hxxps://theannoyingsite[.]com/

Resubmissions

29/10/2026, 23:24

261029-3d1wmatwgz

29/10/2026, 23:14

261029-271maatz2k3

Analysis

user interaction
yes
max time kernel
6s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://theannoyingsite.com/
Sample261029-271maatz2k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{2FB26F4C-CCB6-4A06-87E0-E925DEDD7E4C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2156	4916	msedge.exe	84
PID 4916 wrote to memory of 3236	4916	msedge.exe	86
PID 4916 wrote to memory of 4284	4916	msedge.exe	87
PID 4916 wrote to memory of 3236	4916	msedge.exe	86
PID 4916 wrote to memory of 3236	4916	msedge.exe	86
PID 4916 wrote to memory of 4264	4916	msedge.exe	88
PID 4916 wrote to memory of 4264	4916	msedge.exe	88
PID 4916 wrote to memory of 4888	4916	msedge.exe	89
PID 4916 wrote to memory of 4888	4916	msedge.exe	89
PID 4916 wrote to memory of 4888	4916	msedge.exe	89
PID 4916 wrote to memory of 4272	4916	msedge.exe	90
PID 4916 wrote to memory of 4272	4916	msedge.exe	90
PID 4916 wrote to memory of 4272	4916	msedge.exe	90
PID 4916 wrote to memory of 1944	4916	msedge.exe	91
PID 4916 wrote to memory of 4028	4916	msedge.exe	92
PID 4916 wrote to memory of 1944	4916	msedge.exe	91
PID 4916 wrote to memory of 1944	4916	msedge.exe	91
PID 4916 wrote to memory of 4028	4916	msedge.exe	92
PID 4916 wrote to memory of 4028	4916	msedge.exe	92
PID 4916 wrote to memory of 1672	4916	msedge.exe	96
PID 4916 wrote to memory of 1776	4916	msedge.exe	97
PID 4916 wrote to memory of 1672	4916	msedge.exe	96
PID 4916 wrote to memory of 1776	4916	msedge.exe	97
PID 4916 wrote to memory of 3740	4916	msedge.exe	101
PID 4916 wrote to memory of 3740	4916	msedge.exe	101
PID 4916 wrote to memory of 2644	4916	msedge.exe	102
PID 4916 wrote to memory of 4452	4916	msedge.exe	106
PID 4916 wrote to memory of 4452	4916	msedge.exe	106
PID 4916 wrote to memory of 4452	4916	msedge.exe	106
PID 4916 wrote to memory of 3964	4916	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://theannoyingsite.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x24c,0x7ffa8ef0c188,0x7ffa8ef0c194,0x7ffa8ef0c1a0
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16212661744803671460,4034712204552951601,262144 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,9562956504702834441,5392500979148618047,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,11744423607265200345,7376780456557842937,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10573039922149295368,12545087321501500425,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5568695634335922584,14302618775558928916,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,1950451422476907356,6638637132220430325,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5519198360268053006,4213086629812620213,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,15329730317916556057,2175468547251276144,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,10313555486033780570,10039204327564477529,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18199075805017132849,17887398523718194729,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10766848721622265354,12278189515930277679,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18199075805017132849,17887398523718194729,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6700,i,13658061581135730570,9574722570259650472,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,8387505642515450112,13247885655277247490,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7276,i,16753666720396161584,4798871204828517408,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7400,i,2055083283459542521,12442294367967716151,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7516,i,9747708173244213238,10156919231035514826,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7828,i,7288145114811038796,3193106164710562755,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7788,i,352480024704900998,4512430376293524801,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,12629512858762319287,7615805508086633691,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=8728,i,5603301031212851636,13168217738464847309,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8880,i,4830462335157387391,16908588113126679776,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8556,i,12308743362197696943,5530058664499350486,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4540,i,15764380805827798693,8322637710348293415,2097152 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13070392135831980804,3606895781934936277,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,1871204234614188733,7528660179115951290,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9224,i,6432225250343494585,12778895842905063757,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9100,i,17727810393396144831,7247667595924801391,524288 --field-trial-handle=2392,i,8727936496549183117,16785441668952186242,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:8
  2⤵
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3488

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x514
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4b6b80fe-d0bd-44aa-9713-c5798c39b5c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b6b80fe-d0bd-44aa-9713-c5798c39b5c8.tmp
Size 18KB
SHA256 96e20895d795c8dd36d5b687acc1159442792a78551627342b77bb780e2e6d82
MD5 641765c52d73d7c2ba605f7b4a68b601
SHA1 28c83186532a37e242fa4bde2d929e5efdbbbd8f
SHA512 0191ff8b0ae1b9ec8f0b93229919a43e1a0c8f9db225cad4bd1be915d2acdef9a6e46a7ba1dff9d68b1656715f11ffd21b1e13fb448ef462df95fa3016e124a4
SSDEEP 384:HQkUSv3sNUMFXwdeHp5u8ijOB1E2I2IIlB:Z3e9fk2E52Lz
TLSH
T1D3826C325CB92C379EE3D951F54B36039EA48227E7D82F98D5D96B2C01DB2D82307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b3b072e-ae0e-45f4-a4c1-a9d295bb5279.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b3b072e-ae0e-45f4-a4c1-a9d295bb5279.tmp
Size 8KB
SHA256 755e888e52d3d5de007b0a064195cf34e21e8c6b605203f01ce0681b53043b4a
MD5 46a37bc372b05c24565a853544ffd29b
SHA1 cab1519eff1eaeac898f5a98f182aa66769e55f0
SHA512 8ce3c85b40f9b835dfaa0cb47a07cf450de6a85f0bc63593bab5fa17b6555e715a061b02e4fb97b65d267f4a75d707eb829d5d7ebd56cac20f62661f8abd55a6
SSDEEP 96:PqONkNQsjpfwDISp5ih/cIPURHl8h4otop5QmDvBfPGxvw45RxmJm78lFUxFqseI:SONV6iDCQmiUyjZHq5u88PjaSqCcpLU6
TLSH
T1F102E839AC783C7B9EF3AE05B5473B179FA4013FE6942B84D9E81A2C01D729C1307522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b12fb0-8c66-4cfc-b148-31308c41a5d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73b12fb0-8c66-4cfc-b148-31308c41a5d5.tmp
Size 18KB
SHA256 80240b522a790b24dceb708537b737552e159af4e0623462ef899ed64ad65993
MD5 4b4c5db6235ebb3e0eb58e953110c4b5
SHA1 1eb1dfa0eede70172be10feb37d0aea5f0ec7fd0
SHA512 a589b391a782e304919cde84cc326be15357dbfc4240ef532769f0e817aee6e79fa93a796fdfca28c09ed6984bd5ccaf365cb8d5091f13e090ed14f0c877cfa7
SSDEEP 384:HQkUSv+sNUdFXwVeHp5u8ijOBIE2I2IIlB:Z+Tlfk/E52Lz
TLSH
T11B826C325C793C379EA3D951F54B36039EA48227E7D82F98D5D96B2C01DB2DC2307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6c603c48bad8cf6fc5bfa1901589a53022a5c1315888da77b07a5c7516687a5
MD5 4fabfb1f7d070458e2895ffec233ff43
SHA1 98393503bad4d9db97f3ddfbb3e45d91868d9978
SHA512 8d103d2ec672aaef277a945b102deb58448c812a35ac148aeabfd0c6f3a0f02507510d1c81989a1842eaf658c9190a9493eb0148dbc239fa99fadbb1108ebe40
TLSH
T13ED0805474663DFCD16E71355415CD405744DF53E1021755160B4C15D5501C61CF1EDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

0fadaf2c-66a2-4e3a-a8f9-18c3f5feee48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fadaf2c-66a2-4e3a-a8f9-18c3f5feee48.tmp
Size 10KB
SHA256 f4a714af95e3594db2cf7110a0fba06eacf0a5a2af3059b11955b51c4ada5eaa
MD5 e593a71169746380e54b828e0ed62e6d
SHA1 ea02421d0287b1acfb324882bb2ea760d445d253
SHA512 9bfd0aed7001b6f1aeadaf1a7ec7c2064fd7cefb4cb1ccbaba46240a034ae2aae581d22ca69af838b01567a5626b807ea8531b679a1452ac2f6adf5f656c3319
SSDEEP 192:sxZGRn+//fBsWkiIdpBqHW6+WNmtJ5YaGV0FIg5dJ:sxZG4//fBsWkLsHb65ph
TLSH
T18622C8526E38697B8CC7D219FA16BF53E6F9503191D51E48A6FC961C04E7ACE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bfeb05c-54b8-49dc-a58d-f0c609e2509b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3bfeb05c-54b8-49dc-a58d-f0c609e2509b.tmp
Size 27KB
SHA256 dd45ca222538eff3e6f3b2b91e01d127aa3b9f2e2971b602b91cf2aefd095bdc
MD5 c640c172e5abba631348b3bb12dbceea
SHA1 1dcf4130ed9eb3f1c9144b81022524d344c9ae2f
SHA512 3c5ae63507c81f94a0ded53819abb4e44f04a84d01d2676f10b9cdea5c90c59d93ff07f7c4d166c6ffb278d260316708802a20e591ceffb4b0a9d8559417c842
SSDEEP 768:kByQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3DrokZBiv:kByQRbrWvvlRZu1jaXKLf33wkZBiv
TLSH
T1BBC2E92B640CCB7E4FC01E9DDC6A6F977EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

651f28d9-d556-4185-a309-f26fe3cc017e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\651f28d9-d556-4185-a309-f26fe3cc017e.tmp
Size 10KB
SHA256 c547f28a945a41f0a65bf6607a727715b24acb1293a8f43d6f298f684203a105
MD5 01c92846ec3725aa2c3fb47f45b89e79
SHA1 481c0ea4b9bb78e4f780547b4d8664126ccc8218
SHA512 6a4bb0531545d66967b7111d8417c6203f1b9161ec8dc0dbb830363b4e948eb250b4fd8f91dcaf6ac015656896fa51ad0c84a45ddbb7c032b2d40e2a2ad36802
SSDEEP 192:sxZGRnc//fBsCkiEdpBqHW6+WNmeG/Ya780FIgrJ:sxZGC//fBsCk1sHbe/x9
TLSH
T1D522B7526E38A97B8CC7D21DBB15BF53D6F9103291D41E48A6FC961C04E7ACE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a504784-1368-4350-a1d4-ade21782cdfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a504784-1368-4350-a1d4-ade21782cdfd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c5a50cd-d91c-4a66-9eb6-6aa5786bdc81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c5a50cd-d91c-4a66-9eb6-6aa5786bdc81.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 335KB
SHA256 38d3c144ae01734a171ea052eb31946a3a266193e09d78107fe74e64677d851e
MD5 69a2e59753e3960d18e4c45c0b29c58a
SHA1 78cd4810b0005075722497a5e206e333e956cfb7
SHA512 958f91a158acb7d510c6ed3a0a21eabd4d3280bad146cc1856a7412b009fc2b1c6cdfd3403a252cd29b1a0ccefb22c0764dc37ca1f7da548b4e49f15a976de98
SSDEEP 6144:skJS16bufdIkQdPNlfG0nDgu02NDGKsgVwjSsJALotIE6/9l8FSzfL:o13I3PNI0TvG9vjpXtt6ll8OfL
TLSH
T1897402566BB1A652C07AB731CEE7D3025730F8C08AEA672B114CB6614D464F673E29FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 21KB
SHA256 d88713991f16893a6cc6faeaa17a562ed9bf603353d4a9573030a075cf620545
MD5 148c94a9ea28ec15af274f81e78933b7
SHA1 aa8324fcc5b64262423d07b76cb2d6fca51856b0
SHA512 32f0d70d44fa60b7adb0c61069714c78b716e6519ebba9709bdaa8b0d8c6fdcb01abb076e5f0f03b254ce56f5333d593bd0f680eede2531a63fa58b7d7f9800a
SSDEEP 384:XZA2/h3swe+Mznxm23mhKvvCeyy4L+4QLRZ:XZAGhcwrenxXH3TKQLT
TLSH
T1BAA24AB29F11F02DD2A258398116CB37573E7E32E73C584C6B097E9B2076689D632893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 81c1fd21001ac66201899e408a900484cc5ac03a79bc4dc19c2474b4542f37e7
MD5 83ae63443a5d4a7c1ea19303f64e954e
SHA1 f48e721f6ea2b5948a0bf763895461f6b35de3b7
SHA512 f2d821def0c0e02006ecbec244ffd042a0923c5069351915207160e2f0d0c99ffc11137482a5b357856ebe890d65751b13cd22ac9e42fc882d766689ebe3c1eb
TLSH
T1CB7140CA5ED1297BFF6825B0C1F8144B3B3078B059A31F5A28D6F8751E8E7891DD6238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cfea27e99c85f923e9a4a3c60bcf6c68deb79a26bd8264f17d4b77dd4a0ec882
MD5 e5732867ee427db2f1b152734a7d6fe2
SHA1 e731587aea2b517c83278f191a857b4d9e4179c2
SHA512 cd314ee22a5dcaa2aa3bca0605bcf5485f574d1f52c5fbce1bdf590f225d7083ce7e381cb8c6ff8f4159e2cfceb773cd75c7f2d0f2c5d793744890e669e709ee
TLSH
T1DA6131CA5ED0287BFF6865B0C5F9154B3B3074B045A31F5A28E6F8741E8D7882D96238
MD5 SHA1 SHA512 TLSH

Submit Download

dceb986e-d89c-493b-8bfe-7a8fcd199c27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dceb986e-d89c-493b-8bfe-7a8fcd199c27.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3e9cc243-c3d7-4d85-8042-b7a24d52f5c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3e9cc243-c3d7-4d85-8042-b7a24d52f5c5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a56b6acd-7ccd-461b-8e95-2f5385bfd638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a56b6acd-7ccd-461b-8e95-2f5385bfd638.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66b782601a4a846d34afa7fb02c7732e477e1f0411eedef3f7c71ed816c5c2a6
MD5 2f9b0471a05ea75cf24d25fc40938547
SHA1 be2c00041f8ef6c8c1fb2f7842407cd7a5813e62
SHA512 6c1a0f66f6994ca26198e9b1d83beb01022f59f51e18a39f14bf3a70dcb612f8fe5e130edd1ceb9303466999298246eb4265270555aac75dcb4ae084dbf02418
SSDEEP 96:KgHmKQou6ucK3q8t0BdnDfkvDePh1kKJBhVryKkUeg:AV3lt0BdnDfyDeJ1pBhA5g
TLSH
T110A15251707B460038BE299C42A6DA5A165231B33018E52FBFBC41F16E6FE095FFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9d5d3dd-7e93-4340-96cf-6ebbc84d9a5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9d5d3dd-7e93-4340-96cf-6ebbc84d9a5d.tmp
Size 10KB
SHA256 730aedb58a649571810592dfc8c763895afab9266242669999e0fde6344e2514
MD5 7a1f70bdbc4390f567cd63843bd12e77
SHA1 ab7f0f2664a5f54bb7a4dd8b79bbb5af07f9437c
SHA512 2255e58bb54d52c5a7e13d7625191cd338785f836a0c397dd5a55f1186c7bae52df528a8a8da2417e639bb07ad02259be4ab6e3f159222b0aacf2b24eb218e36
SSDEEP 192:sxZGRnc//fBsCkiIdpBqHW6+WNm3T9Yam/0FIg5dJ:sxZGC//fBsCkLsHbW9Zh
TLSH
T1A822B7526E38B97B8CC7D21DBB16BF53E6F9503191D41E48A6FC961C05E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aff63ab6-08a1-487b-8d25-10cae7142f81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aff63ab6-08a1-487b-8d25-10cae7142f81.tmp
Size 18KB
SHA256 27b5b239e258b93e8b1a8824c21e3043560a4902c7a2c59ff480c1dde27561c3
MD5 9c47697ddc817701456e9503b0d95b7f
SHA1 1121d1757ee908629d70d7edacb9055eb24fa872
SHA512 96453bd12eb16e2e1ad13d19d9c10204da68c609b3c4f517605f151b4f76c1531ec06e143e81410c37e45fddbfd76903e87ba7dbf60ace62a57281b51f7c197e
SSDEEP 384:2QkUSv+sNUsFXwVeHp5u8ijOBIE2I2IIlB:W++lfk/E52Lz
TLSH
T1AA826C325C793C379EA3E951F54B36039EA48227E7D82F94D5D96B2C01DB2DC2307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbb6cc82-75ff-4d76-9f7f-416207aed547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dbb6cc82-75ff-4d76-9f7f-416207aed547.tmp
Size 8KB
SHA256 2046dec64d9019b6582fd8b0914a286f0322b4c10b42fd236839e0e1898b2716
MD5 38c0ae4aec3b29a1668424aebcde4e5f
SHA1 18399221e9343c063af1c007a439d593aec9a3d1
SHA512 4405b2eb6540cfaf007bb23e5bebf99f0ac79528d8248f1212942f0bae4f4ad5143677d41b512d1df26d6517e3623965d36d0b1bb6dac71c84458d03cc5f2c2c
SSDEEP 192:BONvV6iDXQmiUypZ7q5u88PjO7F4uZhqweU6:BONd6o47q5u8ijOBfEU6
TLSH
T16712FA36A8786C7BADE3A951F54736139E95423BE7887F84D5EC262C01EF29C130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34eee897-460d-4a40-b928-7643f6e4340e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34eee897-460d-4a40-b928-7643f6e4340e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f70a522d1b6c77990a0af3ed1939e32ec998f7264f1071b50daefb8d7e32913
MD5 9f93594b5d2ac2f025df306b72da18d0
SHA1 4788a5095bd4e48e8a4ba550828f6a07c6adc30d
SHA512 a4e981b44bbb1372849ecbc4d6f12252fcbca8e196303d176d794a34a71baf74f1a561f89650813722a2a45c183cbafddcf5ee0fab2389e595e592d85e32b770
TLSH
T115412758B6E91148B3B77F4AABF7A8AD487EB9733F06956D00110D4F4A62B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

506d4bcf-a320-4b4c-850a-a18f35f9dbef.tmp

Path C:\Users\Admin\Downloads\506d4bcf-a320-4b4c-850a-a18f35f9dbef.tmp
Size 87KB
SHA256 b1d1005b14deca1ed1e078758d7fc0dd9917748b46f71b0be16b44c57bd0088c
MD5 b95f972b9b33ef69ca3b9fb1b0adef5a
SHA1 d8ad42fab3f36712b6205d6205ac0947615caec3
SHA512 5448bcbca0acbc02b2cf12e81fadb1a0a1b5b27128a530a3620576b58a26926b8b07f814f2dbc60716321f883e75d08a3f606b14b8cae56e459065c7456b4def
SSDEEP 1536:CXVNM1U5gAODlROkxNOkt448G222osmY9XpZ8MQ4FABE2vhuRzih0wWbVB0GnN0x:IM2WlR0G448GamK8MQ4YvUzo0wW52GnE
TLSH
T188931212A7F2DD92C50DCCBE7692417BFF98C60C97F467E848281B16348A361D63D64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cat-ceiling.jpg.crdownload

Path C:\Users\Admin\Downloads\cat-ceiling.jpg.crdownload
Size 7KB
SHA256 03ec03f11548c1bae13af126e5f90fdfac51fae70b4749f80a76a433f0fef860
MD5 f488f8cfc743d4c85fdd2e568f61ce2f
SHA1 61c9978bfd4e6ca0462be878fbd04b427a0218f4
SHA512 9057bdba20d925b565f38e338241c25d8d505de41771bac33194920abba2c7bacbd5ce913a43e49ceb29f7888232363219e833e1eee8b7cde8d863de0e8419f1
SSDEEP 96:RhGuMsfTtWof606EiES35665F9kNGPzQCa3LcnqDG77jwGDtJc47BIOVJNBgaBhj:LxHq0dU56wx7ecnqYHwgxSOVpRUQ/
TLSH
T163F18DDBBAAB9D01E360BA643424CF672BE1CD0C8F997937A025FD4C69F9C7104A9D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-269-0x0000013C08430000-0x0000013C08491000-memory.dmp

Download

memory/2644-257-0x0000013C08430000-0x0000013C08491000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads