hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

19/03/2025, 11:12

250319-na9xssvzdy 10

19/03/2025, 11:09

250319-m9fybsyry7 8

Analysis

max time kernel
157s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2025, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_267262760\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_267262760\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1037053681\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1037053681\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1037053681\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_267262760\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1572	taskkill.exe
1532	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868561957249745"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{020AEB45-0801-438C-B6B8-BCF8D3F47B2F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: 33	4388	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4388	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5276	3672	msedge.exe	78
PID 3672 wrote to memory of 5276	3672	msedge.exe	78
PID 3672 wrote to memory of 4216	3672	msedge.exe	80
PID 3672 wrote to memory of 4216	3672	msedge.exe	80
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4088	3672	msedge.exe	79
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81
PID 3672 wrote to memory of 4260	3672	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7fffbc8af208,0x7fffbc8af214,0x7fffbc8af220
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2340,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2384,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3380,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5972,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5964,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4904,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5184,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5832,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3512,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=5160,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2032,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4080,i,3376594942654244788,3708197641369922855,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2252

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe"
1⤵
PID:2424
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1532

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\953edd56-4a66-458d-903e-d0170b13db44.tmp

Filesize
41KB

MD5
7b30589b2bf8e29fbca56310ddd5938f

SHA1
1c0cd7f3e6a2a24e02b9bdf806efc3dc549dc1b6

SHA256
c622a7b79b72cad96bc9a7c773f5d0e53e15334e518c360d28b3778f04fbc6f1

SHA512
edd02dfa23fa04ef01e858617b2140a445d9b79797ee996648d83e269d5373bdaf6dc32a4c99990b42053ab8116705d40973cc6f1fe8fe396bdda0e457cc3547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c0901e552868c663427a60506243327d

SHA1
fb9e74c5c75c9d08b36ed7bc5fc7b9a634618f40

SHA256
24135c538fd1a925eca9342e8b107f39bd85a9232eaa0e835e004a5731017efc

SHA512
ee4247a544bc1a65d80e8320d2894c9ce6e3d5eb1ead22999b1c2266b489a44a0a03b8c5795d0bcd66e49658c44ff2afce85fbcc82daabcf9fd1328514b4dc54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3b0f6b0cc455424e2d795c4c56eeedec

SHA1
0106e5fcfa2ee3eaaa14858cf39e742bf752a134

SHA256
e8e886713f5599ff8b1253e8d765dff71c540e90a15751751c2713779f6ddb5d

SHA512
61ffa39c2917b6e9956f9694e5f2adbb6e61a86cc819278804f81ba5457135a80a6c116068ba40c2ed7a32b2c05eb3c6139d33db31dc8b9b5f6d6d95ce03e953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ed6d.TMP

Filesize
3KB

MD5
bb27770cd55d965c3aa7af87c88ecd90

SHA1
7dcc95a1ccdade86a45e1e028258874efb7b4581

SHA256
d6019bf81098e8ce990b6cf0e86c3a1123712c9f1ce849ea2b339fd205811633

SHA512
57a5bc0c4baff92dda190e5eaf8644cb5afbaad14eb2d80b88d7c88fecfe4a105ead8c115545c70352d93b30329598772b31998ec91a1237219faeffdb8a3f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
edaa78d2bd1b79b9358bcfa2e897e3a4

SHA1
4fa59766d4916221f24c31fa48563ab5f2bc21b1

SHA256
96e725b40200908b09f6c568f543e4268828e63c4964c706ce063623084ac6ed

SHA512
f184e18fc20f84a19767cbd236db81117b6bcde3ac022c9861341a3d0fb2b769adbdb8bd8b562be6fbd7e39bd2bd2915d2889740617f89511b08890e0fc36085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
43a2ea03c50b258800a011babc5b80ec

SHA1
b0f6504bd846110a2fa96dd3f110121e3ba325b3

SHA256
b888d359e17edf86de7bccf9c544b69c6ecaf25363d288cdcb4b89e639178ebc

SHA512
88f1bdec8a42eed8f21bd3a42e3a07ee880919f5a534029651cc589aefde9b6d95585be74dcf2a11e3784afd6c8270b4685f02f6c76b4e32b94c5defa46e34c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
49c9236e3e733ebf08b25bc91b7ad3af

SHA1
7737bff59ca267cd293521bc5a5a9fa9d077cdfc

SHA256
2cdf1a8f9190698c3a5956c11db3aad1fa5dace81638f7858947f3f2ed761ea6

SHA512
7c3939c6e13adc523229d571a27bd1e6b23a5f8b3cc255556d9739349d8f9153e31b3bea540c944c54c107dc2a205da825eaf707a1bdab9b0fa721efd81ce53a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
2a97154d51d8fe1432b4e21fc85a59ea

SHA1
26977ea764c7a13b3c8498dd153b81dad72b3641

SHA256
e63dfe4397228c446b6b0b26906fc82ac2868da7c1638bd990b4b3b5ec48a96d

SHA512
b56c6aee1b8e8bf14ef00518b1aea337939b63e2c60ce05961be3f16814ae57e36a3367d72a57a0f889eba54d396dabf12dceaeb61a2b667f0084d67595cfefc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
c80689f0e5900d2de2d741f289fa54f1

SHA1
51739e8703f5d5b39041364162b3d760fbf2011a

SHA256
376e3b19b16348a7d9c14499ccfb005e5a46d83207fc5cb4041ed8de869b86f4

SHA512
16972df7c67fb356ac194c9c023d7793a7aa72b15792648221f3c5a785b9e6da98440c5d19594d246433aeff6a8d46b7d7f15f8453e3763ef2d891a9d20bd966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f8a138a12c3e6999122f6725c14f76e6

SHA1
34a9bff5925efccf2b5212ab3d8140dc8183ec1a

SHA256
4669c0c01a2252bdf7d92e3eba2613f876e400878226aa2eccbce9610e4155d5

SHA512
b659a6d5d100be4580a2f1cf58974b37495029c9c04b2ccfd6fb0d5bbdf592c765b7e4e91340422dc61cc56609bf2624c260c37de318ff21c9ef54f67a56f4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
84da9743d9f2dbe5ecd8971327bf54cc

SHA1
6eec55c72766bdf62db87b1023eb07272d11063f

SHA256
c45a1f29092966ad79ed54c36a8d1c6ea79dcc393c75de4130c43d5426494fef

SHA512
3897aa9dc2e8b244e44b07c7fd2ede54c7099cf77175e55b690af1c619c5c003fa5af77661f72a19afa55fe7929b689a2341385f9ce60922789464e8226976fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0506c074-6804-4246-ade3-86bf4a990a19\index-dir\the-real-index

Filesize
72B

MD5
624fdb5cc8a3e1f6f970a45778e6ad51

SHA1
defa197ebda4a73b9a236dccb7f3cdc8d2b77c21

SHA256
47d8731b11f02fffb95b877bf85bef9677cb52f496ce477ea1cf96ce06c02455

SHA512
8473f869de04389ef72a826e3cbf0da23f33b1b4bf25ec1d5447329f7370fb4890cefd425eb0d28fbcc92daad7e58d179c53aaddbc77c1142d9195012d5bf2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0506c074-6804-4246-ade3-86bf4a990a19\index-dir\the-real-index~RFe58aaa3.TMP

Filesize
48B

MD5
e621c00710da65c9fb7f60d60eff6c49

SHA1
777a3ca1c772b5556dcea1e382176452515e23ed

SHA256
e649dcfe4f4f8cd1d307dc24e1ae6bb89307132d1d88ba6b538e84534bcecdc9

SHA512
f2d16f210cdb6cee037585499e185f11251ebd43b2a06a6cbbcd1e44486de81ed5d85092ac2cfe151ac84d1d26178a9f0967240cccbcc08ba8693a1170be4333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7b3d8453-9a68-43c0-a152-567f9ecefa74\index-dir\the-real-index

Filesize
72B

MD5
89df10c2e45aa46ce78c1e348d4349e3

SHA1
dbc0c41ee0ef749146e816b6b67ae7a964c22c0d

SHA256
7e34b3766cc7b73f23e6ce4d3789a9469560be282b597c3d58e1d8548c4acdb7

SHA512
470b3102af9d9f383e4f51f2ecd6543e38e3441efacd4f360ba8b7df8a28fbfd196e68c8a7be4f0fecd4bf2fad5ce9298cf9d942f1b123edbee80d2529639970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9b15c52b-06bb-4033-b874-cbecbf92a6fc\index-dir\the-real-index

Filesize
72B

MD5
606486de0f532477ea0175ac4c50b51f

SHA1
19dab79beea92c642aac7e942f832fcc63838251

SHA256
4c31105fce74ad8d94cdc6c1babb16ac5076a951603700144b5e967c3046330e

SHA512
793ce0ba2be037dab53ec7db40dacf48defc8fc82bbdada04fb3f656274bc18e4d69cd22ce103d5daa87b7722eff1ac6585afcc7c4afc5d749010dc032c83e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9b15c52b-06bb-4033-b874-cbecbf92a6fc\index-dir\the-real-index

Filesize
72B

MD5
200850807fb8da6cca3984e0a6708b1a

SHA1
21a36f08013ac5932c7cec967dc6b84a477dd15c

SHA256
2a5d886b22c6ee04312156d7309f4004a46ec75d89eca008714406a9ecc1800d

SHA512
150623530afa83b83c4ae0d94a73993e4aa9b604f4db5280246fcad017bc106ff014ab8d6e8b5773d850c205aed717499a17c6669fb042c4aa8d1d51e4129715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
9b8b2d1a96c43e0d8674367175e4078d

SHA1
c9c94f8d72b91a1091b5d349fdd124d8beba8e2e

SHA256
da0fb6010f38762b6014d36c774cac4e3154bd2be1ea864b4e9eeb522c7901a0

SHA512
3e10e1bfc149b852a22f833c91d35cf89ee92fcd346bc7daa26d0fd0f46a9a68085c9ae7943c08686a830677f79784206e80bf46d9c5ec80fbf6e2026e29f2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
b9656e6163fec271e98d9c8a7a7e41ff

SHA1
085919eb1bda7a1abd31c5be113cd3dcbbb48a2a

SHA256
5785aea228d87cbed6bedb6a16751aa4b7c838995144a216af9313bd4222af34

SHA512
2c181137cde3e9b7c879a6a936a2ff8dd5f7c29f7871d15ee7f30fc28f4e5bf16645b622aa22a8f2a2f68e26706859e6f7796b3097d208b3ac64623c9ab25c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe582cb8.TMP

Filesize
2KB

MD5
65b1f10156ecbb9095588df0481fafbc

SHA1
dc5dea23b0a14e1eae72f32d845fa2e7d5f0cd76

SHA256
289fbd732bcf4b459dc0210d4fa7aaff2c0707f60d12143fe6f78ceb7f1506e5

SHA512
3774e34d67f3530579f6b8c841ec79c4d0db74660145522babd55abd246cb2fed0514b86dda674f50c705cf61b125c4ce697ae69d51fbc5388f746282be7886f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
55f948353607b34c74d3d5ad6a7403bd

SHA1
02c7801b048f1d15577ff2a5226a71c6971e9bfa

SHA256
bac0591d5f9687329c37cd28bf0693d498d77f789f84eb962d8be41fad755604

SHA512
83023574ddb56add7d4ffd7b22c8866fde40e811f66a0778644a716aa224b0f72f9224b49ce5ff7f864147b391b5d75c69479a83ef3c77117c3cbb71109bab34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
d4ebb7158437604d7e38df4bbf1bd33e

SHA1
ad84787e418d03e7ecc5ec38b92887b3aee2b25f

SHA256
ca4170a5f7e2f203571eb762938e960e1bef51cc5e69349840d36401129ea77c

SHA512
c4a40709423128a57f6e1d8679f218abfbaffd3c8a6fc01ef628207e438a450ff9e4fcc5263e2ce7dd3d561404a18627590110319c3798592428848bb75d60c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c6a8db88b25dd48f93c2d7339dee2897

SHA1
e0989cee7f332f98734ca2b71dcf2a99df378871

SHA256
cea53d03feca91ddc7f7e4e0a6641cc7b8c88ececad337da5cf63cc9a7018ee1

SHA512
b6c5ee2e0aedde662eb621c242bb6ae7c1a08a9f26ccf9da10221d74ce9d2393cb608ca5cc2ffaceb37035ef7ae54a94c55c161af364be040e81e8773cd7423c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58826a.TMP

Filesize
48B

MD5
e3b558ac833610b5bc2cd0a941f13c9d

SHA1
f3997fb411034d28171aaf5243c0d7829c815dac

SHA256
40dc1771e5467c840133bc2b73ad934c57d309eaf51dc4c6f475811b4d163cfa

SHA512
296be07bf0268ee79dfa2dcaab29a46b23427b07edf70169fad425370feef00035d5244714c6b9a4fc5d5c6609805a6de4c76820c62e41c26e6e08a1e43f08e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
069cf3a1411165771ed6cb162165968c

SHA1
7ed6bb7a60130aea96f0c9579ce293f5cbc4c69c

SHA256
81e863c916cb33a96df41240dd369b817db511cb0c41686e3a6041f3d6a006ae

SHA512
19810713a4912b0f4472d14cb5324c450365ca14c269f8d33191123af85e08c06df9809f4be6a52b12eaa0b5442a54c92794eece672bdbbb2c080b4e006e4f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
a58a05177d870b949f1643a1b23db9b7

SHA1
6ee8e8222df26225cb1d4527caa195488a80f078

SHA256
7d1a5406e6e10aca469d473eddaf4b9eddaaabab8a05faef04730e483ad6c955

SHA512
79019ca3d274b778cfc8153da45c6d73ff948ea60c9899951380e51f5c847c5db342985b818ac33851ce61729dd111b2d57d2459a3a483797c7a75cad3148d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
d2330e39a69544567584d940aaf2cb40

SHA1
8689f14fd85b15522b797e3e016e45dedfd88f53

SHA256
62160cbf7e4e704b1c02a33a5958bb70017e9aaad3c9d19a8fe2cf4a530c6e69

SHA512
c579631fadb09a76bf06e7051a1ba90707d0270c94afd3124f4adf9ab2420f29ff4c69e970d8486c5de2aa0432ea1d66a63bff3667fcb08b881b78533b8414fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
c3fccaea0957836cef62c92f46c642de

SHA1
e97a12366f989156a5afa474ffee79874203bdbb

SHA256
c6bc2de4779dbdb56526fbe804dc5e92a52670b8e0d7b8c8a5c19da44bc405a3

SHA512
2c10596afcc0994245d62de69602661a078a258655a84472f40593b75d5ebe2566a53da1189df0e2a7e28cc28a73f5575eea378dabcb92eed765d808d6411eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
91c43787d37a34d84a1a7632e6ff718a

SHA1
ad289fac8173a3d2e91b2b14ccdb7781023f8266

SHA256
92e9ec802027ac313398fa777d0518e09638333c81b307daf775cb9198712004

SHA512
261177c58911d9d82116e1d184bb75c18bdbf97bee475ffedb79c4e6709d3962d43ef010d6a65da9c82d5e7e694049b8ba1cc5b7d0c0c32f7d36db857cd0bdfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
dee1156aff2c61433ea779410ed0073a

SHA1
f97fb3af17e72d8ea0aea4922c43611cc96dfeac

SHA256
af328f187d7a3ae6650fe7dabd057f0fe8842ad848683909f0bea790898ceebb

SHA512
5cfb4aee6ea201f660aed4aba520bb25263d123c2f73231113d523b6d8f6c4d65147c910c4cc3050138c3913e48f4df279b8621eedaaf8e806039ed00955d7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
5ccfa56c1363cc5535888e71fa8a6315

SHA1
b2b51e2190bebcaaef9ba55587f0634125a88b22

SHA256
18f3470593e8e1721e9f09b2cc71d674ad52873cca260d54bbaee78d7390e232

SHA512
c62cf25722d309cd27457666102803b902f39c444293e602d41addfecfad1cc24eff229583130f775dfdf8f29285ef379925da9495f329cb5a2c563e9790058b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
f6d6f6bc2a99b472b069eed7b02028be

SHA1
15e3fb2569e64ac483a84739604f751b041832b6

SHA256
517dfdbfbe0d83b3ae45eb88e6ada91efb4d634dc93f0e4c279436a8c4d9107f

SHA512
40331de5744f9b5cb8574ebf4036f92e2906003c9736e50bca06b15a9b9608838ea329f6b671bec155186dde93cbf1443a1a6e9b366d8f13d80a10c1b28ed5ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.19.1\typosquatting_list.pb

Filesize
638KB

MD5
ca87451145b7744bee71724af1feca21

SHA1
3d99f1ad97326e49ef04904db63c312bd8c64612

SHA256
d03de614aecf8590e013746de46b715605b72445a14702edbda12b5ce2db3df3

SHA512
ef4a47b30b6b03bc73e4c876111af6d08f741998308bde635427d466d4800f8764ea94462f4bd9f13d21c9eff12cc3c2b8ac13433a8cef3f7aa5bc8395c4285f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e37b7a62-0b12-496a-9351-24232ed59943.tmp

Filesize
55KB

MD5
8165864d22ab17837a1f0d9c22823a96

SHA1
9d2ff04855bc12c81fe5a8423100df737a259295

SHA256
ce66fa323eb7480a7d45250e0ffbd2980a9fe13486c8e8be8d22c19a8fe111fd

SHA512
a67ae322649b9fa8e13d380ecd39ac9a59df37997a9651508075082439d688bcba42e891c425c3cfa21a3c91487774f58e0273dede3393c11874764cb4b1d787

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1037053681\manifest.json

Filesize
118B

MD5
1c86577f2cd4d32c2a66df8ea2688d85

SHA1
35a17132f6e9fa4cf9f7cfb307870eef46b697f7

SHA256
312e962260bb133a4c811348a75396477d2bc284701393137cbdad971317578c

SHA512
ab8583a6c1e0f34f937296d12b9c045c99a8d5eb61fb36e797940cb0bd65f952eb99cfcd44c56ae45d6d14ff330bde0bfbd9cf5c18fb8296bf68a64b38ef7594

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_264521629\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_267262760\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
memory/2424-1282-0x000000001C710000-0x000000001CBDE000-memory.dmp

Filesize
4.8MB

Download
memory/2424-1283-0x000000001CD00000-0x000000001CD9C000-memory.dmp

Filesize
624KB

Download
memory/2424-1284-0x0000000001D60000-0x0000000001D68000-memory.dmp

Filesize
32KB

Download
memory/2424-1285-0x000000001CF60000-0x000000001CFAC000-memory.dmp

Filesize
304KB

Download
memory/2424-1281-0x000000001C140000-0x000000001C1E6000-memory.dmp

Filesize
664KB

Download