hxxps://www[.]mediafire[.]com/file/fusjlp6exkaw4f8/exe2[.]5unplannedrelease[.]rar/file

Analysis

max time kernel
856s
max time network
845s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 15:28

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.mediafire.com/file/fusjlp6exkaw4f8/exe2.5unplannedrelease.rar/file

Score

10^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0"	WinXP.Horror.Destructive.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinXP.Horror.Destructive.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinXP.Horror.Destructive.exe

Disables Task Manager via registry modification
evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WinXP.Horror.Destructive.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{A9D0BC22-4ABC-4505-8AAF-6350FAF8B846}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
4264	msedge.exe
4264	msedge.exe
2640	identity_helper.exe
2640	identity_helper.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
4512	msedge.exe
4512	msedge.exe
3752	msedge.exe
3752	msedge.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe
4144	WinXP.Horror.Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	1588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1588	AUDIODG.EXE
Token: SeDebugPrivilege	4144	WinXP.Horror.Destructive.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	WinXP.Horror.Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4808	4264	msedge.exe	82
PID 4264 wrote to memory of 4808	4264	msedge.exe	82
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 1852	4264	msedge.exe	83
PID 4264 wrote to memory of 904	4264	msedge.exe	84
PID 4264 wrote to memory of 904	4264	msedge.exe	84
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85
PID 4264 wrote to memory of 2580	4264	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/fusjlp6exkaw4f8/exe2.5unplannedrelease.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fe9b46f8,0x7ff8fe9b4708,0x7ff8fe9b4718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,17751469899836899364,18375248504830409180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1056

C:\Users\Admin\Downloads\WinXP.Horror.Destructive\WinXP.Horror.Destructive.exe
"C:\Users\Admin\Downloads\WinXP.Horror.Destructive\WinXP.Horror.Destructive.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3080

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:764

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1044

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1240

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2016

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85fdc1c8-56e0-4235-a046-83d6af5a27cb.tmp

Filesize
9KB

MD5
99ceb678dd7492b8c1ead6c8ba1fc55a

SHA1
3a1c2a4ba19c50da69310a0d8929606baa24ac71

SHA256
38195716109739add5778a3bac687c4496caa4cef5367eb35ac141b4e0cac4d2

SHA512
2e18e16345522b32bbbf6da166e4ccd16d49b4afe123c2be9393636cc9e0fdb6f18826aecd2e5491d42f6e6958987a5c37145ff6617b13b8716c18985e7de180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
fdc31caf5c62d9bf85b46d6730d69822

SHA1
83e67e224aafa22046329b9d0460a0ecc62b99a1

SHA256
a9dc24214ecfaa31d67d32b77072010a1a9e07f88b7d436fa979c578c61770fd

SHA512
fc0c75968d860a7ab0e4609b8018bfeb40034268bc072a5ba6c7827b06efdd194523fe77ab83d1b9dcf2b954f969453595f1e72b29c4cc8dffe0405bd6c6e5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
1bc46fb55e04dd8bb4ab22d0697ddd16

SHA1
bbbb13d97a76bcef8dcdc1c9ece89bae39722894

SHA256
924ca378ccf32455ea41a216babca7ed8174e9a9e09a5a0c92b1e7dd95c991a3

SHA512
fb8a3f6c1912ab6b3ce7007292b6ab032a62c07973080dcf68f95ff40e0d0c17009858409c927281a1483d1670f27af650628bea5e4710e3b89a7cb1b8e53719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
20fa4d0f166e66d80ca5d76a8b5cdd0d

SHA1
9f9b368ad730d3f841716bab9e0f106ff11b20d8

SHA256
3572e8eab3fc539ca8e2f9a4c7fcf2496034378c3378812ebfc3dbb3de202932

SHA512
b1bab82f96db7221b89308d8cd700f15441a19a4b2771e072b4045b37300f1f66394faaa4be9f3c60fa73f7bc4a77690e189800a559d2c4750b0760364332bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7f327fcbd22df8cc1256609d032666d5

SHA1
c9e6a91e7f1f24de813c59417190212c4a86a385

SHA256
e5946813db8ef5e6c4f473b52f821f1131919a2e5a09aa3e866297e72b896a87

SHA512
a9ab092230e0464d7248979d8f738367b1e0d5a4621d8b481600f408d23606b5b4337d218128f0f3df01cf0cb3b440488df7fcd07aa6776230d31ecfefe3c2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
4377342cb0c240be1ba5e91f5fd9c9ed

SHA1
b9a85af9dc725787e12385eeede36fbe70443118

SHA256
aa53402fdbe6ab6c22ee4c3a0670f285b4e630b94729fd07bbbe453a1478891c

SHA512
95a7b11702f6e7fc73c5680de0163648f0c764b38d6cef6efa433244b9feecde867f41ebb3b096c300d56271f9c4aec5d3a40ce1a31251f424ecbcaf2a79bd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
437f68dfa17b2d0bf3e0ec75e9b9d7ba

SHA1
628f9e74fcfa1ce6ce39ca9823344cbd078be6b7

SHA256
b2c4d45cfb4d89ff39961e52d5656f2570ca2dcb8e9ab2e0ea196127c561761a

SHA512
14a083f4c1d39097b745e4271d5fa3675fc1fd2e143745bfddadef1ddc4af4ce9a574cafb0777469b0b1fb9a4e2a0d083f6e0e13e42d686d5e81c865e1c74d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f0d783b62c34fe9b7224f0055eb763f4

SHA1
f5df8cd4eb2cf9b66793625c47d0f0222f235c0e

SHA256
91c4f0999e21fd4f604f0431869ae6661da4c45d236d3ce9a1418294f27cc884

SHA512
8f3ecd6a137b7e035c71c0b4c4e67dd2fd0a4b628383d3ce9b50892999b24fab6b47b234946fdaf45673ffe8e510e00285daee3f539c9b2fc127e79046e95523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6430573bb9f9ed94f445b30229827c31

SHA1
239c263d076a4102279c8237bdf96e7e521d1b02

SHA256
e3d749255a74fc36d4a39ba91b53743193c1fc11b49103e92f4511c43c93965b

SHA512
af7fe4ec7d1ce558c5fd11a2cc97054ec9d983da3aba76899ea662b1bd4bae6a14f1ab299be4ec9edadff345c241cac98253bb585046510490d8dae5b465c46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
24eb416a78c65e12cd278dcbe15a0fdf

SHA1
69d2d93259546790038a184e7acaeb12b84a3967

SHA256
d424b7d113bbb40e1e541eee7fca3838b911c72a4cfb2a72f5c03bb957c537a4

SHA512
7ed2e0eaac9669036edfa6bcf872549d7505f6f724af9bf65e61bb9577a0b27fb44523106d1c3b04cd53f4b7002f4558a6e2605c5dbcf49a8667b8b9ebd600f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
967822e6757bfc0309e3c0aa52249358

SHA1
efe08f1a1122229c83959bbf48ac83d7e314c250

SHA256
7524f6938ac63dbfd79eb49333fd6c64c3d86fcea3cd7f9c6084db70f59550f5

SHA512
67d01de6c70d1297576a3faa2d556329614a4066781450e9fe89637f1954026047bdf23adc07a573fdc7946350f3c5f57836dac126d884e6c4c14e8b356bd76f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82cfd5b5d4608e6ae485d9b761c65ecc

SHA1
290407155ba3508963e9b0c4e5868f71b818308f

SHA256
e72965db782582a5684629acf3727766bc27dd60681e775ed821963a92c59e5b

SHA512
6dead1a6360ddd2879a155d31e7187864d6b4b5461d082780200045ccfca2eb0b756325f66187bf7e06db273591659a4d4a2467248982f9edb37a183dafb05cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
033cd69faa66bb17ed98495a9387317e

SHA1
28af99613ca0e65b06c3806eb3f7dd27a81adb0b

SHA256
f5f373dd4bef87275d9d60daf5c5c4eacc64aa8b40128f08572ffc6abd2fd5bf

SHA512
e7f9c4391c865c6b27accd2b6d683e18b9d40c3cba68d8acd8297448bd08a6d5f307758b8baf0ecfbea7fd94a34a3bef0d0b2098014671f734a5f4aabcdd2af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c167659f31ba68b6300cde17280a26c

SHA1
30c886e4d272cdf023e606651c47be15a1ca28bd

SHA256
2013fa4bb4b46b8c264cb6d9eceb15e16ec04c293edebebfe04282b8c74a43cc

SHA512
89266fda9e108a4cef2e5d9712dc9c5ea3ea09c65c179cc409e943fe028a57c9f2187af078a4b0f76022f729cb9af7659455e91929fcc08950a8ccd6ce5eeed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c8bcfb2427277baf4781005a1aa56bfc

SHA1
f2b38fff68d547696ac7df69e3aaf2f12374d429

SHA256
21d6de1931d28914b94428411e72a58dc65e73e891a42ee6a718a8b8e6ac3e1a

SHA512
947daf591da0c7c75fc0b7bef6f40705876f1f25f23da7afffdbcd35a9097b7378a6257015e60e701607687e38c1e48ac075c42a33196fae10d0ab3cffdbc3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c308.TMP

Filesize
705B

MD5
821eb1ae23a0b5d4735b2f7a56d67c0d

SHA1
8668cd8ec793b2ad2089f075bda72c8c1c5991f1

SHA256
b8414f9c3b121181166929cbddd23707483a7cdfe209c55ef14c830baa7b89ac

SHA512
75725f1e890a678394d4e52f4357be1fac74c2acd7cc3aae8127d7d32452b114c1a560118f3018ef610de42c6dd6e1a092cc4ab469f301e35b887ed5ec7b13b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f9da87980bcf01ae890d2f43bf75fff4

SHA1
5319afb0bf2b030574e1eab0c23bc4a68c3a74ac

SHA256
ce443f6796970052bd3a6dd8c1b572669cf0fb76df5a2b0d09ae93aa915bbf50

SHA512
313d4906aeadef49cc1fa9a99552c174ab488f990e6916051f13733a59214a5b0e80313aecf5fcb9edad74b3ea37cf2fdfd61c27f66604e5f0c8575d82e89de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5a6a48c52da018f45ff1de6a040312bf

SHA1
bbd6bc506d17cf553c0198f7a708403c82ec90b4

SHA256
74e0d2199837231605226edbe41d9a8b5b3546628a453451566407e17327b2ad

SHA512
c952e6734536b1a11dd99309ff835319cbbdc69b71191fb3d6395ddd9b7976fb47f4147013a2a5849d33f17d1c5863fc8095878ecc9af6b32738026d060b2297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f45350c9be3064487b30b41c753fb135

SHA1
a416a6b04eb9e7ffae89f63820eec785653333ea

SHA256
90df631d55f3048e18e854e7dcb5334bde8ecd67f26b5885f03ded924439012a

SHA512
0a81d3d98f933f2dd2446ecb1ab8a2fc2aad45b0619b0a17db4b2274089bfe731ba65cae89a3e1b5aaed54f34789f395b70b63e44735ea87b0dc5bbabf0518e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b5013bd364b154228cd527b5eb992b9

SHA1
42ea35a6114a521510e9f62589b6c04e7b401f7b

SHA256
d30576fca133217e12cad2a116d57e6de4b8cc9ab2a1589cf8955581b100c4d3

SHA512
b5465f517af81ec8b7764c8c3aa0fac9afd5f6c42347c6f2d3799cffc2e128c0737ae61ab6d925f66adad99b9a6ea72d709472df6b1dd56b84e467d88efcfcf3

Download Submit
C:\Users\Admin\Downloads\4382af0c-d3f2-499b-8118-dd181c5dbec8.tmp

Filesize
127KB

MD5
f01d499a3a88976b4f826326a99cba17

SHA1
1622090374e659523bb9091360ceef5a0ce1ae77

SHA256
9be7b0b6ad3fee3c758ede92d28ce74bcaa2eaae732c7def4940199c2b522961

SHA512
a566d792c068a6c2b2559f86d3f538636cfcec8c5d7f9b0eeb974b3496d8573354662881466c5b0dc89a4678aab3ab0d1eb1bb3a8b4f986107990f36cc3bc475

Download Submit
memory/4144-676-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-677-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-678-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-679-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-680-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-681-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-684-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-685-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-686-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-687-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-688-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-689-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-690-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-691-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-692-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-693-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-694-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-695-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-696-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-697-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-698-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-699-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-700-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-701-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-702-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-703-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-704-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download
memory/4144-705-0x0000000000400000-0x0000000003DF3000-memory.dmp

Filesize
57.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads