hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

04/03/2025, 22:58

250304-2xstpaszes 10

04/03/2025, 22:56

250304-2wycsaszdv 8

Analysis

max time kernel
50s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
04/03/2025, 22:56

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
35	2968	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
920	GoldenEye.exe
4964	LaunchTM.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
35	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	LaunchTM.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GoldenEye.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LaunchTM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GoldenEye.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{e0262aac-97dd-48a2-9329-f743a3f45e2e}\LaunchTM.exe\:Zone.Identifier:$DATA	GoldenEye.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
796	msedge.exe
796	msedge.exe
648	identity_helper.exe
648	identity_helper.exe
2256	msedge.exe
2256	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4964	LaunchTM.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4412	796	msedge.exe	81
PID 796 wrote to memory of 4412	796	msedge.exe	81
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 4144	796	msedge.exe	82
PID 796 wrote to memory of 2968	796	msedge.exe	83
PID 796 wrote to memory of 2968	796	msedge.exe	83
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84
PID 796 wrote to memory of 4428	796	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f77d3cb8,0x7ff9f77d3cc8,0x7ff9f77d3cd8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,8073920788464309299,15612261226266414247,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3776
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:920
- - C:\Users\Admin\AppData\Roaming\{e0262aac-97dd-48a2-9329-f743a3f45e2e}\LaunchTM.exe
    "C:\Users\Admin\AppData\Roaming\{e0262aac-97dd-48a2-9329-f743a3f45e2e}\LaunchTM.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ba99a68335a13e8a22b4b51dc0a51022

SHA1
934d1152101316a38b684741fc86724cd74a8ff6

SHA256
f3d599f23410c833f41b25467809f4b6c7c8d6b33d28c1c8abb84b6d7e62abb8

SHA512
ffe6f1a2c521be5ed38ffd6a6762484ed0279b9d21e513cb26c4001e5ea5cb78aedb3ce616a6db85309dc200e0b7f2be868162c12d355c3c86c27f4122b0e632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bc2cbd04ed97af5ac19b4576a7bd16c

SHA1
0ae6fde8014576169a374d6e1c791b485a636405

SHA256
03269843f9483855aa07c17e3535844d5b83f3cc6315641e6dcde805688b9226

SHA512
0a8b4f5face6031ed90f33d438cee072deda924c9b8d8992d0dbf5d9d245b019a22d567ebf633fb2e8429adda453a887342db558824d52bcf056cc81696dd452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d0e13562a64b0c43c78d13252b6012a

SHA1
e3e3905d9e309a22f9a635827c272cee1415f782

SHA256
695942de135ae2575c099362e3918e13b6bf06ddf7eb308796b47c01ee5f85c3

SHA512
1ed1e01d857f90ebd9e82394e6b49336a657b7ef79be5bd31097916a81dc8319c295de856d6966ad0e40ff5f52447c3ebf6ff27e8d389f0e1decc6bd7919b3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
efa51670a4878461282edfde78c5757b

SHA1
eac00102a232ecfda0fabe2e7a45a45abf671a76

SHA256
c3a881db4b27fd80272ce7d8a97a6c432a8316eceb9da49acd840936fd7f7755

SHA512
e439eaea37716cb09f910e6a545b3f37745c98dcd2646b7a843dad769a4e85dc7a3140daa9c86a02f21c52140f4b6d521ced69573932dc9aab996231fe1529cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0a8c2a7cc0f5b0f8a97b79b1c3dc35c4

SHA1
6edb639eb587b173dad8c9f42378fbbb73845035

SHA256
9737118772d533005e64fddb7a906f58233ac1bc042f51a6fece48dc8224a034

SHA512
036cd5a2be6adbaf92c14ac858c4e08cf01be21402609f0b516df293a30b64dc085fba282939addb82b03b6000e2f07a8de06a706104d8bb27f0b74bb1984bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f82b.TMP

Filesize
874B

MD5
9a08439d3814ae67e24af18b35277f98

SHA1
dbbc881429601e800a51d4d4a067f6aa879db873

SHA256
4d05218d74a4d99adee3f32bc5e7344443b74e7129ee7cb1280ff8bfb477dfa2

SHA512
25df861584fdafb4b3bf6bcb334c0429f92b870cb90ed99a5bc1e8c25150c939b72424cbd185a92480ca4e050b92b2f7754b20922e17fb27d4f2bce5ccdef799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af56dc37f3a32a540e9157ae185b430a

SHA1
fcb188ff577a9e7367e394ae1a7e621197d62628

SHA256
e146b3c60badb0cdebb943cf6897e1e3e6645e3caa628607f152395d02c48cb7

SHA512
4a313e58a12e04f9fff2c49d4b45cd7c44c763b4bab25118b947280db580a8f9ee1fe2e3c9d0870e1fd6d2e3bfb243853a323b09a56882ea53df7192393e1de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b36c7f18bf7850786390ea856a3fade9

SHA1
2cd357c47387e4212c3e96c386e46807ea229a14

SHA256
e90a50440fa695b1549ff1cae9b3a5a84d065d73c8122a390f271823adec6cd5

SHA512
f0d06c6e7d253ea540b69304efb1f8276adbbfba299490ef15151b7e4ed0a37e4ef63d8df08f2bade198f6c4e719b130892622eb260e7e1cb76b6a76bb82a4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb5306fb2db0a3183a02b4fc337a56dc

SHA1
143549240f3b377be735269f10c851413dfc9acb

SHA256
23c74dd9f3ac763e42a6166403412fcdee34296b300ed09bc4112247b641afce

SHA512
f1455f2a1ec1f65dc5e32db1267d66b7cfe83a3eccef3353ba091240bc82d17a41d9153f7b4780c3a9b8c0cb88ec92d2c0e2c7dde33a66e07ed85e4128f5ac96

Download Submit
C:\Users\Admin\AppData\Roaming\{e0262aac-97dd-48a2-9329-f743a3f45e2e}\LaunchTM.exe

Filesize
255KB

MD5
f5971632b14a3bcf0b1ca5790b538e32

SHA1
a3c6dcc0e1607638bcdf6b117c5884d616ec7569

SHA256
8f5de2381c9addb0304ae920b04e3d6ab83222f4da5bf60b538a1a71fa624e45

SHA512
de5d1da02b68c0ec8c3d45d0e4fddbb953f3f6799a76afa58a1eb7714b32223cb256e676b4b54c959a54163281e39a19abc37bd3f539aaa4c552252a16a44599

Download Submit
C:\Users\Admin\Downloads\GoldenEye.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 817694.crdownload

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads