hxxp://yourmom[.]com

Analysis

user interaction
yes
max time kernel
71s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://yourmom.com
Sample261027-29vttav13r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "30"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{106A45DB-2E76-4629-A28A-CED883CAFC14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	taskmgr.exe
Token: SeSystemProfilePrivilege	4804	taskmgr.exe
Token: SeCreateGlobalPrivilege	4804	taskmgr.exe
Token: 33	4804	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4804	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe
4804	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
776	LogonUI.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2580	3032	msedge.exe	83
PID 3032 wrote to memory of 4336	3032	msedge.exe	84
PID 3032 wrote to memory of 4764	3032	msedge.exe	85
PID 3032 wrote to memory of 4764	3032	msedge.exe	85
PID 3032 wrote to memory of 4764	3032	msedge.exe	85
PID 3032 wrote to memory of 4116	3032	msedge.exe	86
PID 3032 wrote to memory of 4116	3032	msedge.exe	86
PID 3032 wrote to memory of 1820	3032	msedge.exe	88
PID 3032 wrote to memory of 1820	3032	msedge.exe	88
PID 3032 wrote to memory of 1820	3032	msedge.exe	88
PID 3032 wrote to memory of 628	3032	msedge.exe	89
PID 3032 wrote to memory of 628	3032	msedge.exe	89
PID 3032 wrote to memory of 628	3032	msedge.exe	89
PID 3032 wrote to memory of 4672	3032	msedge.exe	90
PID 3032 wrote to memory of 4672	3032	msedge.exe	90
PID 3032 wrote to memory of 4672	3032	msedge.exe	90
PID 3032 wrote to memory of 4748	3032	msedge.exe	91
PID 3032 wrote to memory of 4748	3032	msedge.exe	91
PID 3032 wrote to memory of 4748	3032	msedge.exe	91
PID 3032 wrote to memory of 2736	3032	msedge.exe	94
PID 3032 wrote to memory of 2736	3032	msedge.exe	94
PID 3032 wrote to memory of 2736	3032	msedge.exe	94
PID 3032 wrote to memory of 4160	3032	msedge.exe	96
PID 3032 wrote to memory of 4160	3032	msedge.exe	96
PID 3032 wrote to memory of 1488	3032	msedge.exe	97
PID 3032 wrote to memory of 1488	3032	msedge.exe	97

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://yourmom.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd14bac188,0x7ffd14bac194,0x7ffd14bac1a0
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5229685518323506488,3156252719382286153,524288 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,7934474577146324718,17259002494599400228,262144 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,10132093075191875016,14585124118600676639,524288 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8901237507477004380,16111262648449065572,2097152 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5446517398400406753,343753626057965726,2097152 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16440112212087377254,11793601210897848521,2097152 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,18165928841519824934,3432964122326994751,2097152 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3664,i,6806494642404393745,680127182242530276,2097152 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,8818536026574575577,12709726270476621835,524288 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9048008121749608269,13637698062868302885,524288 --field-trial-handle=2268,i,3358762394891663030,1100711443108972869,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3951055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

183a976e-4108-45f7-964b-f4e80ba1e16e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\183a976e-4108-45f7-964b-f4e80ba1e16e.tmp
Size 8KB
SHA256 b5192fe52bcf9e0315c289dc1fb0e78df996c8d6e7157cf9389f5b4ad3afdcdf
MD5 168dc184972936e8e69d09f2930017fc
SHA1 59c73b4466cdc00e1525c234007f32c03363cc9c
SHA512 899eec7539f6edee76dbec01174da29665269572b93adc1700a90bf24e05ab56b754240310733422fa79bd5acebf5958934d4e39f145a707b24d2d294a9d4559
SSDEEP 192:9ONe6iD7QmiUy6bjq5u88PGquh63KuZrqsvKU6:9ONe6gVjq5u8iGls98U6
TLSH
T1F6120B356878BC7B6DD2E951F44736139EA4423BEB886F84D5DC272C02EF5981707913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2944f0c3-9f49-4653-a839-1001f7b3cff4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2944f0c3-9f49-4653-a839-1001f7b3cff4.tmp
Size 8KB
SHA256 6820623fc5aa2ed530803eb7b45134003044dfba6007684867bac84ab34e7a6e
MD5 bc941fddb8e83132cf0b310d7bf5d349
SHA1 007d6758342aa82ebbad15c19d67ee58eaf1caa4
SHA512 5dbef0fb4143ff34045a2d6e2f4e87ec5597f290e75fccc6918eff2dafceb8a566f82082fbf4910d83a70ee1eac08f274d13f42ff93ba8991f5633096bc27932
SSDEEP 192:SONs6iDCQmiUywbHq5u88PGquhMSqdVmU6:SONs6/xHq5u8iGlCyU6
TLSH
T1A202F8386C387CBB9DE3AE15B58777239FA4013BE6941F84DAE8162C01E769C1703923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e47b7b3-ab27-452a-a931-d2dd6b44f157.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e47b7b3-ab27-452a-a931-d2dd6b44f157.tmp
Size 12KB
SHA256 303600b3cef9572cec385a0781c75df660b2dd7d21e6e9c8ba86dea518ee6132
MD5 5717489dfe6df9d08847a3ed11d49ac6
SHA1 e48f03c0192f10195e5b4191659f79270628d6b2
SHA512 384b49df730dbe153c0e1a05e8de940475d58d2d8bc37e2bae14fa72921e76c3ec33948b59ed2725977fa9572cb1a06539fb9fbc87748043cd22eefe1c9b770b
SSDEEP 192:8AsNbyQA4IILXxDPlvQmiU1TyOZp5u88PGquh63iuArqsvKgOniW:xsNbyRi1bUkp5u8iGlsU8Fn5
TLSH
T1444228356C78AC3A9DE3A551F54B36139FB8816BEB882F84D5DD671C02EB2D80307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7982f278-1315-4773-9f57-b9c5a9fb232a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7982f278-1315-4773-9f57-b9c5a9fb232a.tmp
Size 16KB
SHA256 ac2326fe29d5ffd74178913a1ca6fe717ad7d7c15ce2bd058a036bc59e766d75
MD5 450e7e82b4f435e6800dd5f0ac6f0793
SHA1 c36049860108c1e0ed4d96c118fd361a9a1c2757
SHA512 4ee420504b8c0ffd8a678b06471b1dabbb3dc252c24d815396173882f7e01fe57dea68ba095f1a8127684cbd63f8c750dac01ac52f7240007c96a281f2d4f32b
SSDEEP 384:isNbyRi1bvRp5u8iGlsLEFAStt4do79aZFn5:iutkGlsvSr79aZv
TLSH
T1957219B4A8656CE789F2E9C1A54BF613AFA8413BD6881E4CC5F9B73C309F5F81312412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5d2e3a54f03904bbe55eebd2e15796e5b26d6e7120a6693c971408f22102794
MD5 4656163abf32e5ab1a0774c2d3ffd3c0
SHA1 7bb2730f110962fe6a55dcf63196da9d74635fdd
SHA512 2096bbc1475260d24baaa9e51217bd19dd5edfd500aa9c96f8c9ec0510a31f436be7ca6a34af3ec2478245bbace0f09d84f152f56ad9a37ae2441e8f22301bc7
TLSH
T1C9D08094D4B47AF8F035313D5136450177CCDF96F603235A91454956C8501C309F1DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

45b04189-7cc3-4bf6-b5f0-5e793a3582b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45b04189-7cc3-4bf6-b5f0-5e793a3582b0.tmp
Size 9KB
SHA256 9ff81857897d5a32f27e5909f4e0efb5d9e9f3ef9f69f6bc3a807a52381c9d58
MD5 790fc9f021eac69f5ec6b97bd20fab95
SHA1 1df0302dd079a5f07fe1599557ef69367e093eaf
SHA512 7e3028ce1d12072476c924445bf786b411da937622249fa1bf9e5b294b45c9280f05747a7e78327fdcd32a13a78112baad1a28600054929a18ee905b60fa5d66
SSDEEP 192:sxZPROW3/fEstszvSEdp6XHW6+WN5S5/YaLPvIg5pJ:sxZP33/fEstQvlwHba/Tt
TLSH
T1BB22A7566E38697B8CCBD21DBB267F53E6F91032A1D51E48E6FC861C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53cf97e6-6816-4e92-8e0f-1293a9dc6d8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53cf97e6-6816-4e92-8e0f-1293a9dc6d8d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

639cc33b-22b2-412d-ab19-e1e12894e90a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\639cc33b-22b2-412d-ab19-e1e12894e90a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

705593e3-5521-40a7-9c49-a7eebb557038.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\705593e3-5521-40a7-9c49-a7eebb557038.tmp
Size 10KB
SHA256 d5f7c8a38ed7293b60f45603fb56f5a2f98e6faa85efdd0320932ec00f26eac3
MD5 9f876ecf0ae6a0a2d3f4fc68318f932b
SHA1 28d7fa1ccb9c5dca2d254e2bfcf031dcd62149dd
SHA512 ab5f92b50eb768e729d67602724ce74a8436a6915f8b1c36b204a37bc8c2b8941e1a00f3c6218d79fe5587ca85d2bc8f8809aeb6c9b03b261606d77c766ebb42
SSDEEP 192:sxZPRxR3/fEs1WpVZz2aSEdp6XHW6+WNPFS5/YepVrRIgbpJ:sxZPx3/fEs1WvxLlwHbe/xTH
TLSH
T165329656AD28A97B8CC7D21DFA257F13D6F91032A1D51E48EAFC861C05E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b7282dfcf90931a0ae761930a72abace216c7e2e0ce031b408b9fa353fb83dfd
MD5 83c67503342ebfdc80f4d39a7c421e85
SHA1 b6e2a59a30bed2971fd72e094d799b6c2a9b1704
SHA512 5057280daa4b2f3b85c5c1f86a8eafa54998b9cc2735c4d98c74c042b3f4dc2c32a021afd0da972c65de3db762dc8c7709bdb67b5d796763772665436904ff16
TLSH
T13281B542A74343EDFB6B603281D918CF3D31366A005B2F29E5A8D63578CF344AB1986F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e56054bbd2e51d45746659ec7a6e18c3071ba5ac580f3d81bd38c5d471d7ea8
MD5 6318ed5fcfad38189ea1fd338f7d25a5
SHA1 8dd727b704868b90e24013730340c90fe92a0d86
SHA512 0eda7cd1717e2574aa286323dd28f67f8d0dd72c80ceac932467df4f37da4c54b257abb3e52ca9581a9b215faa58f21322301d44f9c894ff48120741960956ef
TLSH
T14A619282A74343ADFB6B603181D528CF3E31554A418B2F2AC5E4D635B8CF354AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

79d21176-ca83-4326-9bf9-a53e3faed661.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\79d21176-ca83-4326-9bf9-a53e3faed661.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4597dc27-6e74-4890-bfa9-c53484e60ecf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4597dc27-6e74-4890-bfa9-c53484e60ecf.tmp
Size 2KB
SHA256 ebca6bcca29657bbbd89cf3765effa8f3606ad32b526ca4c5f6df775211ff882
MD5 273b2e5e9b97afd1588f87cb8a9af2b0
SHA1 a53d86c921ea48f1eb85fab6684a3089c039156c
SHA512 1997f88e980d96b9241a236a25bb970fc2f2e5ae4377d21aea87b7021a03b3083c7448dc846f0e00a8b5b5d15e70de7be57de789f2efc5ea980162282e233b3e
TLSH
T15A417AF7C3D4862ED81116F0AB287E2BCE2E091442283D65D9E9EF5B93F2472D24154F
MD5 SHA1 SHA512 TLSH

Submit Download

d7665743-9910-4100-94f8-55acc1fe945e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7665743-9910-4100-94f8-55acc1fe945e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ead46521-0237-45d5-a3c0-926da0faf6c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ead46521-0237-45d5-a3c0-926da0faf6c8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c2a01f7c-d6f9-46db-ae78-32b9f16ade70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2a01f7c-d6f9-46db-ae78-32b9f16ade70.tmp
Size 27KB
SHA256 f9f94bdaddec67117d8a7a785d752a803b5f02487cee42e95a950de9b2902651
MD5 579b71a0133cec9380150ede77c97051
SHA1 247001f5994eca6ee3616ea441ae1b090769af46
SHA512 4f67e1c8fb697154c76f94a58c110769423d587141722b3808cb3293670413003c8ffd36be03ff41855ffe96b265875b36772bd9bd92c0edbd8165851dbdcf4f
SSDEEP 768:PQyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3qromZLa:PQyQRbrWvvlpZu1jaXKLf33BmZLa
TLSH
T1D3C2E92F640CCB7E4FC01E9DDC666F976EA802C7A6588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f11ba6df-07bc-41a7-a0e4-7033fd636bac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f11ba6df-07bc-41a7-a0e4-7033fd636bac.tmp
Size 9KB
SHA256 c513e0002af2b7f079ee543476ee9e4abd7da2d9382182c1b2e97efe22a61855
MD5 ff7559360813c79f9378ffc78a5193fb
SHA1 65a66caab492bdcd0a8cfcd083011bc0a54afe11
SHA512 e8147f96910bd4bae664551857e69a330e5e9b542dd37967e79f69abbd13ace09d64cda098098a8653ad2cc260401e13108a85ea6e38159d1f515614f2c0a54b
SSDEEP 192:sxZPROW3/fEsiszvSEdp6XHW6+WN5S5/YaLPvIgrJ:sxZP33/fEsiQvlwHba/T9
TLSH
T15612B8566E38697B8CC7D21DBA267F53E6F91032A1D51E48EAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0699165-71bc-4e5e-b3b2-51aaa65ce807.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0699165-71bc-4e5e-b3b2-51aaa65ce807.tmp
Size 12KB
SHA256 6a2314ec2d3df086339b51b33b21257dd992005877db8e8088a41569f211b68d
MD5 c352a52160480c43ea96e4f411462a11
SHA1 68b34747f34b17e8307c4c0f383a007fd61fccd2
SHA512 ddfce8aeea3ef2c20b3b5c73d69a19e2841891bde15158d1d38d8fe439a54adeb1fb8d0ccba005626e24cd5acb814a5a87610abca4d9a9002dfcc47add333ee9
SSDEEP 192:8SLsNbyQA4IILXxDPlvQmiU1TyOZp5u88PGquh63iuArqsvKgOniW:3sNbyRi1bUkp5u8iGlsU8Fn5
TLSH
T1D24229756C78AC369DE3A551F54B36139FB4816BEB882F80C5DD671C02EB2D81307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4306246bca677f9fe0aceeeb63e373eacaf44fa2638208c47849d4d9da6186b4
MD5 2f8f9741be18f79ac3be7d6e435707da
SHA1 5d3ab5da3219749ef06eca2ce9c4b3c378a7ef99
SHA512 949d48e5a20aa59a11aefe8ea2489d711a442939b84ea8c3d033f6cdb16dca824b32323279fe450fdc92d7b3e13cd3e8f74e5c0186a25d33e5ccadd2bb662bdf
TLSH
T133411468A7F91548B3B66F5AAFF3A96D487B78372E1AD46D00010E4F0A36B44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4804-315-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-316-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-314-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-320-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-326-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-325-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-324-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-323-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-322-0x000001A774110000-0x000001A774111000-memory.dmp

Download

memory/4804-321-0x000001A774110000-0x000001A774111000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads