hxxps://www[.]upload[.]ee/download/6927389/1258a8d3d3d62347e5b9/BOA[.]zip

Analysis

user interaction
yes
max time kernel
568s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.upload.ee/download/6927389/1258a8d3d3d62347e5b9/BOA.zip
Sample261003-xbe89avdnd

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
170	4800	msedge.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Activator.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activator.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{02C332CE-53C2-47D0-B12C-CFDA6196DE6E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
5980	Activator.exe
5980	Activator.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe
1704	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4168	4488	msedge.exe	86
PID 4488 wrote to memory of 4800	4488	msedge.exe	87
PID 4488 wrote to memory of 5000	4488	msedge.exe	88
PID 4488 wrote to memory of 5000	4488	msedge.exe	88
PID 4488 wrote to memory of 5000	4488	msedge.exe	88
PID 4488 wrote to memory of 4036	4488	msedge.exe	89
PID 4488 wrote to memory of 4036	4488	msedge.exe	89
PID 4488 wrote to memory of 1176	4488	msedge.exe	91
PID 4488 wrote to memory of 1176	4488	msedge.exe	91
PID 4488 wrote to memory of 4988	4488	msedge.exe	92
PID 4488 wrote to memory of 1176	4488	msedge.exe	91
PID 4488 wrote to memory of 4988	4488	msedge.exe	92
PID 4488 wrote to memory of 4988	4488	msedge.exe	92
PID 4488 wrote to memory of 5112	4488	msedge.exe	93
PID 4488 wrote to memory of 5112	4488	msedge.exe	93
PID 4488 wrote to memory of 5112	4488	msedge.exe	93
PID 4488 wrote to memory of 3800	4488	msedge.exe	94
PID 4488 wrote to memory of 3800	4488	msedge.exe	94
PID 4488 wrote to memory of 3800	4488	msedge.exe	94
PID 4488 wrote to memory of 3028	4488	msedge.exe	99
PID 4488 wrote to memory of 3028	4488	msedge.exe	99
PID 4488 wrote to memory of 3028	4488	msedge.exe	99
PID 4488 wrote to memory of 3208	4488	msedge.exe	100
PID 4488 wrote to memory of 3208	4488	msedge.exe	100
PID 4488 wrote to memory of 3208	4488	msedge.exe	100
PID 4488 wrote to memory of 1756	4488	msedge.exe	101
PID 4488 wrote to memory of 1756	4488	msedge.exe	101
PID 4488 wrote to memory of 1756	4488	msedge.exe	101
PID 4488 wrote to memory of 936	4488	msedge.exe	102
PID 4488 wrote to memory of 936	4488	msedge.exe	102
PID 4488 wrote to memory of 2456	4488	msedge.exe	103
PID 4488 wrote to memory of 2456	4488	msedge.exe	103
PID 4488 wrote to memory of 2180	4488	msedge.exe	104
PID 4488 wrote to memory of 2180	4488	msedge.exe	104
PID 4488 wrote to memory of 2180	4488	msedge.exe	104
PID 4488 wrote to memory of 3404	4488	msedge.exe	105
PID 4488 wrote to memory of 3404	4488	msedge.exe	105
PID 4488 wrote to memory of 3404	4488	msedge.exe	105
PID 4488 wrote to memory of 212	4488	msedge.exe	107
PID 4488 wrote to memory of 836	4488	msedge.exe	109
PID 4488 wrote to memory of 836	4488	msedge.exe	109
PID 4488 wrote to memory of 836	4488	msedge.exe	109
PID 4488 wrote to memory of 900	4488	msedge.exe	112
PID 4488 wrote to memory of 900	4488	msedge.exe	112
PID 4488 wrote to memory of 900	4488	msedge.exe	112
PID 4488 wrote to memory of 5228	4488	msedge.exe	117
PID 4488 wrote to memory of 5228	4488	msedge.exe	117
PID 4488 wrote to memory of 5228	4488	msedge.exe	117
PID 4488 wrote to memory of 5316	4488	msedge.exe	118
PID 4488 wrote to memory of 5308	4488	msedge.exe	119
PID 4488 wrote to memory of 5316	4488	msedge.exe	118
PID 4488 wrote to memory of 5316	4488	msedge.exe	118
PID 4488 wrote to memory of 5308	4488	msedge.exe	119
PID 4488 wrote to memory of 5380	4488	msedge.exe	120
PID 4488 wrote to memory of 5304	4488	msedge.exe	129
PID 4488 wrote to memory of 5292	4488	msedge.exe	130
PID 4488 wrote to memory of 5344	4488	msedge.exe	131
PID 1704 wrote to memory of 6080	1704	OpenWith.exe	140
PID 4488 wrote to memory of 6040	4488	msedge.exe	141
PID 4488 wrote to memory of 6040	4488	msedge.exe	141
PID 4488 wrote to memory of 3996	4488	msedge.exe	145
PID 4488 wrote to memory of 3816	4488	msedge.exe	147
PID 4488 wrote to memory of 2880	4488	msedge.exe	146
PID 4488 wrote to memory of 3816	4488	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.upload.ee/download/6927389/1258a8d3d3d62347e5b9/BOA.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb4585c188,0x7ffb4585c194,0x7ffb4585c1a0
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6903805827757469812,1043043372292430490,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5355196887468651007,430843465294804017,262144 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,13102657315138332907,13484460812715779223,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3096,i,16292797307057631009,16830474261642683828,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2580,i,15369276826758454381,16759987042557847573,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,5323380211669593875,15832665429657163354,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5467068615858257811,10614599801703920953,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,13679604787330974667,9809408305629732747,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5284,i,8838190875603805048,18134078694353679609,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,9793203063339224541,6755049881650431958,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17674509894783058922,7269269030009869135,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13858471719987495940,15053465545705531059,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6188,i,10318712226824534252,9414506064192428228,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6340,i,8856120138957197095,15199068744405370794,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,11625737801296159580,5576863483086363555,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,11625737801296159580,5576863483086363555,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6252,i,1553020757837918435,7531056560696022349,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6312,i,6266644604667771819,5355268531794438035,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6456,i,11827938709572442787,725883869077540268,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6568,i,12669374222753198835,17654509797888417959,2097152 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,868100127835856555,2100612395868819521,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,16522235226547281325,15006967410776848090,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,17374960892548237490,8622778396742531135,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,10421997478811243506,9985886064776049356,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,8414413834012662330,1162975908649219521,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,13648620164186538319,5028705931633953922,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6972,i,5260721353382440501,16528411880382044550,262144 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,6077566817615192507,1437588292247866161,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,5248658558860317987,3909626934143812519,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,15239958460538434722,6572383633790400209,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,16038289094681661079,4144804525380518039,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5575552272647224536,5209860595795417900,524288 --field-trial-handle=1904,i,3083664225568234179,12657231054939533434,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\Temp1_BOA.zip\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BOA.zip\Activator.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\drivers\etc\hosts
  2⤵
  PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0b42e263-e538-4d77-8329-8585fe14865f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b42e263-e538-4d77-8329-8585fe14865f.tmp
Size 8KB
SHA256 933131ebe59f5f45e337aae25c9060acbcaaef187b2083b478ef8a63ea720ed1
MD5 4d451f773aaf9d6fb1c9015fb1ef81af
SHA1 c0f0882e71e4a77cfd753799cbdc8d3a9b4970e3
SHA512 6a72d4ee82441c1de4d6e72af6765397fecca091fd4945766b6ab2778af64d21cc90a9b7b1b86b11ac0a69c92208450662b719a8f0a8a270af18915099ea24a2
SSDEEP 192:EONL6nnHGQmiUyBtQ4YcX5hQDP12jzor21mxXu1g3zq5TU6:EONL6nCGy4NX5+Dt68xXuqQTU6
TLSH
T14512FC31A8B8AC675EE3A585B08736136FA55137DA897FC0D6EC2E2C01DE66C1309D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c848bb6-2e3a-4cd8-869c-82e81e77eb7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c848bb6-2e3a-4cd8-869c-82e81e77eb7d.tmp
Size 18KB
SHA256 96aea19bcfc95069dc886145e23eb297a675004570f3376355e18f36ffa18284
MD5 087ab96a1fecd482dcab45677319b37c
SHA1 7a77a9c8fd4a77d67a77127bd3294e697a892e18
SHA512 a4326b19ac97dca9457fb66bd3efceae727c0b8fa67fa4dc1e4074281e2b39afc840ffcfb0a36953e0a208f34ff09d2acc8597554e9abe557de964f0c33f6b15
SSDEEP 384:2ZcIhsNC0l1ewiUjdnZ2QX5+Dt68xXu3QTtgOIwZOyeoIos:kh+1zvZ9kDHwQTXs6IX
TLSH
T16B827E319CB89D7B19FBE185F18736035FB4912796C86BC0D9ED6B2D01DA6B9030AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251da22d-b0d7-4787-a121-49d84464c5a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\251da22d-b0d7-4787-a121-49d84464c5a7.tmp
Size 8KB
SHA256 1a41c8201c34191637dec7a4eb3bb5cbb6bc6f7b4223f52f1806d910ac38435e
MD5 a55df766981467470013790713526a01
SHA1 0f6612f514f559b3241d19c728814cbbe78e069e
SHA512 d7330b606e9501310d2ab73b79ad6face6cdda9eb75d498f983e986473076e3402138108210d5520764d3172ede63510c4edad0b103cdbd6a330f038c87e0d41
SSDEEP 192:EONs6nnHGQmiUycQQYcX5hQDP12jzor21mfMcW0U6:EONs6nCsQNX5+Dt68DDU6
TLSH
T1D302DB34ACB87C7B9EF3AD49B4872713AF95213795952BC4DAE81A1C00D769C2306D73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9283330a-bcf7-4ae1-89e8-80d0d0dbc8e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9283330a-bcf7-4ae1-89e8-80d0d0dbc8e2.tmp
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

219ef19b-9070-47fa-8a21-f3679b52fdfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\219ef19b-9070-47fa-8a21-f3679b52fdfa.tmp
Size 11KB
SHA256 79b37970a3dee77a7b20aea3d613496b5cbd7a7e066592edca6e7b24caebae42
MD5 2eb7f09bc7580c7d04663bbffd21b39e
SHA1 c625173f2fd252399591277332ccb38989c04ea4
SHA512 9c889ac2720f6394f80742ccd20910d49aabb741669fa043f9d7d3d66f420755ccca7a59b0705ecd431542d1bb3e2190dc67f22a00e55a17d84899b1a8c498a2
SSDEEP 192:sxZgRKn9/fZs1wKIdpQvqlxhHW6+WN+MQAP/YYBdNlIg5VJ:sxZga9/fZs1wD5Hb7/fxt
TLSH
T1DF32C8526E34697B8CCAD219FA55BB13E2F9503251D10E48E6FC991C08EB7DE120794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a8c2c27-d48b-4ad0-af01-74b6f0292ff5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a8c2c27-d48b-4ad0-af01-74b6f0292ff5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4da4abb0-5f9b-4cc7-b63c-738062b427c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4da4abb0-5f9b-4cc7-b63c-738062b427c5.tmp
Size 11KB
SHA256 0be7a3c76d9cbc36aa085f8ffafddd2bc3c59518f0cf1ab6ab81d49cf033e76c
MD5 508ce3b52d1c8d01da76b40240a1ff7a
SHA1 1366e16171cb51538f995dd83ec8affe2e725f1a
SHA512 b7320e9919656880d76a8cd66ee3b7c093809f8feab4c81331c99716ea4f215182708c816e421c27dda0878d02f565214ec634725987e2a5b93b8fb05c5115a4
SSDEEP 192:sxZgRKn9/fZs17KIdpQvqlxhHW6+WN+MQAP/YYBqNlIg5/J:sxZga9/fZs17D5Hb7/f4j
TLSH
T18132B8526A34697B8CCAD209BA55BF53E2F9903251D10E48A7FC9A1C08EB7DE130794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

572380ef-0fee-4952-9edc-1903b4a9aecd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\572380ef-0fee-4952-9edc-1903b4a9aecd.tmp
Size 11KB
SHA256 31e495271b96c3c8e8aeacaa66f29776ce1a28644606e76fd8b946af99d8221a
MD5 4ec151345872b12e9f934c0ad9799774
SHA1 70c07730ad49f3d3fabd3d4fe9b50fb71f555bd5
SHA512 b762f39136799716ce393db4c0304fc2020345e7a7c3c497206c934052094d517abe40498ac68e8e2bc1bd5cea8f32e2bc91947b1e73866c5203abb19ac9e9cf
SSDEEP 192:sxZgRKn9/fZs17KIdpCvqlxhHW6+WN+MQAP/YYBcNlIg5/J:sxZga9/fZs17DTHb7/f2j
TLSH
T17732B8526934697B8CCBD219FA55BF53E2F9903251D10E48ABFC991C08EB7DE120394B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66415d9c-4041-4485-831c-0603b0dfc10e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66415d9c-4041-4485-831c-0603b0dfc10e.tmp
Size 10KB
SHA256 b8e95f121eb08d1f01c63bde0677bfed542b77dfb8e028c1eb02e4e87d6eb3aa
MD5 6379948952bc595565ad12f71183be62
SHA1 bf0bbf15a1763fc19717349b685b156749f6377d
SHA512 788b24780c0890f73ae356dffa44f238c899e13b7f48ee6e0b8a1d68dec3c435471b79ef19a5172bf3ddb914ac802b62d5b90db7165a137e7dca327ec3b00503
SSDEEP 192:sxZgRKn9/fZs0KIdpQvqlxhHW6+WN+MQAP/YYB0NlIgrJ:sxZga9/fZs0D5Hb7/fu9
TLSH
T10232C7526E34697B8CCBD209FA55BF13D2F9503291D11E48EAFC991C08EB6DE230794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d7fe555-4aed-40e0-bd8c-796b13465c35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d7fe555-4aed-40e0-bd8c-796b13465c35.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 cd0d03348e8831f0d8c946599a470083af0a3e237b95d2fc0760ca0dc1a876fa
MD5 b68407789b10f44516b188a5d44747ab
SHA1 75505506cfb94c30e748a34519063adadf0111ca
SHA512 0e774a6d861d7ab2335a0929da441b28b655be119eb88a5570546500875047335c0b3af568702f317121699162fd917725c94440f81475d73ae2953eb65f1391
TLSH
T11CE020E575C5C62DD10E64C703BCB31D87C1361B92C0AD1D5734C568B447440A6D1BE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 29291f44a21db1e01b605ae783ea157f6110941180e4959312f775f8398dcb7a
MD5 bc6c880b695c40b55c3048402b381658
SHA1 3eb50ee259807a1b0d23563dc95cefd6c0fcdadb
SHA512 1e5ed452a390fe543f628f72d83e85ae32e43312dead576c76ee46f6f0ff89f9d8c1c62fa76a5dac49cc179101cddb192e4957bb52c10cd7c8539f97a16ff29b
TLSH
T101E026E534CAC32EA748644B027C972C83C1361B96C07E1E1755C9847407280F2D2BE4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e23ee411d1de556ff9c3b1f2540bcb30373e9e18359d911ac5094114547ec954
MD5 a665311f4a4e1374a427801078a3d3b0
SHA1 4c6f5ea783447078091fc391866c42b0a5d27cb2
SHA512 4f661c0bb46e2c0580e652793c246db7dd724d9a1dcfcdf1fefdca81e157a3bced376748b4e81660b80145113f42160cf64aff1fb016a90a0f462674a0ed9b7a
TLSH
T1275160C646916895F3A410F6C1EF238335BC86A21A473E431398C8FC68D7B0F918C29F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0b4377d5faeeff547cde8ee25e97ac3aadf5302fec0c2706a0a1e8bf5841622
MD5 554b2ebb7c81c6f01db34bbfd30939ba
SHA1 5c7141f0fe9d53c0c5a7bfac67d7412ab82debea
SHA512 82a91bdbaa877a6c79d1f98217a30c0f8e5ca1e8ac5b39ef1af19e7a0bf70a0b7d285b35c91c55167d3c96fd1b5c5b54b2443f9910706ac770c64e7127c2e2a9
TLSH
T1C6510CC65691A895F3A810F2D1EF138736BD85A25A877E431398C8FD48C7B1F819C25F
MD5 SHA1 SHA512 TLSH

Submit Download

bdc5db08-9431-4fc8-aac6-119a01accdb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bdc5db08-9431-4fc8-aac6-119a01accdb6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

07d58e05-38d6-4963-9b34-5d744a485571.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\07d58e05-38d6-4963-9b34-5d744a485571.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

4d4c4302-36ee-436b-bc34-c5973c27c88a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4d4c4302-36ee-436b-bc34-c5973c27c88a.tmp
Size 6KB
SHA256 ce48b47b739c92c286e83f821491f85c623e8cf36ff75ae6fc7e17fe1971d862
MD5 fc8cc987d3ef3733aae823d73d60aefd
SHA1 ae2705a15bd2f46b77fa6ce57afbe359351fecf4
SHA512 ebaefe45658267fbe9a6e98516d00c78d6923e420d1458236e81e7faadaf6a9cba7c6ecfe76be7467d64d9b5cd40fa025d2de963443065b9f9b516a106b03ec9
SSDEEP 192:DW+JoHJKPJTIAUJlJ31jIbre9fnqLzNKIGnS0z73Pi2qcPigPi1KGj4v:DW+JopKxTIAUJlJ31jIbre9fqLzNKIGn
TLSH
T16BD17CF743B1862DE92192F09A24EE1BCE9D1518431C7D75C9E4FE57A3E2072E241B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd1f028d-5df4-410d-a263-77ff2a9e43b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd1f028d-5df4-410d-a263-77ff2a9e43b3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1936878-1fc1-4edc-8fe1-7ddbf48abebf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1936878-1fc1-4edc-8fe1-7ddbf48abebf.tmp
Size 7KB
SHA256 5b28007c5832eb85c02636c1709c2333ea080975a0deedff80166bf452a57f14
MD5 21034d23aca1722ae29fc973f3f74eba
SHA1 2ed77577348507bf118eb176b0f3af4adb16225d
SHA512 fb35da2428e2bbac43b53d0ab670bcf04cd52c9c38684f03017b873d276d878223e896e7bb8560be2c2f75525bfd58be49bc0eb341f454447c04a724de6c319e
SSDEEP 192:DTQLK8JM5JFadqJOP1jIbre1In0nzNKIG/Gdhm73PR2OcPIgP/1T:DTQLKYMnFadqJOP1jIbre1I0nzNKIG/c
TLSH
T1F8F19DF783E5862DEC1152F45A24BE1BCE5D191843183D2AC9E5EF4BA3D2472E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ae3ac9a3-be55-4927-85b9-d5c2d75de63a\index-dir\temp-index
Size 360B
SHA256 b81a5ee6c1c7d1bfb806d8fa999cf26d7cff7bab4ac1a21be3ce475cd7c92d98
MD5 d4f6f8d902fe28fe1ba2ca99a08ee88e
SHA1 0378b314f48161b8b27e1cbfb6b61236a271101a
SHA512 299c39a8404265abedcc20b8bc7f5980b712bf0ff95c10165d104253cb2b1fb0fa62fe9ce2c1aab3e4cc9654982801a43176502ce1a0aa29730d4daa89e38c32
TLSH
T110E02B482E13518AFC6444B5743FA465A73024DC93141A0F70FDA06A8C0A788BF02F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ae3ac9a3-be55-4927-85b9-d5c2d75de63a\index-dir\the-real-index
Size 360B
SHA256 12de3cf0f6de8838d1ef8a4d2193edc7c8095ea95dad54702a3674a638c80c2a
MD5 7342bfc507ee38bcc89e38b1ef052793
SHA1 700d2311e87a96dd316344b9b90a0db2afb717cc
SHA512 d0091ebeaec276db55d39cb84fb61dea8bcf954e7fd3bdca369e853f86bef89ed849a0eab6140168846c05cb6bcd878b500648448585589c112b02d27cf6c423
TLSH
T1EDE095594B13D145F8280071787E6175A271141CD320170FA2EF8057CC47B485E07F14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 f5ac8e64f0976021be4d21b278704219090e568f704b844039bc12e9162c8849
MD5 0f1302c52c6ea2ae4339475248d7bc03
SHA1 2bd893e2d7a4326957a9b6b749bff3c30d372d66
SHA512 ed2018932fdc084a30d119ea848a28dcba8420941e3dd6a49f06d0e0b6b1efbeacc5c88613652874463caccb29df22f3880c404ad807cf02d25515c84249db0c
TLSH
T1D1E0C0FA1DE31410EE7BD7DA2031949140053904CA88BC4F4049738720B2369341ECF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 da4761b046c486b6c1451b9858b66d1ea6e12c1d1ceffa91cdc8bdcd6a459851
MD5 da1776ee88d282e1d758d17df8316bb5
SHA1 d9eefcdea3344c18e7bb6e28c827234e7e4d6502
SHA512 47d18f703b86edb9a7f151f31b9f9a72b40d0b27c3f7bb07146976f0c019196e466a322bbbb6f8cbf45a733bb407c1b9000f1fa0052bead59bf41f41450ebd35
SSDEEP 48:KgFk51Hznob7+7ISNoK9t1foxt4Yuf1lyLuJkomscVbgnoISAVK9k12VxOFYfgcN:KY+4K/K6ud2K2U6uTyK4o1
TLSH
T1D191AF133567030079BE258890B497AA454235F37018EE2EBFBD09E58D6EE185FFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be58be4d-6398-44fe-af6f-51646e602d9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be58be4d-6398-44fe-af6f-51646e602d9e.tmp
Size 25KB
SHA256 3b5f792a6083c56278c432a5217bd5bccbaeeaa10818a07f22c5f700a789c0e5
MD5 0c27983681a1f9a750a5809e7e54ec16
SHA1 5ff7edf55d25fa06d7790d6e4bc77b44e266d524
SHA512 1dc5836789de49d5c4533398cee663af698347e4de8613805f91363cabe057fccc5856ac89dde67c35fdbec9ab57ef8814994706e7d528cec4d8d8902a9f4d29
SSDEEP 384:sxZga9/fZs1B66s8qMpRiYnazAW8pZS15posJWeT+yDTHb7/fDj:s4a9/f2B4Mnc7WeT+y/HbDfH
TLSH
T173C209059924D87B8EC39D18643D7E33EAEC506212C5CEDE5AECCA1C019E1FDAB47897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed358ddc-563c-4d4e-bd7c-db5872014721.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed358ddc-563c-4d4e-bd7c-db5872014721.tmp
Size 27KB
SHA256 0cf44f3740f513a6e91f79e6c7ca8f5de9d62f0557a457e02768116bd485cd9d
MD5 48db25e5447507bb46ae8fdcf5fb0c1e
SHA1 466514aa9301ce0988bd92a7044731bb75d0e9f6
SHA512 95d9badf593f65312d58078ae97d1fd65410f009b3faf7b26faa11ef188b62680f607703d030066f6abdaa18daba5686c8229bdc33908e8e02257aa9222ad626
SSDEEP 768:GnyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXxropsZ8:GnyYR7jWv3NpBu1ja/CL8OXK5
TLSH
T1A7C2F93B640DCB7E4FC01E9DDC5A6F9B3E9802C7A6548D4047FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1401b7da-abcf-48e9-afde-3a535498499b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1401b7da-abcf-48e9-afde-3a535498499b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a23d68d7-51d9-4b15-a0be-d3243d45790d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a23d68d7-51d9-4b15-a0be-d3243d45790d.tmp
Size 18KB
SHA256 ea8a6adc636cd46f09cf609e1c8f17408cd0f19efc2f49c53b14c039ae5d3227
MD5 7301d5af2f91581c4e843945e489a840
SHA1 40466ba47b203795c042d5cb695b806ee0b04c02
SHA512 fe0765071e98e37f71509f48201ecff20391f8bcfd575f8f9ae5ffdf562abc8455beafa374c3de45cd89a071214a09160ca8ba1eecac063fd1c60bcc986f2701
SSDEEP 384:/ZcIbsNCNl1ewiUL9dnZ2QX5+Dt68xXu3QTtgOIwZOyeoIos:Xb11zxZ9kDHwQTXs6IX
TLSH
T14D828E319CB89D7B19FBE185F18736039FB4902796C86FC0D5ED6B2D01DA6A9130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaefb8bb-04f8-4a9a-a762-91aea2a06e68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eaefb8bb-04f8-4a9a-a762-91aea2a06e68.tmp
Size 18KB
SHA256 28e5ea8c1c58ec920b1c9f5fa9622651f90a6f74ab7f88a34578530eac15f2d3
MD5 6fbe29802d2e09036e6eedc7e5b3aed6
SHA1 c28d97ff0837831a04dce15e1b104639ae2e21b0
SHA512 7752a5101659a627b365d36ddb23bf6927aef754862bfe6fde851d0840943766b9f989c312752ecac4ddb1b6496a6a1583b258013abc92da9e413ec3373033ee
SSDEEP 384:DZcIbsNCAl1ewiUL9dnZ2QX5+Dt68xXu3QTtgOIwZOyeoIos:bbO1zxZ9kDHwQTXs6IX
TLSH
T1C8827D319CB89D7B19FBE185F18736039FB4902796C86FC0D5ED6B2D01DA6A9030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16b881d5-565b-4c87-9bf3-3f8a5dc27cbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\16b881d5-565b-4c87-9bf3-3f8a5dc27cbd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f40fa621-f32d-4f80-b607-82937d239806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f40fa621-f32d-4f80-b607-82937d239806.tmp
Size 26KB
SHA256 60be48080b4a5e9e8e038271917b86f3cd3753102af596f290eec413c0471e01
MD5 c46870b59d15f4328e4d1f17b73caa09
SHA1 8a69ecd2ff99769737ddaf9b1ca7246898ae586e
SHA512 7ea0facc908e2dcd88d60815813c7e57541d0f97505d359114f1d3975346e648272adb32da0cd7e766c6d280267a0c2cc55644b45e95dc8caafe2fa6e096c489
SSDEEP 384:ZiFHZcIY1sNa8TUNTUlIlNl1ewiUL9d1Z2QX5+Dt68xXu7QTtgOIwZOyeoIos:wFvybwgB1zTZ9kDHyQTXs6IX
TLSH
T1A7C22AF248E7897AD9AE9747B37D2E039EBCC063B5849A80B798591CCC561BFC306C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c826f09f8d599085cbd337ad79d5e138aac68b636b6f2ae6b2d6194084284baf
MD5 5fec5b6e154caf825114557554f4a56c
SHA1 4c553d8290f3efb012603b163b391727d433d6f1
SHA512 0adfd9d021b79937b8214e72d03a0b8874eb3761eee181274c1f4d7bfeaf058b9f84b8c6283a27d0a4114dfb9a3d1ae29490a20d820313eceee90d5a569e8b46
TLSH
T1C441185CB6EE1148F3B7AF1A9BF2A86E543FB9372F06905E10110E4F0A26B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

e9907ace-34b9-45d9-8280-b2e63167c58d.tmp

Path C:\Users\Admin\Downloads\e9907ace-34b9-45d9-8280-b2e63167c58d.tmp
Size 15KB
SHA256 416c29c5e57418e8211cf104b1c7b440c1d0271565f05a8265f8a446b788f463
MD5 40c8d32b04a716140df5c7d42258565f
SHA1 5742e826a3e8acf884aa85f3ba05bfa0caa289f3
SHA512 7e76dbb713abdb9cec976aafce4f9ba4c026c83fe65ca19d9f4b569170f7c3915843743d5b72f56f826854f454197d843dc2670d95d64e17a366a4e065e820e0
SSDEEP 384:89iY6zWIADFxkVz2ZRdAs87cghKOtgMS4YOeuY+7I:89ilzWIAxxkVz2LDGcgptgdi97I
TLSH
T16B62E199EA110BC64BAEC6439BC0D40936E8165F421EE5167C254EEB80C17C728DEFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 cd815f9c63ecf7258b6e9b836aee4dcbd9e5089daaf0647162f9d6b9c854984a
MD5 b3f2c2b5cdbabdb64138329f9099282b
SHA1 1493199d87320e976f46d97178ac2aa2c3beabab
SHA512 fd37f84e666f2dc16c469bde0f1f0b721f1958e4d815b80ccf05f90689945d70882254544277a354c23ef2329768fd90dbb05b78a799514485705447fdcfe89e
TLSH
T1B121BB260689916D26B341E5091CB82FA31FD0EF0E2B8D8D3E8E450F7BA2A1C5366646
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5980-269-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5980-240-0x0000000000400000-0x00000000005D3000-memory.dmp

Download