hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

18/04/2024, 12:16

240418-pfngesea41 4

18/04/2024, 12:14

240418-pesprach82 1

18/04/2024, 11:52

240418-n1ymfscd52 8

18/04/2024, 11:48

240418-nys9ysdc7w 6

Analysis

max time kernel
610s
max time network
647s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ico (2).exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
4576	bootrec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bootrec.exe"	bootrec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
198	raw.githubusercontent.com
199	raw.githubusercontent.com
48	camo.githubusercontent.com
49	camo.githubusercontent.com
197	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bootrec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4636_137646304\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_75_4_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_338216431\_locales\ro\messages.json	msedge.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1416	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{1C6FC980-8188-4B6B-AB44-6D94AB0EAA78}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{4DCF9F21-9BF8-493F-9CDB-79583F5B5704}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	ico (2).exe
Token: SeDebugPrivilege	2276	ico (2).exe
Token: 33	1508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1508	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe
2276	ico (2).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4576	2276	ico (2).exe	124
PID 2276 wrote to memory of 4576	2276	ico (2).exe	124
PID 2276 wrote to memory of 4576	2276	ico (2).exe	124
PID 4576 wrote to memory of 1416	4576	bootrec.exe	125
PID 4576 wrote to memory of 1416	4576	bootrec.exe	125
PID 4576 wrote to memory of 1416	4576	bootrec.exe	125
PID 4636 wrote to memory of 1464	4636	msedge.exe	128
PID 4636 wrote to memory of 1464	4636	msedge.exe	128
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 2164	4636	msedge.exe	129
PID 4636 wrote to memory of 1860	4636	msedge.exe	130
PID 4636 wrote to memory of 1860	4636	msedge.exe	130
PID 4636 wrote to memory of 1292	4636	msedge.exe	131
PID 4636 wrote to memory of 1292	4636	msedge.exe	131
PID 4636 wrote to memory of 1292	4636	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4972 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4928 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5400 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5520 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5908 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6012 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6016 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3a0 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6184 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=5740 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=6548 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5732 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6488 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6776 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6628 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=6896 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=5772 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=4548 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6888 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=6916 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=7160 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7604 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7036 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4056

C:\Users\Admin\Downloads\ico (2).exe
"C:\Users\Admin\Downloads\ico (2).exe"
1⤵
- Disables RegEdit via registry modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\bootrec.exe
  "C:\Users\Admin\AppData\Local\Temp\bootrec.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\bootrec.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd71342e98,0x7ffd71342ea4,0x7ffd71342eb0
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3096 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3216 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3492 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4712 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4780 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2572 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4988 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3836 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5188 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5232 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4536 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5880 --field-trial-handle=3100,i,17403299303860331031,8813289284201790160,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:628

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\UndoDisconnect.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:4212

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\0c1aa3137db54ec1abcdd43f5c03f143 /t 3688 /p 2276
1⤵
PID:540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PushUnpublish.htm
1⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PushUnpublish.htm
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
52d8c39180c863e5e7b2607eb05686bf

SHA1
08c7b1cec8199dee4a87e4f77605bdc3a02d0cc9

SHA256
7135428fe5e046a6dc8416f0d7b5296a764618a7fd2cc961c9f22eaae298ba11

SHA512
d826c04ab54d7584712667f3c9b34fa0e6502ee7b86881c321e51faaba524838b6c8e320c2f577fb4a27e3207a8a294d1e9abfece32cf879277080e6610bdddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c74b3776cce259d7245546505b0af85c

SHA1
db9733d4eb619d5af90089646f928ef4ed8bc26b

SHA256
4e2f07cdf3c967e7b3dd31887ad8f3a129b66b31454672e6abdbdd6a4a6b3af0

SHA512
3adad2b0cdb75255968db789fd3f27d917db59115d04008d9217d9fd575c2824d8132edd9c394ff1090c9d5ae40a1134cad25a30ea2cf83fe3702dd7bd115145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c828e3a7a2d99d0f1cb75df6e7dc4e92

SHA1
35bda1ac6d8c66b9e205ca1f8c395f991294e166

SHA256
e21e680a1b29bac4b11546e55711e52c75eaa354e4b34c57559021a88e2d9832

SHA512
ab9d39c2ce184f12abc71481c822f02ff521c4cd0f346f0bfa09b8529a17302681213e682aa076aeddceb55a8fe189d502546e0b39b622df38654331a3b0602d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
85014ae30caa53c54753b9040dd7c7e0

SHA1
38a3b3fcd8a3cfc5c8cd790468970441ce3c1580

SHA256
356afb430fd40971dc58efa7ba3e0d23be9f5d442dbe2886ae1842ce96f049f8

SHA512
cb9d5a396f186e97f7b206cfc325a31dc6a2b07d7032258a61840afab3b8c6ab8826b8c09ecf0405e421a936d25eaa410172ac8c0d75573b9bdbc45b0f81a5f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a34c210a719d894d607e87fb65b29f10

SHA1
33e94240e6d3ddaf11ea2651a99fb1ff87a1c1c9

SHA256
08e62b3448258430b1f4a97e23620b6bd9ccb416df20a2fabd7597b2fc2820ca

SHA512
5f7c5287a949e461391a04a5f0fb2e7b9e5ff9295f3c24e2327b5169e17993ff8dc2a01e2a906fa659bb9e51cdcc31074fda2b8f178915c5e1f1d79ae4462291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
4dfffa2e4e7a33db6be7640688f45296

SHA1
af566a9576bd068eaac50239863c1208134b86da

SHA256
0ed1a6ff9f27616f69cf93a27ff47712e5ccab5afcba254f3817380d9a2102c3

SHA512
2c0fe5cb269cd5b4b0ea53408cc28508cc14f7f9f8fbba80e75f877454a880dc2fe6068e81552e071ebef1d82dc76e0e4847bc9534fb792e77b7989c11dc83de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
a20f5140a25c1d0edc4820ce7eca7b10

SHA1
951efa004a7cd707b6e9b0ca5d3e8b2f825ecec3

SHA256
a2f78da15c0d5058b2757c7f8a05d09f4f201e7e3bf13a28212c28e972621768

SHA512
44828e84cf6c307114c565270885d3ea4697713de5fa68d553b6e9aab352973d719dba76b967c4c45e2ba3fbdd5526a8da353774995c89e429931b1894af9ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9783d9007f48618ebe26ae9a3638ff4b

SHA1
bc42e93465f965b901bb384b16246f7be4d02965

SHA256
e73fc9832521c5ba270f27c05607f5840ace13f67ebf3eb68582d4ceaffb3ddd

SHA512
de152ffb5510769db28d3675ffe87cb2d7e80c41ba026e953c97580dfdc6acdf101e90fc4ae0ee8836b1df53cfbdb6e4c90f1dfe58af6a558c899d113271dec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
dc56a4467c7525e4b6ea890ed100d1f7

SHA1
8b0511657bee6eabe508476d539a8eae0f58bb02

SHA256
0eb6d70fcff77e73fe47f8a2adf4a81e13ea57c7f4d3e8e0e91808b35c8200c5

SHA512
2816285de819970d31e44f2dd7b8044ec444beff5a0a75c7e7415f1015efcf6f22f314ce84742a673deb92b5c79fe6c14c756fa75ffa866fd8fadd7823caf7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
6dba7ea988b5388f42fe3543c8c17f70

SHA1
4f80389f0fd2f835277e0cab2728d42b83a6b712

SHA256
65a45a7a6df6bcfac5ba59855822af2c4e23680cfda5620cfb5205c3b5676cdc

SHA512
fe4f33310eead9a64d34192082cd0d67839f61d388986750ef37ff2c09e59e46dbf8be61b0dfc37c564254a0355dbb9a12be81e355b43d78f00a5d4efb5e7dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
68a84f8d5d457fe21b2877f3d472b22e

SHA1
3712b8bddf10d0692f5a956a83d9bfd68c2d63a0

SHA256
9a801bf5d3cdb5592b764a8ea89b74f9242d725d44077689e1cb1e00395f29b2

SHA512
79e6f1117de36c5317a6f417c4bb3d838c0d6ca8f87e1b045637605981d325b15e7b47cd7512b6b3968f6fdf39765cdfbc9b118410c4b2755a29bef6d71105f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
25d73d8725c5dacbcb60ca53895ee10f

SHA1
9632e0e4ad93b526347187f2a3175c9fb1ff5cc5

SHA256
bde9936e244c0c51b071c2f269a619a585dca352476a97f49605068420896df2

SHA512
d9ce1d3e9b4119a954d945424a923584de646b05e5a00b9e1c72d1315d670d79c1c5977125a04f01a004e3df33c33690b23ef7e5148a66f30dba4d380910ae5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
51KB

MD5
237377ca121527865b8771372933c2af

SHA1
a4d08f5f9e61cff22da2e946935341334222471e

SHA256
ca5cba14182110d9d007d7b16ac5171eadd0462f83365d5a9491b9c72d90b5a7

SHA512
215f4a05f4ee3252e754fcc80957fa6989adc9626e954448ad6eb10d518f863b2e9cbf040b78e159a9f0608fece117d476d18694cd3087e8bfdb76878e4de7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
107KB

MD5
cb32db8142a22c67aba8b2332fd175c0

SHA1
5a170d65ddd768dc4c8325024f055fcc8b3cfd5e

SHA256
5ad6c0d6b22f12797f38ebb0ded97e1393104d696192d1e091ce981cabd6dab0

SHA512
f01af87ac1a139a0cb4418fdb7be5eea2e7574d3eaad1abff2127b4c70e84e8966bc80188545ddea6bf0075d88d3d014b2e6998a0a79fcb25f98f15d2de3b933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
97KB

MD5
c144bb5ae778d9eb5740765bf2767459

SHA1
1e458507518ae4178b67dd1cc1d577e61d363e46

SHA256
a23f9fa1cfd646b723cc451f4e5511c0a6eff2eed604ff7a747087eba0cf40c1

SHA512
0defdd00b1f8cace88b61c2957dbcdca9dceeeb0d9f1c71d24ab18c528076ea3eecd23406ac27b27d9737e8862f83b80f44fccabcbb0a3627706f3eea4650a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\b0d6bacf-329f-44dd-9e56-c4b8704eb170.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\bootrec.exe

Filesize
167KB

MD5
f14b989516f256db1befee3dee508f55

SHA1
fbd2c6b1d783debb9a69c5766d3672138e24e127

SHA256
c88dbbd0002395beaeaef3f855790abef3430d76307953825745339bdc1f9388

SHA512
bfa84b7837d3bcda55571710289092af7e6cb7ee48b21a2a032d24b495ddbe9259c07eeceb58fb2a5ac4482e2b120259fe5b95162eb632228c86516f41bf035e

Download Submit
memory/2276-20-0x000000001C5C0000-0x000000001C5C8000-memory.dmp

Filesize
32KB

Download
memory/2276-473-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-22-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-358-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-375-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-21-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-0-0x00007FFD76510000-0x00007FFD76EB1000-memory.dmp

Filesize
9.6MB

Download
memory/2276-19-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-18-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-401-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-403-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-17-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-458-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-459-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-462-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-463-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-566-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-23-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-474-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-475-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-476-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-477-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-7-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-6-0x00007FFD76510000-0x00007FFD76EB1000-memory.dmp

Filesize
9.6MB

Download
memory/2276-5-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-4-0x000000001C520000-0x000000001C5BC000-memory.dmp

Filesize
624KB

Download
memory/2276-3-0x000000001BF00000-0x000000001C3CE000-memory.dmp

Filesize
4.8MB

Download
memory/2276-540-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-2-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-1-0x00007FFD76510000-0x00007FFD76EB1000-memory.dmp

Filesize
9.6MB

Download
memory/2276-560-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-563-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/2276-564-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/2276-565-0x00000000210F0000-0x00000000211F0000-memory.dmp

Filesize
1024KB

Download
memory/4576-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download