3684 wrote to memory of 2548	3684	msedge.exe	106
PID 3684 wrote to memory of 2548	3684	msedge.exe	106
PID 3684 wrote to memory of 4856	3684	msedge.exe	107
PID 3684 wrote to memory of 4856	3684	msedge.exe	107
PID 3684 wrote to memory of 3968	3684	msedge.exe	109
PID 3684 wrote to memory of 3968	3684	msedge.exe	109
PID 3684 wrote to memory of 3968	3684	msedge.exe	109
PID 3684 wrote to memory of 664	3684	msedge.exe	108
PID 3684 wrote to memory of 664	3684	msedge.exe	108
PID 3684 wrote to memory of 2124	3684	msedge.exe	110
PID 2124 wrote to memory of 4756	2124	msedge.exe	111
PID 3684 wrote to memory of 3108	3684	msedge.exe	113
PID 3684 wrote to memory of 3408	3684	msedge.exe	114
PID 3684 wrote to memory of 3408	3684	msedge.exe	114
PID 3684 wrote to memory of 5108	3684	msedge.exe	115
PID 3684 wrote to memory of 5108	3684	msedge.exe	115
PID 3684 wrote to memory of 1932	3684	msedge.exe	116
PID 3684 wrote to memory of 1932	3684	msedge.exe	116
PID 3684 wrote to memory of 2916	3684	msedge.exe	117
PID 3684 wrote to memory of 2916	3684	msedge.exe	117
PID 3684 wrote to memory of 5620	3684	msedge.exe	118
PID 3684 wrote to memory of 5620	3684	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3272
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7fff718ac188,0x7fff718ac194,0x7fff718ac1a0
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13410650179083175469,12484313102051831953,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
      4⤵
      System Time Discovery
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10937023588553292962,14542307041956292151,262144 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,18233792577647695213,14679517171707330169,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,17837199585592135125,8213279836955326010,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,15030249490201969561,15470967156009312193,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9064814452865733205,9956562638317238655,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11361367447492570284,15246961169251113040,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,4207221926724893947,7242852918916310870,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,3886742138729606258,15169663565122167391,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15472077078049222308,4037308934672773320,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9784685855344705026,11608774304288276640,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5608,i,3141373550489813253,12467558227716659539,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,16143491230946659079,12441339096521034110,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,12063891297133592181,4457764464913301924,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3644,i,371048358769163548,17606489382850683212,2097152 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,15307375554807428593,11648754844451821395,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,16725648365375279753,6867217711786617026,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,16725648365375279753,6867217711786617026,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,15445379614374692120,12341287037892071111,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,10813521234648629809,8309446359032830282,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,7879842796072223356,11402316307091234241,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,6512738546043828418,6696043766014106977,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12271657917129157768,10758114195834515496,524288 --field-trial-handle=2196,i,14767125230527090299,2112509284744034349,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
      4⤵
      PID:5620

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
MD5 7fe12d00d13e30949f1419fc02757c7e
SHA1 7fe9042bd95f9f143a17aee8b65dd97f8f4eb44e
SHA512 c9251c530a2927beaa3f58a69cd075267ab37b951ce23f2f159ff17f194ed9b03a08d41f5cce2d4dd1a091898135db5440df49406cc67c2f8fa1bd50c44edd4e
TLSH
T1B1D011A2FB32008CE0802238A23B2B282E00820000C30000AA2000AEAC882A2AABE028
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8169d6563bc65b4ad062aa603c8e6d740ef968bd936229a4b8774fcb9c0dee6f
MD5 4fcd0f4eb4340aa8311e9aa78e9e5a1a
SHA1 5e17841014f09b5ab5381ca2746284b58bc8ca2c
SHA512 f178b1f9083f3d8e845f1840ac601f504ab3a81579696dea2f4e95eb9af5d6ed045245900cfc328c889a665e1c6e23cfe2fd9b395c012fb603dac15e5c74fd39
TLSH
T185619186DA84989BCBECBDB8E9E574C73AF45D8277B30D0110EBC83CC89E3557911400
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c3eb6f8bf3e152256bf5ef6e666d810d080c934f5248aae89ee17923c8dfba0c
MD5 175029fa4e015f26bf1a590aa0dd08e5
SHA1 d150a1e93833f390bff439cd46f3d27d35aff31e
SHA512 ea18038a7e2343618623727efb2c961a0fb15f6817ef63f148ee5f5227978e6227ad5a2934cb0a0b667ada25a87330c5e93c4fe9cb790343d7de643954e69976
SSDEEP 192:sxZgRRYN/fPsI13vgiLIdpupGV/W6+WNqoY8/Y0H1e+bIg4J:sxZgsN/fPsIt2F/bj/5Qac
TLSH
T17F32EA566E38A97B8CC7D319BA29BF53D6F9143251D41E88E6FC8A1C04E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e97c5b4bd25c1540268c2f4aac73bbf212f4db0eaebc6cf72833fe331ce0bcf0
MD5 33c8f61d745c7ce92db50afa252135bf
SHA1 51a5525ce8db1ee64c3c55743b3c090650a9ab75
SHA512 6b1101d4d56b99722039fef7990a5d7c0047c183fa460b3f0c7b102f51cdb4d129def04a7fe9538dd5d59ba87d3d7063f800b1647c5a9946799516662aae95bb
SSDEEP 192:sxZgRRYN/fPsj13vgiLIdpupGV/W6+WNqoY8/Y0H1e+bIg5fJ:sxZgsN/fPsjt2F/bj/5Qa3
TLSH
T1CF32F9566E38A97B8CC7D319BA19BF53D6F9143291D41E88E6FC8A1C04E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 825c145d69e1ea2c3c1c59e6464069cb3800fd6b76db1306112568b4ac67c2a6
MD5 f01a94ec79dfce0d0f0d76199b6fb471
SHA1 9fb13eee6b59112dbfe7f9870c0d9961deafb0f1
SHA512 ef7bf8ed48c07d07f8b789a318eed8c69fad9d2d52346e13228eeb884764e069032d96e21f90fe6bac851fbe7d44f9d1b1f1a36d5a90714aedc4b7412ab988ea
SSDEEP 768:4VY2I87M2fu7pLuLbXTWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3StLyLlk:4VY2I87M2fuEbXTWRmjdQVxu1jaKStLV
TLSH
T1DDF2EA7B380CCB7F4FC04E9DDD1A6F9B6DA8028B9698898447FA845C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2db6bb464b254a71390a04bdb762c69a91cb34010e65d6c40eff92ed3e45535d
MD5 a4070b3c7ac471ed5996af1a0b64dd14
SHA1 303a88f959073c22362538759787a0b8b8465390
SHA512 e6454ff4a4725c992a60dcb0ebee41237a131d17cb1c47d971e812d53aaf4469280549a10e27af143b5aba0faad1add8f12f18a73189ca5f44fcb739a381169d
SSDEEP 96:KkkN5EtpnTPkfTaPNRkKFBNvkBJp6nJ5+v6KcgPZ6d5DL7WBLsdb5WKzzbnWXx7:fT1HG
TLSH
T13791F740356F034238FD790880A9876F524271B7356CEA6A7BBD00B78EB7E094DF96C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 929f41d93322a12cbe9a9d7e6f4273daac99ba0ba94a7a66a7fe2f0d6c52a9c3
MD5 d4e0d7fd7416971531710df5b95ba267
SHA1 047f6ca779457e4497f079c848c54ab322344401
SHA512 cfcd033b03492eb92ebce1d1ea95128589f4f62f6b4275ac74ace384750f7c848a92600766d125a60682b8ab3d2b2ec1afd9a8f97b37d7f0f51d5c99f7585f42
SSDEEP 384:nAZcIh8Nu89arfMS9ckX5mV8e3y/clRVZh6DKhHkoN:+hQJsATi/gRfYGHku
TLSH
T1C5827C76AC78AC7259F6E105F8862B179EB45063EAC46F48E5E88F1D0097358371BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2421a199e8454c41cdb9a7a9f3fd34be1b60759bcc60128bca50993bf2b5a07
MD5 2022f4dd66978b205a6e8e7d8d496256
SHA1 bbac3b57f600ca8f58f4d54ddbf0c5f0d8622b43
SHA512 0317f2e541a3f62e672405a5e854530b3da70c4deae1b2f87095940917c3b59cca54a5c0f83f697d1ea0813b58b68e9887bc2e79bdf4f75ec481dc3b4316cb5f
SSDEEP 192:AGNm6WLkQmiUyImlMLEbnckX5m9r8e3porlg4lV4U6:AGNm6a0b7LQckX5mV8e3yDaU6
TLSH
T19002DA39AC787C7B9EF3AD49B94627179ED5112BEA853F44DAE80E1D40D729C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 608d6685298ed81cdfa2c893098a8c7ea663ee6c64578d39cb441a34aba7f3e3
MD5 1704462459235fcaf1e6556b79112d56
SHA1 03b243beb2930580cbc03391d42582cd792ae576
SHA512 691c21bbaba25f94ec064ba4bc2a0c3759443ea4d53ae67b9c1b59fd4db3728e3f46df9d4d8d8f61ba6700ec4dcddee3bd6e4b4b44c39ddf17c1871a46d7a680
SSDEEP 192:AGNH6WL6QmiUyvlMOEbnckX5m9r8e3porlVcNBMeWqGIDU6:AGNH6a2ROQckX5mV8e3y/cXRU6
TLSH
T1DB120875A879AC671EE3B454B88737279DA52167DA846F48E6E80A1C00DB39C370F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

626e1168-46eb-42ad-8e0f-ec979160eb14.tmp

Path C:\Users\Admin\AppData\Local\Temp\626e1168-46eb-42ad-8e0f-ec979160eb14.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

87e43d7a-9ddb-4757-8208-dbce7d84e234.tmp

Path C:\Users\Admin\AppData\Local\Temp\87e43d7a-9ddb-4757-8208-dbce7d84e234.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3684_152588232\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd906128-a337-4f76-91f8-a7cbf854cbf1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3684_397327539\dd906128-a337-4f76-91f8-a7cbf854cbf1.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4592-10-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-8-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-9-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-429-0x0000020117810000-0x0000020117A14000-memory.dmp

Download

memory/4592-11-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-12-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-13-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-14-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-3-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-4-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

memory/4592-2-0x0000020119A60000-0x0000020119A61000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads