hxxps://paste-co[.]de/?category=Roblox+%2F+External

Analysis

user interaction
yes
max time kernel
270s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://paste-co.de/?category=Roblox+%2F+External
Sample261006-rbttrahv7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\㝯ꌐ✀耀X	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{53D1866F-F99A-4808-8AC5-825DA50CBC1F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.md	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\㝯ꌐ✀耀X\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\md_auto_file\shell\open	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5152	OpenWith.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe
5152	OpenWith.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 920	3636	msedge.exe	87
PID 3636 wrote to memory of 3016	3636	msedge.exe	88
PID 3636 wrote to memory of 1376	3636	msedge.exe	89
PID 3636 wrote to memory of 1376	3636	msedge.exe	89
PID 3636 wrote to memory of 1376	3636	msedge.exe	89
PID 3636 wrote to memory of 4712	3636	msedge.exe	91
PID 3636 wrote to memory of 4712	3636	msedge.exe	91
PID 3636 wrote to memory of 4868	3636	msedge.exe	92
PID 3636 wrote to memory of 4868	3636	msedge.exe	92
PID 3636 wrote to memory of 4180	3636	msedge.exe	93
PID 3636 wrote to memory of 4868	3636	msedge.exe	92
PID 3636 wrote to memory of 4180	3636	msedge.exe	93
PID 3636 wrote to memory of 4180	3636	msedge.exe	93
PID 3636 wrote to memory of 180	3636	msedge.exe	94
PID 3636 wrote to memory of 224	3636	msedge.exe	95
PID 3636 wrote to memory of 180	3636	msedge.exe	94
PID 3636 wrote to memory of 180	3636	msedge.exe	94
PID 3636 wrote to memory of 224	3636	msedge.exe	95
PID 3636 wrote to memory of 224	3636	msedge.exe	95
PID 3636 wrote to memory of 4352	3636	msedge.exe	96
PID 3636 wrote to memory of 4352	3636	msedge.exe	96
PID 3636 wrote to memory of 4484	3636	msedge.exe	99
PID 3636 wrote to memory of 4484	3636	msedge.exe	99
PID 3636 wrote to memory of 4484	3636	msedge.exe	99
PID 3636 wrote to memory of 3012	3636	msedge.exe	101
PID 3636 wrote to memory of 3012	3636	msedge.exe	101
PID 3636 wrote to memory of 3012	3636	msedge.exe	101
PID 3636 wrote to memory of 1912	3636	msedge.exe	102
PID 3636 wrote to memory of 1912	3636	msedge.exe	102
PID 3636 wrote to memory of 1912	3636	msedge.exe	102
PID 3636 wrote to memory of 4968	3636	msedge.exe	103
PID 3636 wrote to memory of 4400	3636	msedge.exe	104
PID 3636 wrote to memory of 4968	3636	msedge.exe	103
PID 3636 wrote to memory of 4400	3636	msedge.exe	104
PID 3636 wrote to memory of 2312	3636	msedge.exe	106
PID 3636 wrote to memory of 1140	3636	msedge.exe	114
PID 3636 wrote to memory of 1140	3636	msedge.exe	114
PID 3636 wrote to memory of 1140	3636	msedge.exe	114
PID 3636 wrote to memory of 5728	3636	msedge.exe	118
PID 3636 wrote to memory of 5736	3636	msedge.exe	119
PID 3636 wrote to memory of 5744	3636	msedge.exe	120
PID 3636 wrote to memory of 4412	3636	msedge.exe	128
PID 3636 wrote to memory of 4412	3636	msedge.exe	128
PID 3636 wrote to memory of 5804	3636	msedge.exe	129
PID 3636 wrote to memory of 5804	3636	msedge.exe	129
PID 3636 wrote to memory of 5872	3636	msedge.exe	130
PID 3636 wrote to memory of 5872	3636	msedge.exe	130
PID 3636 wrote to memory of 5872	3636	msedge.exe	130
PID 3636 wrote to memory of 6080	3636	msedge.exe	132
PID 3636 wrote to memory of 6080	3636	msedge.exe	132
PID 3636 wrote to memory of 6080	3636	msedge.exe	132
PID 3636 wrote to memory of 2568	3636	msedge.exe	133
PID 3636 wrote to memory of 1204	3636	msedge.exe	134
PID 3636 wrote to memory of 1204	3636	msedge.exe	134
PID 3636 wrote to memory of 1204	3636	msedge.exe	134
PID 5152 wrote to memory of 6084	5152	OpenWith.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://paste-co.de/?category=Roblox+%2F+External
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff865edc188,0x7ff865edc194,0x7ff865edc1a0
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11143683306097190034,2205592914630988574,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,12401689999432800825,6284540983297016020,262144 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,10632816891821790801,6263559952075792539,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,5027262339240451732,17298849120698687658,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,6677998502329470413,6996384517441092090,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12833703494928247852,1461598557590515750,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4465078669937650850,11568619415378344948,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,3872533525278895971,13685147513436261839,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5216,i,3687760218628043130,10571939421982686048,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5432,i,271561899183620148,2790252910252425703,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5496,i,5736650342239742542,13574596719421425877,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,7949504134077708782,13893266504388530693,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1570480880546763574,1043292743560160807,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,4559684987168696906,18211258968137170904,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,4559684987168696906,18211258968137170904,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6744,i,10161138015744355092,12188905010332060518,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,8565931049947113693,13396905756000373367,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,15451049506504567786,9475930542164915365,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,17598809177231522658,9252045071218722813,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,11717632114985805326,1375361201514058827,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,16793375454765647496,15698769929673592068,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5848,i,10919531589555485606,8818481185269613261,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5800,i,9763181133362445918,13141100556627264902,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,351809204301847289,6961588457893863685,524288 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5884,i,8895280656964740809,2821203317924856537,2097152 --field-trial-handle=2272,i,5459277951215379845,887112788466462976,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_vesta-1.1.9.zip\vesta-1.1.9\README.md
  2⤵
  PID:6084

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_vesta-1.1.9.zip\vesta-1.1.9\THIRD_PARTY_NOTICES.md
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

19f989f2-eb53-41ae-a329-e5e6cbb8e265.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19f989f2-eb53-41ae-a329-e5e6cbb8e265.tmp
Size 26KB
SHA256 38a549021c30174775827c3df37bfe899d313e6dcbb057d226354ffdfbc409ee
MD5 52e51e7c8ec2c06a33e59d83d58e58e1
SHA1 bfb3698fac74539ebfa36fcdf02f3c34fe714fbf
SHA512 3bc57307ccd50545bc215e1085d85392865bbb5f975a5700f6b3392676a3244a8df6e56852e9d4e7d61f891b5610be2fbc8c65007272609da72ac5d66f89eb09
SSDEEP 384:6iFiZcIczsNz8TUNTUlIl1fE9bGnFrBh//GJYQVZh6DKhH61o7:xFQguwgTs4v/7QfYGH61A
TLSH
T178C22AF298D79876E9AE9743E73E2E034EBCC063B6855940B3C95A0CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4379cec8-4ee0-4f52-bb9e-3e48be7c0b64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4379cec8-4ee0-4f52-bb9e-3e48be7c0b64.tmp
Size 18KB
SHA256 2aa9d3752a6646077222eb5642bce2cb9550ef1ce61d60426796f5719eb04841
MD5 5a04009397f4e750231d3b9cc63a4ae4
SHA1 5585b79335672a262a4e97a09d0d30d8b2f1d232
SHA512 756036ec6b408d90c225828a72b533b62c60ee979ef53b2ec3393e8556fdc831b569ff11adc99b5a5735369a0f89327caefd95b9910726f64f9677aba95d527d
SSDEEP 384:0ZcIhsNh1fE9bGnFFBh//GJcQVZh6DKhH61o7:yh+smv/NQfYGH61A
TLSH
T164829D72EC78ACB66DB6F181F5473B034EB880A3D7C95F84D1DDAB1D01DA1A82307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5702a0bd-710c-41e8-af2e-e279d40aa7fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5702a0bd-710c-41e8-af2e-e279d40aa7fc.tmp
Size 18KB
SHA256 d9c8a9e07375b78ac075eb091deb5d9b7c48d309b7f2cf046d0dacd3c3efae38
MD5 2558b2034608d8fb5158a7de17706cd6
SHA1 e054db16981a3f990893796104c29b11c1d42564
SHA512 14c127def45c7cf2a047e3ba3cd9c84fcda91d55272a92fe8e1323454c652b958d034c9c50f4262fe8d88791e20f4d1c89553a9089930f9b1f4bb275ca0a04b0
SSDEEP 384:eZcIhsNhEfE9bGnFFBh//GJcQVZh6DKhH61o7:ch1smv/NQfYGH61A
TLSH
T15E828D32EC78ACB66DB6F181F5473B034EB881A3D7C95F84D5DEAB1D01DA1A81307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59e5b6ec-8986-4253-9c00-c58467d4799a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59e5b6ec-8986-4253-9c00-c58467d4799a.tmp
Size 30KB
SHA256 b57a196442ed2e7eb78b6cb7cdc589e4ae821b85ff49f3f608779ac80251322b
MD5 4edd7dc01b23da39cc578e6337c1ed61
SHA1 176f2aa1872270cb265425cff563ec5124a5fcd8
SHA512 f47cb07bd268c9c5e6521b2965dff118c75eed57ebba4301fd9de0c291b9605fd06d41819ffa7f03df1718c166225b8e9c5c214a9f667329e172e28675670c82
SSDEEP 384:6iFhZcIctsNT8TUNTUlIl1fE9bGv1oK2h//GJXPIvUASBZWZOMMKwIr+BVZh6DKV:xFpeqwgTsNKG/+qTS/xKwIr+BfYGH61A
TLSH
T13BE26DE284D79CB6D46D97C3A73DAD0259BCC073B1895948B3E8692CEC8B0BFC312951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74119838-d222-41cd-9233-8365148b0cea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74119838-d222-41cd-9233-8365148b0cea.tmp
Size 8KB
SHA256 5acd0a821daf3c5206c3ed7e9b98e52695c685d8844663682e69b99b4e4b6a8d
MD5 7c0631ffe475b985dcd5d7e60472c620
SHA1 84337b1d293f4f0866537cfd4e5d137360f58973
SHA512 799b0b4908f9dca1683e5c1d46f40a3b6c8c5f9471f1339bf4a676500318570d9e33f28a02ccd6472c86f8f90405494b8f176041576e8c587b8900f68c34006d
SSDEEP 192:BONE6JU+QmiUyxOwzo//GBm8gNxgbqyU6:BONE6+6SFzo//GJKQU6
TLSH
T16F121A35B8A8AC7B5EA3A981F08736135EA44227EBC96F94D6DD2E1C01DF19C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7813c5e0-9000-4844-aff1-6b2709d489c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7813c5e0-9000-4844-aff1-6b2709d489c0.tmp
Size 392B
SHA256 35bb300ba08c2e103fc25d67c83b2d8412e1300803c1479e721c1d954340daf5
MD5 96f3fad15a1ddc408d9ac49f21ef8f8c
SHA1 c14c853e0a6be1c940af471baeb7347cb0e6ffda
SHA512 4512cc869cdd19004cd1800ab88b3d75f2dd9df844945b331c9673b364b92ae2c8a3688a884347522a4e0964bbd36f6a9b20f6302a891b974a64b6b330925fd2
MD5 SHA1 SHA512

Submit Download

8de82436-bdab-4563-addc-ae114155f557.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8de82436-bdab-4563-addc-ae114155f557.tmp
Size 8KB
SHA256 4e4744faaee6d96a8079e5950d66a0141263a6e801d5083c479a77208910546b
MD5 5f46bede1757e9bb0fd9320f5b32525e
SHA1 11e9ebee14ebed294e357ebccbb9e574a1a40f22
SHA512 e9bdd18f2b9ea1dab3acb19aa564f362a02fcb0d175e190510fa31c3ff0cdb421a0312dbb1f1a53f305d9674915968a9563d3dccf205f12dfc76e32850b2c87d
SSDEEP 96:KqONk5QsjpfbUmjH5ih/cIPURHl8h4otop5faDcBKP4v+Y1xf//ojdhxZBmqBCgX:BONd6JUm0QmiUy0wso//GBmqBCgUkU6
TLSH
T11A02D838BC687CBB9EB3AE45B0877B239FA41067E6952F84DAD91E1D01D719C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

5670d087-9eae-4872-a54d-3343b257d90d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5670d087-9eae-4872-a54d-3343b257d90d.tmp
Size 10KB
SHA256 0eb81425f3aaccd7392bf207811d51e8919b909caad1ac26a1d9311ebbe955f2
MD5 7e0c132fa23ea344ead973ed31d5b987
SHA1 bf3a2440a7e720c7bee750aeee24f1da1dc3e5d2
SHA512 be8b5dfeedb3e3e8de64b0683bcca80f183f0af21e47b5f228f9f5335bc19d4c833a38f08ffb9385d4cd76c01c071b2fd2c38503b53dbe7fb351b031598b5500
SSDEEP 192:sxZzRTnj/fK4svLIdpgj+HW6+WNNBmFY36aXqUIg5bJ:sxZz5j/fBsvUDHbiFXaRX
TLSH
T13A32B6526D38697B9CC7E20DBA19BF13E6F9503265D11E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dc1a650-e337-4bb9-9d3f-8257a8192226.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7dc1a650-e337-4bb9-9d3f-8257a8192226.tmp
Size 10KB
SHA256 395119505c24c4b39373aae22c0940a6971a10ddde9c45adead628f08c2407bc
MD5 3a2b9be5c60d05c4122175d055de9ed7
SHA1 bdd20b64db2bf65bb20d53c0a2f1e06e09bea91d
SHA512 f77268c3c1cf567a65a3709bae0f995968707b50cec323bac9474eca6aabdf75763eb56d4d6bd4a8142e6b09e85fdb4b13486186a703dfc390938e40dd790380
SSDEEP 192:sxZzRTnj/fK4scLIdpqj+HW6+WNNoQ/Y36AqUIgrJ:sxZz5j/fBscURHbF/X49
TLSH
T1A122C9526D38A97B4CC7E209BA19BF13D6FA503265D51E48EAFC861C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 655e68ea4eace0310e05c59de28aa02e0bc8ba4501b2cf2c1d4d0bfe94c900a9
MD5 1a2fcb78a67575d47a4df57914f9ed68
SHA1 8a4c7650fd1aef25ef4a5f7d0519ac8eb099f35c
SHA512 0331d1cafdd0fadd08e74359ed8274e8a77644190b520113335031e522f5b78980d0225770b0ebe27c6a34532abcdaa2654942da078a67ebe9461d740dc5b9e6
TLSH
T13DE026E506CAC62FA21874870578730E83A03B9ED3C0691E2B00C9CCB546D40F7C26A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f2057a758ad9ce45dad4f5a1441e1b2bf3d832d8621cfc154e338a00e72fc428
MD5 0b9ca7b65ce825cc91158e1046348ec5
SHA1 a561a34e94cb8a944fb8c37645c706cdf3291e20
SHA512 83daed22c121dbc66ace1a442d436461a167e078d8b1dfc7759e64ef6ce81962f844fb43ff201c2e2853d9ac5ccb14cda7a9ebd5baa24c9aa2ccaddb1d103a6b
TLSH
T13B71D9A85FF1A894FBA447B8F0C2097333B060A0E6430F1F8152D57C2C073F9989632A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a5733c0fdced4bc95ea98021d4214ec34657e9f7d9b6e8a13be962d29b3541ea
MD5 42403870ff1ecfcd64744260cdb96f28
SHA1 9f046f8843caabe38b5aa5b9057969d6f2ff62fd
SHA512 5096ca5e30188550f310a6b6caee8670303768a37517f840c92b1a0dc2d3232d2b33d3c59573d19b688a481e50a397b6c52cce3761a87303fc4bb2c3d50ddb28
TLSH
T14371C9A89FA1A4D4F7A443B8F1C2097333B061A0E5431F1F8552D57C7C177F59896369
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7e1a70ebda37e9386e6a6b1e64ab81b43bc3372f39191c7f44e11a81bf2442e3
MD5 1f8fde1ef10432227c919c94d144acda
SHA1 2580dbbf08676979a3aa092c713e58518078401d
SHA512 1613cc6aba7eb4cbe7b0ce2e943d374bb1d06d390bf131b85606ac3c12b266090677c648b682dbf330311392e28da7700aebbc44689b5dd847ff0e97afb81913
TLSH
T16B71B8A49FA1A4D8F7A443B8F1C2097337B461A0E5530F1F8592D57C3C173F58896359
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 3fd32d8ddf1a2d82a73e6a0149c5f58aca6324aeb70c42122bf68e161787beba
MD5 25fa2cb04c0e9d2c7e7fe7752398c1bd
SHA1 90960e191f9ae44447d5edb8c63b0dd9a9343b70
SHA512 eeaee4fa36ec259a723cb375c950b44ceb9e05ec3b73b4d993a02629c4391ebc7a39e4907ef4a7dd1859e27795dcd06035e71ab33d743f0a232292c3e2b7eff5
SSDEEP 3:MsEllllkEthXllkl2zEpnd:/M/xT02zgd
TLSH
T1434404047FC10C45CD0050314013C3700770D5101511DF4375511C137DC77D30C00C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6904c31-69d0-481d-b014-a3afdf47bd43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c6904c31-69d0-481d-b014-a3afdf47bd43.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1cb6e7ca-19da-4514-a57b-d3f9930c0263.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1cb6e7ca-19da-4514-a57b-d3f9930c0263.tmp
Size 3KB
SHA256 77a266c872738c7c72ccca25d4292712ecd91b409333e7f6143727525012fb63
MD5 b1198e05b406f86fda8887fcbe890490
SHA1 2673d958c7c013460af6c52e98217612b4321dc3
SHA512 0ff7ecf140512cc24c2843ca0ebeb00074e762f89efdfe00004e98017700253006c68bbee251fd63e2b14a8c70a9c88103e375c54149a1de39eacb3dbe09c615
TLSH
T16461ABE2C3F5865DC81656F4AB146E2ACF2C0914562C3C798AD5EF9B63E1471E301E8F
MD5 SHA1 SHA512 TLSH

Submit Download

827f2cd3-26ac-4ec9-86fe-c27565c735d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\827f2cd3-26ac-4ec9-86fe-c27565c735d4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9dc7568c-4c5d-4278-ac64-3dce06472477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9dc7568c-4c5d-4278-ac64-3dce06472477.tmp
Size 3KB
SHA256 2b4a76876d370fd1b10346bdace7535c9335033f2869749c8a8c1265ab525130
MD5 859afb375fcaaff42e5d40c4d4dfb05f
SHA1 766f715dfa5b50cb68e9572b5a5595a63d4862ad
SHA512 d6af1c7878ff60e510900b1c75b0ac4a952164ae1caad00abd67e53dd59cbfa99a8c58a291de8f27995a0861e4e179142c98be665193f80f6cf86ad7b0be3bd3
TLSH
T1B061ACE2C3F5865DC81656F4AB146E2ACF6C0914562C3C798AD5EF8B63E14B1E301A8F
MD5 SHA1 SHA512 TLSH

Submit Download

b7f50da5-f4fc-4bed-8eb4-f6c7a916a13d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7f50da5-f4fc-4bed-8eb4-f6c7a916a13d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 9179fde6f911f3c95d149c1a0109a20ff2c817623978a376e07642ff56a05d82
MD5 c7aa54c986b3680591680e0d4f78bc4c
SHA1 08b32ed9c3816441667b72b5be6e73559841e5f9
SHA512 17c74d8637884c1b968fe2c5af22c54cd7ec9e313e84e53dda46c2df2a2d16f26650ed4bc86ef402760266bbdab3e2454ee72a06df64b55066806e04d92f0cb3
TLSH
T165A00211458DD031C425077054CB558733D048220275420249E191DCDDD7392E143305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 62ce3b3144731381f82271224fe4c0cf1aff1d91db9a255898185efec1972e06
MD5 268bfcf027664acf3368511adfc5a322
SHA1 f2de37ccc43a413a9893ddc43af4e86e4f7af08e
SHA512 8896d38b081fdb606a76edb8690e96c1bc5e8e5162e4931f0ae30b720a48fc70b585f9f16ec320b6e2128566891371003bfa82e2446562ccec7e3db2dd27b109
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ea08c387069874c80309e4a08e695e673517cee262defd02378e9688b3537b0
MD5 b8d77c99f87b3b67767fab1f37a63cb2
SHA1 48ca1f4973a129b15ac436e5cf24e4f8c1635d5d
SHA512 573ff3e917c12d644460b2254ca8856dd17424f27278a338e8d5331972b1a6edc1b4e46327572e1130e40eb900042f02567e7dff1217409531ec52ee87f9ff14
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyLQ/26gK+/b2NWISS/K9u10/xIvY1mq8:Kg1SK+Maun2KIQD12K+UKV
TLSH
T1AF917F10736B12143C7E296C40688A6B465271B73069FD2B7BBC50F24E6EE446DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ad65ef38-a405-4e1c-8d93-44fe9d01f59d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad65ef38-a405-4e1c-8d93-44fe9d01f59d.tmp
Size 11KB
SHA256 abd3e4eaaab0a9775c50633f5482e752279ab8f51cbd0f51deb0ef615c7e89b7
MD5 68b5a3666b26668b4d2bdd339aa0f5ba
SHA1 d0c1396fbc1faaaac2e463df9463b926815f4749
SHA512 26f298208082f23d31a48a07b26f02252345799a020e62680bcdb44e2c5f467a735c462506fa16c481758f66048bf5f8f4d90b50e6e61ee53aeda8a60052748d
SSDEEP 192:sxZzRTnj/fK4svdIdpgjTh0HW6+WNZixBmFY36aXqUIg5bJ:sxZz5j/fBsvecuHb0uFXaRX
TLSH
T18732C6526938697B9CC7E20DBA19BF13E6F9503255D11E48EAFC8A1C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad9c6ad7-c398-436b-961c-ca257a7a4a9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad9c6ad7-c398-436b-961c-ca257a7a4a9d.tmp
Size 10KB
SHA256 3c82e5a4e11750275455de7df007f6f24aff1239f0c727c39a256e1215ab5a03
MD5 95db95e583e5385a4c2b90549dc1f935
SHA1 fdc29ceb7d058a4b64dc1d34a7dbed4f31203b4e
SHA512 45a27ecd040af7648c003467c3746b859a785e0c57f96bdc1027baba2305d0f9cef8938722fd9029fdce1bebeb1ee54b5b792f16b65a765c0465eb649b603125
SSDEEP 192:sxZzRTnj/fK4s7LIdpqj+HW6+WNNoQ/Y36AqUIg5hJ:sxZz5j/fBs7URHbF/X4x
TLSH
T18B22C8526D38697B8CC7E209BA19BF13D6FA503265D51E48EAFC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afdaab4a-bd73-4d1a-ab1a-2a8ceca4df86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afdaab4a-bd73-4d1a-ab1a-2a8ceca4df86.tmp
Size 10KB
SHA256 fd65059370ddd539c4a5ebf5c676b1f6043cecfa48a658f007278dd4f97a6b92
MD5 9cb3edde1da7f85e1b134707b45f029d
SHA1 f096691c41b0bcc5aca8d1bdec8bba6f57ab7d74
SHA512 51b50fe2df97740c08f8937dcb8b49f63f45bca388e5527f53d417ebdeed490c074e9003dea779cbc788af14c7b51c1ad853557e693538e4fad587e3b4818557
SSDEEP 192:sxZzRTnj/fK4svLIdpqj+HW6+WNNrZZY36yqUIg5bJ:sxZz5j/fBsvURHb7ZXaX
TLSH
T12D22B7526D38697B9CCBE209BA19BF13E6FA503255D51E48EAFC861C05E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0701e11-ed36-4f35-8c0b-3abc3833d300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0701e11-ed36-4f35-8c0b-3abc3833d300.tmp
Size 12KB
SHA256 d5d37ec60b2ec9cd8bb100fb39518b08be077698985dc52104b536db0b987745
MD5 19a622c4a3699d1899f1797d53821d08
SHA1 a1563ac51ce88599326aaec040e8962efe6e3d11
SHA512 f9849bab7abe4564f0b433daa9ac12d54638ae63ab2c1943c3cb737c8acb2076a84025edca384d3b572483a2dc1ea55e29ef99b02d830eb818147a07e88f1681
SSDEEP 192:sxZzRonj/fK4ssWpV9OIdpgjTh0HW6+WNIjixBmFY36mJm6IgbbJ:sxZzoj/fBssWv9fcuHbhuF7m9R
TLSH
T12A42C8526934697B8CC7E21DBA19BF13D6F9103255D11E48AAFC8A1C05E77DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c693befa-b54a-4d46-8a64-899117534126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c693befa-b54a-4d46-8a64-899117534126.tmp
Size 27KB
SHA256 8782a998fd5e3ede60e69bcbc4ca8cbad6c4b64f49e228d5dde7d4b0c27a9a05
MD5 fc4df57dc81ace91f4348a81f0efe0d3
SHA1 2d17d837f421122590f0d162ef91491c3ad54227
SHA512 00b806c8f8bd75f55eb000f130ed626560cc78e4e04c9bf47421c46ebf29728e23b699fdab6704881517cc97b5d1ad268a0e1b078f77992fac74beb6f8d7e46a
SSDEEP 768:m4Klm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Nrof9:m4Klm7QWvUYm0u1ja8/L/E/mf9
TLSH
T11EC2FB3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e72592b1-5904-45c3-8de2-ab5b9d0eb973.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e72592b1-5904-45c3-8de2-ab5b9d0eb973.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ee6a4880-25f1-417f-af54-267d4bf6647e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee6a4880-25f1-417f-af54-267d4bf6647e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

419ab7b4-7a5c-4d67-b754-b7979886b471.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\419ab7b4-7a5c-4d67-b754-b7979886b471.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4f6507101fdaad48c6d4c13ac2d2d63e9f2d04aa99ac004cc6c11f470edd9400
MD5 a5436515277e4803d33e213f9a27d465
SHA1 80695229f56cd39c2f3acf2a42501dc81fd6b9f0
SHA512 f84269aeaa0a15692db1efa820773396e4bbd84888a1a4acd752d8e9056b722f6d5afa57627d7071b571b80294aebdbe8c70f6143d109dc90d023c732c9a5947
MD5 SHA1 SHA512

Submit Download

a92b5e96-ff89-4c27-b68a-4612765ae014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a92b5e96-ff89-4c27-b68a-4612765ae014.tmp
Size 392B
SHA256 da3a04d0db3902ef17f6bf615ed429b2685191f53d0f43e92572bb7290bcb981
MD5 eee4223ed42bd0448462a34d625b25c8
SHA1 4eb350ab76869f391fa17fd61aa23fb8f70013b3
SHA512 621aeef581d8421b494431e14749bf312d28c59633a5013b9538e3df8355a9c8bca1d3df924472a898d9f0840ea7c9c27f4ebfd6a50ecbbae0375913bbdd2eb6
MD5 SHA1 SHA512

Submit Download

d9d36ba6-45ff-4682-b28b-877274acba6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d9d36ba6-45ff-4682-b28b-877274acba6f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 300afcb05ffdada7460aa4c903f6d715be6733ec9fdc5ecfd3295d0c864fb949
MD5 7091c147a8cfd780911158c202594865
SHA1 db895f5a2cedc5afd0288d5a4bb7d05531486851
SHA512 c6d48997ef1f0cc591c9f68c67193262ca9acb0ca428bebb038d8b1a4124a781a3a947c3b1f6e008196fe07809f239ef2d824ae278a7acab311aa44b7e690c16
TLSH
T1A0412798A6E91148B7737E56ABF7A86E447FB8732E06D45D00110E4E4A36A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

52875cd6-b6d7-4f66-9c15-09d32d2b0e35.tmp

Path C:\Users\Admin\Downloads\52875cd6-b6d7-4f66-9c15-09d32d2b0e35.tmp
Size 256KB
SHA256 0123f75d7d73736fd40c21e360c82106620e8a6f8c8a2f79bd515835e3931714
MD5 e4e96f5db5766f9ff620a4ca270f5e5f
SHA1 c303ab561aac9b251eb312f7794c2b4e0dc1f46d
SHA512 9c0ab587b8b4b40cab80695c1127e4483c93bd4d1c12705e87169e91c3f9e2d758c53ab94604e762c03c45d4b59401474b9b244730c01442b3decefd601526f7
SSDEEP 6144:ippYTmuk2DX00EQrL29mcJuoBkCqMnXf98l0t8uMFPSO:i3E9X00EQ29Z1Bxh9juuUPSO
TLSH
T10A4423C2A106345EF13448FD3C67DD12732AB66A2103AFB01FDAAEDA259F1AFD115891
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads