hxxps://www[.]r[.]oblox[.]com[.]co/users/479556822/profile

Resubmissions

14/03/2025, 03:55

250314-ehay1avmw3 10

14/03/2025, 03:50

250314-ed4qhssscs 10

Analysis

max time kernel
103s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2025, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.r.oblox.com.co/users/479556822/profile

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_1898209988\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_1898209988\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_1898209988\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{154B0FE6-EAE1-4C2A-B00F-5A600AF9545F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5580 wrote to memory of 5812	5580	msedge.exe	81
PID 5580 wrote to memory of 5812	5580	msedge.exe	81
PID 5580 wrote to memory of 5176	5580	msedge.exe	83
PID 5580 wrote to memory of 5176	5580	msedge.exe	83
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 5264	5580	msedge.exe	84
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85
PID 5580 wrote to memory of 3648	5580	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.r.oblox.com.co/users/479556822/profile
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff8450ff208,0x7ff8450ff214,0x7ff8450ff220
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2296,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2344,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4640,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5080,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5276,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5336,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6604,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,15769719506021674538,12612870323752491397,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5580_515680410\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19a55135-1a19-463e-af17-df72ceb77332.tmp

Filesize
16KB

MD5
d52e3afe6fd34b37a28f3314a7ed13fd

SHA1
2a713133e024b71b9c4407d62d40fd664677fb83

SHA256
78f1217464f5caca19fbb768a743d681227deced67252821ce0a1347513363f6

SHA512
a0e1f43f1e3cb269bc22c2b1d3fc6d088ef8a74a216b42046ffc5a1b06320a3d9dc2f82deb52bef1f87d9d790ccf5c866db20c585cf1fae5ec9f1acbc9bb3208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
560b2a56a066668476b67651c3f668a5

SHA1
39b02b99df62156e3818fc53720653bb514edada

SHA256
e9359bdca9604f48e37b66587c32fdc892528f1de6138c06101593614107a500

SHA512
56a973396945ddbd44bd47822018b9bd117c89c08cd5cb0a19a249b3ca671b8dc9322522e058e2e3be636278e04605863ab20aefc578606d090c5748aec1e052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ed3e.TMP

Filesize
3KB

MD5
1356b7d5e52ce3a20b431edb97e53b61

SHA1
ccdaa64e73c0a887dc8bf41bcea115d25793a781

SHA256
dc8397b420e90507e5eccfaeca2a2ac181eb0a332288a6873133f4f4ae282e13

SHA512
74e630e922d2b3c771e8004c2e8f3ebd2904e0e862524a1b55ed8bafa746c62be81911dee8a98b77ea5fb30d6daf3c3d3ad725dca4497a5637ac6bcf50fb9c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.r.oblox.com.co_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
12426a8975e93fdbb31bca521097f89a

SHA1
8314c3da116423c322193fca5dfa159343f55840

SHA256
71b1697cf9dae29cbe72757ebe984d765407823f6438fc306578b325afaad873

SHA512
12c6c2ef9dbb036ee2fdc597d0cc4d0d9896280257713e9e56888ec6bdf264e35ab545d3d647db2291e0d4a04d94c51768f94dd5d99f419d49b5cfd42d6e2cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3ef44842c67c9b78b0a49b8f7be2ea50

SHA1
8d38b2d7916e7ab809391144b1a41cc605120e24

SHA256
b82d5c012670881d515eaba659b000cbb0922d6bd91bfb12944f8c9275f2e21d

SHA512
9d79fab7b3eca0a2ce6b72aa90ba991bb9a00cd5054138b5336b921043f2725da54dc614c44ccfeb6bc880cd190a8cbb3e66927f1a07ac711339667cc798061b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
931e6db4f7d3eed3715471265e6e8e04

SHA1
6413d5a4b672f6ee387f225fcd652ef3b0bc2922

SHA256
cd07325f3cc8d148bc3342d66190df37fe50b8e5b4386a835b07543c32cfd9c4

SHA512
e1524d59a00a101dd72c929e25e6535ff387086242117d61ae85a62edbacf222824b168a3d7ba12eb009e999780095fe1abc6210dfee6721fd70c9b938c09670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
106054f8c6131ba125d556c1bdddcd95

SHA1
2ed1f612d82224d8285231e4c4206d68de398792

SHA256
2b5ee0cb06656e52e83165a962a1f786cd187a21063c1814fa5232fa48f91c8a

SHA512
b8652f5a67e6eefb0ee8e717cf8f742e34bdc0bff674fce49f8221c00ba87219c1556a9e0d193132be991c35a5697c75cf31b5472b8a145dbd3dc616f16354ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
4296ec449f413fb6a2345524a229092b

SHA1
07cb276add1980b522853f3452f14da3862ebc97

SHA256
52e55cf69267d2888ae7d2bc479ff1f10d08b16a26a4ecc10ea81c0ee13cfc79

SHA512
47f7d44bf7fb15736a7c2a6cbf24ea78bd603d017cc0b32decc2d6685c9d5c718d5270cd55713114e043166c7efbf8714d224a883b54b7dc6cce57bf983bc5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ce6c.TMP

Filesize
72B

MD5
044f79a93b956dedee525298477914c0

SHA1
90f3e57565aa73523fe83f9f1a2c0c3e8ec9860b

SHA256
4ad1cb6660d47f4f77fc64b2c98a071b72d9545d901114edb6aecc8ad407a8b6

SHA512
74526db12205ac23438c7def05f3f7fcf123cdfa0ee3327ec207207655f69b0823531d328cc84bf825cfd274d8147d7db049aaced3d99abc8e3ffba3abc99415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b32848ce60047519069227b309df52dd

SHA1
136ee923c96e330e4a1c130d9e986c7442cecfda

SHA256
5b56c8415645f15c96999100dc49c5783f513840f4f0b8ac02b465217acbc313

SHA512
937995338efc7c1abb2afeabb3dc843c4dfa5d2816e6fc356ede0b64421077ebb7f9eba6ee37478944a2faf21a3d3ac7649651db566a05635fd40a125772eeb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
462B

MD5
642611cac0e8d4b04c2ba1e4aa791136

SHA1
846041c93293af69a6eb51546bf4f2a32237c531

SHA256
8f11b666878c191c939edcdea144ef1269c62096ddd0ead39664abb8fdc69a87

SHA512
6bd9026b3c5c1e3fb3587f6944ebb6cd925eb97067e7837409fa54f9886908fc150e0cb424afa2ada68430bbf25f516de57d7d39423f31a83551a8c5a9b09d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
05fe24a0f429a0b8f7522146c19dc773

SHA1
b21f1c05163ff0fe9d9d329327c550533cf60a0e

SHA256
82ad6703efc179afe730d4d7b93a1cb67efb0ebdab6b0da772000dfc0dcccf42

SHA512
f248ff7eae7f5843bd8e7ed690b50603ebadcf32a0c7e76c141738935a15a085447e654efd8f114a43b5eae8bb6ff4453c5b28af9d1d8de53a3749b1f305b51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
503f0a3d98e9a749409ee7171afb533a

SHA1
40045e8cad287808491cd6ce466d66dd0c4a738b

SHA256
0d0fdea625e51627da45a615185dab21697549a70552e29499fa2a455da6729a

SHA512
e8f0cf0e5c81a5339a43ac945c4f114fd02fd7e82c7b074d37a165ef608c19717945f1a56eaba568a6a0adfa88cad234479779a692bf49775284daf7e844a172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
12d9c8901f4d5b11da269371575e456d

SHA1
e555e4827677fc79052c06d85378c65fca20728d

SHA256
5f87171db80041d0b9f61bfe0aa6bb5404b62b4d35ea1b280fde05730f7d81f1

SHA512
76c16f0e15d02819e9165140b834d973ac2733184e69934b9d58dc71f1c59e6ca593c3861b3c246b5cafc06141ea0ced1ff805b1a9bc483a406cf567d7c53c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
01f7dfa5b950553496471ef11623bfa3

SHA1
3bb16b302668c44786a36ce22058c6cae3dd03ce

SHA256
a04a1545aec8657db6a50bf8fad981da581726bd3a044e768f19573f3ec70b78

SHA512
1042164b80686ee6885608ec589e4e230f82ac0bdc2adb61d3cb63132c1dafc75c3364c9a87e9e59f306a98f95c0ba228fb4013a92152a97c1017bc6a1ed7f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads