hxxp://9mod[.]com

Analysis

max time kernel
215s
max time network
217s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
25/03/2025, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://9mod.com

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
182	4500	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_550792412\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_550792412\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_550792412\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_550792412\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_550792412\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873740512445271"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-73851796-4078923053-1419757224-1000\{A2479F85-7305-477B-A8C3-AE1B97C9F3EA}	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3128	1784	msedge.exe	82
PID 1784 wrote to memory of 3128	1784	msedge.exe	82
PID 1784 wrote to memory of 4500	1784	msedge.exe	83
PID 1784 wrote to memory of 4500	1784	msedge.exe	83
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 5952	1784	msedge.exe	85
PID 1784 wrote to memory of 3768	1784	msedge.exe	84
PID 1784 wrote to memory of 3768	1784	msedge.exe	84
PID 1784 wrote to memory of 3768	1784	msedge.exe	84
PID 1784 wrote to memory of 3768	1784	msedge.exe	84
PID 1784 wrote to memory of 3768	1784	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://9mod.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7ffd8c4ff208,0x7ffd8c4ff214,0x7ffd8c4ff220
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1816,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2496,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3416,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3424,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5052,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6176,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3912,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4992,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4908,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4892,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6876,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7272,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7096,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7436,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7452,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7428,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7556,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7536,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5092,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5448,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7656,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7620,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7124,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7028,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,13347693477666536435,11245305686192528026,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4372

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2116

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aad9ef568b38aa2ab42b57a3cbd8d8eb

SHA1
efe601b188069ca6b54ba6bd63866687c5574780

SHA256
ef0ca3af55b0eb83ea83d3376038feecaef97236df7c556f821c93bd08e86a9a

SHA512
5a3e66a1f995ed2779c7260787a2688118406190312d31e7a77bbfef233d81bbc17dd1bbf77a08ba73e390e22dd973c173b5eb39851b359a9196f48bb6fea963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
202402ef878b612e429841cfe6a6888e

SHA1
267e8879e3b08fdb72d33918eeb06f051a24b78f

SHA256
93f0e44f96ce7e9c0ccc414ec6a007244f5d1193537f90c604641688eba01ab8

SHA512
039e562fe28e984dd83ed48e3b87fa80334af746ede3db1ba282f1ebe7dc3123418f5ac8a2f5067542ba28b97205c4cb31a80f7a70787ce25bd1e3f48475e4bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1550cbba64ee1551cba74995927befef

SHA1
af2a8aeaf7b8795d94e59995a64a7823c72c2e63

SHA256
d85402a97412d896422b2683a9f6a150a3ff3c9dda825b334a66de0410e60868

SHA512
56a7ca9e0152cc1d38c58ffa35ee1af55e8fbda1fc4d5d450947935ee30510e9366f3f553fe0836cfdb299e19b8d4f1ea92903c778173fb0ded1ff93c960e0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
858fa5353b137f45586d6cf2cbbd1b74

SHA1
9d2a343d45b2c44a6f9d97f2ab82291f28e10364

SHA256
7764dcfeaad9e04881481ee5e33313c822621d5e0acfc17c3ddc935541fc0bf0

SHA512
de39d0d02d2d6bf332c520e3d9e8c9fae0572704d1d7c87b3f9d9458df614959de083d9c45616d6c4f3bababf0273423f851d9ae2539eec80647cc636ab62254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5809a0.TMP

Filesize
3KB

MD5
b49d96f7c29ada095e0811482b6d3f72

SHA1
d9684d19661fb78fc56a1f4cdeed12946a5430ff

SHA256
2991594abbeb5560dd23234f0fad9ec07d5b9c2c98bfd460f813f9343d82269c

SHA512
2ff11e27df8f6afc6d7ed82afec6dd3cf569a3efa62ca67574a75e717c06bf6cfc3752a31eb67a917a678ed16bbf8bf4bce35dad059358071eca4dbd75abf753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
728acfbdedfdb6182ee6726f3daf7325

SHA1
3f86085353a6e77281f3fb32fe15448b3a730ec8

SHA256
d3407c6ca26054419715c102656f568952f237e3675d2bfc3cff8adfa2dd5da8

SHA512
95fca598003662360b282fe1e2aad62d30d46b41ec9b858ba8f1c7087153d3a5d68a7c719c5fb56254b242d863b327190cce096d85bbec3e6e2b50e1ff17cdd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0390b8f99286e436484b391d6921d4a3

SHA1
eadb65aedc8da822ec1725e938724588505616ec

SHA256
57758439c4d47e43d21b1034829dfa6a37b174e0ec1d04e79eede7ac94137054

SHA512
8a172f97a12739afa45ba56208f93d1392b85729b64144a989f89e295f8cfbf86e7179331040eb2b3b57ad5edf1c4f06bceb5b1457bd3484e64a66f2a77becd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
a46207e59afa6941dd887238b6e7953f

SHA1
9c84bd9e572661a69401912f6bffff1cb089493b

SHA256
ea98649f5259d2ea1cae062c3ddfcb0a2121f1064b522afd7e8bda4f922c2f05

SHA512
a95013bf11f169befb7c6b88292f11349f394eff0af9f4637062dfaa76b47df8b3ebfbfc130ff694f44bb20d280ab169217a7efa08d0d66bc759fb584946b93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
74008d52dffadbe2134b5567c05a601c

SHA1
b48de0cd1a7fca9750f7509c78a6b5c968ce5b24

SHA256
8a754d6915722eaa0eb77a0a1ecc9b56c192de3e6e2b5c15f39c465792ee7bb0

SHA512
58d5795eccfa608c4a4c5cd3a0502ee58e0ddb02f8ab921e8bf3ebc2ae1741784d344f5284d1eb4905f56655667c6c18ec47af72b0725ac0526c433f75fd5814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
76ec00a3edde47a31b24132e5bc0c3ea

SHA1
639d4cd66fe34d51ee60df53c65e32a93cde33a5

SHA256
de8b251b2e4f8a4eecc36c58797ba6afab97f2da3fe42262e600686dd413d68f

SHA512
439c75853679b27d2a4242ecb09931840298dd7a3a1011f4b866c01f3698737333d4b921dc8255f17d130139a145e1bfb87de512492c3590b60562a80275d06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
93926d1118ded4209bb6977d2f7e778d

SHA1
046641b15bfd181de3993f32c01aa3b88d270c9f

SHA256
3a1e6019521d92714d4866393873f06c170c2de063149597f7a03022028e49ca

SHA512
c9e57e7fa949d8904d38c6123d0a30a2c19ec532c12313179fad3a1afec5177c24197ef4a3d22fd1d4920c5f710b098cde9c8eae730d23783f3638cd0e011bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
4c5940bc444473277f89857d5d4e0653

SHA1
284b8ee0bbf9923a65e99d918fc0b6f9fb098765

SHA256
39b57f2dbb17bcd6ea340b91f8f10a1c66613ec2fb9e9ab7232712430a5c1e28

SHA512
f78299fefdabfe6abd41cedb617c5dec4fa361478458bcded0d97163eec15b2eceadb3a0b5947b09bcc943454f0edae196d571feae17020f42e16cb05819a8d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
0ab3ee10d1f7e1478391b383833d1562

SHA1
dccd03404e15b9693fb635d697b0d0cae56a4750

SHA256
1d9e2c45df257add82867e06490229ee3a611c814c0036f6453721e34f292732

SHA512
6008630308b37739a14ffdaf5aeac06f1010ba4613c1a9e2997792a2051628d3d1466302c4b4af5b87a263e95ca4943acac4b9cd1aaf5b9b52db81013122cc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b9e7b614b7e1037d1aad58362ab020cc

SHA1
e5ae76994e529f33f7779347fb6567771e99e3db

SHA256
0afdaf5b06e72d8f20c1d3a0bc0059d6ac283761f6bc5394c0307a4f0f93a67e

SHA512
54b5f83ffa726b8336807c37f89e797311b8833554845a88d61e0391041f93f6015a62c97ccacb0f0679602d1da1ce2774067f519e33cefdf37087eec552b2ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3d2450268f476057d9239799c768c4db

SHA1
0bca6600c621c39fa0afe24bbf9397a3c0b352a8

SHA256
b0c54994a4b48a710f6cd105f1bdf14881a11c2926ef14905d3f7dd6a61e620e

SHA512
72260c7ceafa9394cbb39ce3ba257a2648604de9cb8126b7a8179176ba260d0776084b0ab4df2f2cb5b3ca2a89128dc2e18800df4c8ed6840751edcc37aa38b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
b4725e633f19995ef8e2524ed4e91a40

SHA1
304dead29aadbf4f2188a0b6d843d5b3bab25b06

SHA256
1775329b880e216f6edf47d150a4027c528c4244478c39c901118d7df3af9070

SHA512
10e4b4a46145040c6dbca064b173cd4922d0bfd5429b347e7bd268e90b013dc29df5e27871b0411ac90085e33dcf6556c3f7ee1dadd67b9c62c7f4e4858d9246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
e5a84681afca1bc72bd1c558d0e953ad

SHA1
c236507f05206a75b634a284d5fc1ffe5f887fa9

SHA256
ed0ac7222e5688c1c428f203decca9e8cc1b539c0ae8c3f7b58538efcbf808e3

SHA512
590b674152b38db32e0bd36d7f7d2acfa3fb213ac16d39d3cdfb8bba70336628611fcdfec3bd9352fcb6b7326999702d39bea541643d609041bc183a95b24414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8fda6eccd91dd12af5b15a05f01c5371

SHA1
c7e26336ec415f423c977c8ce0f1ffb951c5da7a

SHA256
2c11d50880f5f55a4a611bd20ae089dda17915ce3d900ec47c65fc4eec5cea90

SHA512
e914706c17a6b92c05bf24ee30399ecac473e413c8c5aadf772bdcd0bff2584664e6279f69600d19d7a757bfe99671580ba53ef41744588075286bb7ef54ed2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5e21d9e770eddf56d3693d7e14c560e2

SHA1
6d8bb2a0555f44a96481f6f34909c201f1188e44

SHA256
ea03d901b22ef66e9fa5a8bd017fc5c38cc173a1a53e0aae1ac9dcca90c89246

SHA512
5af73c7f235d3397a2f8a3c3fbf9db2f88157388c52f6ebb58f1ab7a2da5bb67cfd7c517652dcf3e55868726450be37b0179a6b899ca9debeaf09d624bb90db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
9e35ee21d4c9c4f8bbc51cedc96e9d7a

SHA1
aaea13b81776898e544f0e7d81fdb1fe1df63749

SHA256
1d8434601da1446720c305dc2a628d169bb40a2db09abcd8ea88ed393d4d14ad

SHA512
c4397a44f44acf0913d7a7744852744d8555bce8fb28625420f54b44a647302d3d007d0f3b9b001a2bbb60fa5414673482ec01e1ae621a961288920122eb2584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
9473700320fbc957d2bec6d61d6ff409

SHA1
b259127ebe3e06a2fdf9e33f17d51e79ef6fa031

SHA256
e5cb4b3960af1e1263df31226303ec1e7823afa0c079ac76c65701dbf54d00a4

SHA512
616a495743db99ecf4ca8171ef1013465e25e25f473de6219bad2ec496ce2a3d2b774aaa3ba179a1d3577ecb2d1c226ca81698d3f84a7ffe0651fb743123338b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
668c686cfbbe0752c8246b03d0ebce92

SHA1
9ff54bcbd4302e5a73e087074837818287e94006

SHA256
cab71d05df8a4aa6d0c96bc1b6996b9d7a23f176dd2821a4b4064d2d4dc927f5

SHA512
34ec68ee5628cc5e549f64f82a4141669e6f1a70d4e1f7b97d66ef9b7011fb60418af0cd4782336779e14d9216fd5a9f481832d85842df97b85a4a88c58dbb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
7b9372e966c1f42aec75ea91aa879a2c

SHA1
4c4cfad44902affe5b1346400fb3c90d31595e55

SHA256
8a959ed34c98939d0ac9fdb438c93717bdb96908b8102585576cfa64c5e2af86

SHA512
6adb8f619a889a07de903ef0c4f82819a0f9e2ced4bc66ee64a047d3c9a1072b4c81c3d54bec91b577c9bd0309fbdd6f8decda966bacd7ff628c2b675d3f0778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b1abbc4600a37a713c43f63242808016

SHA1
1ecf638027635154e3a644db219dc5c86bfffc97

SHA256
7857d54c0a3fd61cc32cb828fc71cbab90351fca03b1701b97efc6cf2a40e008

SHA512
a7e4a36f617c674d5044f84409e421221a4a8e3c494db3f72321d2ee922558f946a2b3305653f4e4cdb6594b5139d4edbc1ef845433ffb38f461fe38c2c100ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
36cb1614dee2754a124c75e2760e7ad9

SHA1
75963f647fa042133e9df17cc1115341afbe053a

SHA256
38ba4b662cf3b63bbf1246a4b2b009f962aa5471ed7957c2958dd9e2327b12b1

SHA512
11ba1f36ebadd862dbbff90b0ec0f753eca309a2372170a82c304a9be38ae63d158989a1099ab60f0388cc263a1db42c7163fb2e7c02f5aa5d26c15ccd368354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57bb41.TMP

Filesize
392B

MD5
95c0f774d419ca4c051b55bbce47af4b

SHA1
61a3904387f3757db1b33b1399253ba5d9deb761

SHA256
12c77414b26b26bfa68ba9a49491c8b9ea2e7b64475a5c0eb5abb1825851935e

SHA512
334aa1cda24ca4ccad7145bb110006d02a84d4c8cd6bcacabc418d9eccf4cfb05e302358f21acf280860300314e9d3b63038c05462a8aa7019a505689d992d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
60bd02f4ce8352744dcaba7c5db8ca60

SHA1
e25c50067fb67a48bacb2ab1ece79ac8528f4391

SHA256
e22fa93077a6bbcb5cc2be5db0ca454da958d827f63e757c828273b0a9298e24

SHA512
a838e15ee11deafeb99071337542981f21c1bd9b60b2d914ee0d2c518c24917c527378f85c3df009d12562cacca959f0508e503a16103320176873dd229af87e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads