hxxps://www[.]mediafire[.]com/file/ba5y8bgbg4yyogb/Infected[.]rar/file

Resubmissions

26/03/2025, 04:06

250326-ephmesxtct4

12/03/2024, 15:53

240312-tb3srsfa6410

Analysis

max time kernel
144s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/ba5y8bgbg4yyogb/Infected.rar/file
Sample250326-ephmesxtct

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_2133280347\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_2133280347\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1577650226\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1577650226\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_2133280347\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1577650226\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874356193805844"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{92538BBF-4347-490B-862D-456E00E6CC17}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 3684	6140	msedge.exe	85
PID 6140 wrote to memory of 3684	6140	msedge.exe	85
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 5296	6140	msedge.exe	86
PID 6140 wrote to memory of 5296	6140	msedge.exe	86
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 228	6140	msedge.exe	87
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88
PID 6140 wrote to memory of 1796	6140	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/ba5y8bgbg4yyogb/Infected.rar/file
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffcb0fef208,0x7ffcb0fef214,0x7ffcb0fef220
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2432,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5580,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3508,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3652,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3504,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5744,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,130901175797978422,9886811301987952430,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:8
  2⤵
  PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1577650226\manifest.json
Size 118B
SHA256 1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96
MD5 3004ab7c9e3747e5109246e7f6b3859b
SHA1 ac4c574c03611b8bc675e878a1be8124bc32fb48
SHA512 f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1579963866\manifest.json
Size 79B
SHA256 530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
MD5 7f4b594a35d631af0e37fea02df71e72
SHA1 f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA512 bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6140_1911796052\manifest.json
Size 85B
SHA256 db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
MD5 c3419069a1c30140b77045aba38f12cf
SHA1 11920f0c1e55cadc7d2893d1eebb268b3459762a
SHA512 c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6140_2133280347\manifest.json
Size 53B
SHA256 94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88
MD5 22b68a088a69906d96dc6d47246880d2
SHA1 06491f3fd9c4903ac64980f8d655b79082545f82
SHA512 8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d
MD5 65044109d1beb8ed8d59560642cbc519
SHA1 0084485b0aa26069232fab51ee603682e8edfd17
SHA512 96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6
MD5 SHA1 SHA512

Submit Download

322e31bb-c077-40b3-a001-5e891370944e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\322e31bb-c077-40b3-a001-5e891370944e.tmp
Size 16KB
SHA256 790b08ac8750e0cd7bef9d0a3d2d21b5e83213e094833cc4b0910574a70de599
MD5 86a1a1b24a34b2a11de7c2727137b56b
SHA1 3726086c237ad642b9f94af187de849ecfe2aa24
SHA512 ae1ea7cc81afc05dc2b05f36122e8a14d5d0c1b2e20eb92538bc35de70994dedafc8d6b0c96dfa01fac29b88f246643c6033b7d78818ec6ba9a71a21af879d0a
SSDEEP 192:sVvIRbyMqv/Ky0Ml8UQp7rsTcwlwA7pJ9Ov1ZMbUzoZ8pKHY+WNGRwtyKXwa76SB:sVvIGLqBrs4oT7pJa1ZMbyKHSwwtHdAk
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2511f3b3c40e9fb92da2f652f9d21d7b48f8612ac437ff868d5a15d300120fd2
MD5 bc9cf4abf7cee2d06306e1deb675a5ed
SHA1 368f4f9c13b21dff5889cea36aa03db7c7851ec0
SHA512 5be0d0011d47e47435f1953cad2a8ce96f9b3129f063e4402bae6ed363f99689b41c3d3b953dc12994088b34e9858465083a2d92f0553c85a2f0b22b3f2887ab
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57e89b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e89b.TMP
Size 3KB
SHA256 e05c223dbb40a8e99b1fd4c1d9f09be8de8d36af8130251ec2e7c6dd7a5bb21a
MD5 542e667a275650db108db51d1afe377c
SHA1 79fd39bbc3b9f350a29bca8dfb51301af60ef0cc
SHA512 e5bdba97b4c9603b0d1d40c714d9d933d52d7020504b7a0e0c42901b32188af5d0d693153e9130e006304e835b19d95d2172d0f157b25a4b3d748081abd80ae9
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
MD5 40e2018187b61af5be8caf035fb72882
SHA1 72a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA512 a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
SSDEEP 1536:IRWH74CshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHNdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4f390fae70d177b5b057e9b8e4573c8d86cc6fecffa8847d48a8ba44210dacaf
MD5 6e5ffa095d1f39c2e32f8cec48d819a5
SHA1 1517da4d0c5ec39391ad84737e52898e26c3590f
SHA512 4485ac0a00b6f0100d2a14d33e25a764d3403ea4c800e6cbf0f033e9aeb573e1ec9223eaa1f286aa483cb1598cea2fe46c2967d8a9fa07f01ee6a78807e91dfa
SSDEEP 96:4D2keUsffZIz8LVKU4BkBj6cA216AvfAXfApkIsAUz:4D2csfhIz8ZKUcAj6cTY6fEfik5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7a4864a9ab3782c009f1d0f897026b32b63eee59e45090b41f1791ec1f567cd6
MD5 1c8b9f8e4940f52fc3f991c6d3b59f85
SHA1 4b4e5ab33d27b631217031de89cc295982476b6c
SHA512 b7d32a771841da88d8633326d5217a1e77547fb4a7238c4693a2771ec3f62faf76a29b2fb050a513eef1a1fa8624dcaf6bd4fa1611a2700853feef76cc358f3f
SSDEEP 192:sVvIRbyMqv/Ky0Ml8M7rsTcwlwAKpJ9Ov1ZMbUzoZ8pKHY+WNGRwtyKXw+76ScII:sVvIGLjrs4oTKpJa1ZMbyKHSwwtHnAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 341a3f4e10eaf43474db9aa6a88919eb91d0e4428fffb02ef4f3cdf562c17d00
MD5 ff6db5a8f04e2d3c3621d8279ccab076
SHA1 bdc8255ce6fb45104c8dbbe9ea871536dc85ae7c
SHA512 9317bf40c66aef45e447cb88e0cdf8e896370129a9e8954f47ffff9e096b9020d1360c48f477e276e60c0c2a8222781e9104a33ec8817f0efd32f53e542ddde1
SSDEEP 768:9gVYCDU7pLuLxFjWFzNfJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjY43U6LlUWD+yt:9gVYCDYExFjWFzNfJu1jaUx3U6LWk+p+
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 5da498182416ac467d8b4d8dd377996365211aa537dd4659eefeed6df6474f3d
MD5 5a6a73d05a25886d7f4505bf27abf3e6
SHA1 3eca7ba647bec17114b813ded919335c8a6e54e5
SHA512 cf1f42b2104ddc30d0b41dcd5ae2e4cebababa8c9c4157651c5b73966203040d2aa2ef530b6bbc86ac406a7dd456099dbe134428ba68ef495bba5d0d4d63e9f1
SSDEEP 96:tnKn24KwrKfuWKF67WKAkQgEsBWSgKKkYSx4VatumKyyKBGAKcSKRyRKNIKxWWKy:Gyz1hVdShY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt
Size 113KB
SHA256 95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985
MD5 60beb7140ed66301648ef420cbaad02d
SHA1 7fac669b6758bb7b8e96e92a53569cf4360ab1aa
SHA512 6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5
SSDEEP 3072:WOmkTNO7NHrMziBxfPURO+/bAipYbzV08unFZUUnaR5K:W7kMRIziBxfPe/sipYbRJkHXaRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 465B
SHA256 dbeaaea34b976b432eeb74166c8687a9ce5cb0ff88c35ba9c70068de77663f18
MD5 d4806b03ea849e815e3efa5d249eb569
SHA1 5089dc19d647f874a949f015f035c0cc7b621807
SHA512 7451bcdf7dccd65e3ba95282b08139c4308d2a050ca462f76551ee6703eb5dcbb63f95fbebd321ba24c2961567f79d3e129ea5a775d87346d01c5a5b78efd806
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 23KB
SHA256 dcc909a13677318a9791fd6f6b78701ed55d9ce9abf6627f855aaa78e7d2d2b6
MD5 d2d8c2aa8c19d51471a260e0ecc353bb
SHA1 f5203c9978fe37b7603d5480b5c9ee07e33bdf1d
SHA512 49ca96599264a6ac93004b4f613cf22ede040b56976867baf35577703dd9ef4e6285568a46df4184aa110167fcdc0588c75c968a55b499d7acef3f5ace8d7905
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/44+hkmb56PQpGMgSVlkFIum1z4tfLTvq/uM:OJOk/FY7/2lagbCtCkQ7wDlH/H+umb5V
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 896B
SHA256 a2d9a07467b4c2d42dc5b6c54333c743e6f651046b844416687b6b090afc794a
MD5 c5d1f2fd78db0da5598a8388f50e1a6b
SHA1 4e681cf41fcfc624ea06881c333e1b8e53443024
SHA512 1c50c6c337ec3fae19377bd8feb93e4b0452d4b019b057bb9111aecc22cca08db9f4316c62f3c08d57b377d62e49f01d49b31694a7c101f8d2ba5006ebc8e002
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 19KB
SHA256 16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
MD5 41c1930548d8b99ff1dbb64ba7fecb3d
SHA1 d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA512 a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+eW6PQpGMgSVlkFIum1z4tfLTvq/uIvqV:WJOk/FY7/2lagbCtCkQ7wDlH/h+eW6PH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 2114aa14f3322ded0799142d50cc3faf068a1836b0e00ad539a366cde054f709
MD5 ae741941362a42eabfcf08736439ef78
SHA1 77296c3db685798d7bfd3a225b837235a36d13ae
SHA512 d4599a6d6f10c2eb5c4e463064c34f2a70f62f6c8b85198d0eb77027c7435a86e854f182019a6719cbd0113cd89bd9e15f872eee512050e082da5c583906a792
SSDEEP 768:AliE6esE8lDldUGdubgJ4WrEjj6O01GWLNv4vV8JNSRbTrwUQrp6JQL2e976Jofg:9eB85dFFiXo6V8JNgLCp6JuT95g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 f61ad43050945b26e94fa0b19f00ecda60f5d96e4165c9d31e4ef944e8cb6f98
MD5 77e7dc7aee8d5b4118f83e42e941e512
SHA1 be4a720be2b417cb730dcfb28a1455c69b74ed51
SHA512 b0c4c487b6989743ac8f0ef76cf64f8262e7ff5471209d9ec1f035c957dc29ae35d36f68cfd96199814629785e163325bee556be9ccaa7f4bc7b7cdaa547a000
SSDEEP 768:FniE6esE8lDldUGjuUgJ4WrEjj6O01qYLNv4vV8JNSRbTrwUQrp6JQL2e976Jofg:WeB85db2iz26V8JNgLCp6JuT95g
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Size 6KB
SHA256 fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
MD5 bef4f9f856321c6dccb47a61f605e823
SHA1 8e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA512 bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
SSDEEP 96:UXq6pG2GE+Vy2+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbVKm4lOvMwkoR9PuGs3gy
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb
Size 628KB
SHA256 5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7
MD5 c26015b2460d1acf6859aad730dc8f4a
SHA1 9c772753b62eaf995e39ea5ce1ef86454b58f169
SHA512 ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2
SSDEEP 6144:aManFpo7A+wlMKsGxqx8noFC6Y6dFT6BQ7up:1IFpoULOGIxpFOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

da2a210e-fcbd-49c3-8a3b-9f7fd1261a76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da2a210e-fcbd-49c3-8a3b-9f7fd1261a76.tmp
Size 40KB
SHA256 903fcc744e0a3103c25d25370b1db4fa423c75cd2994e4d402f31e7f062ad7b4
MD5 ab2981219c33b75093f2f4d75c90b984
SHA1 022af09a67ef73a1a2f5c09ac014e50a4d9021b7
SHA512 41e544229ec48a7726ed952dd291632f63ad201877a2155c5b7b720e2b1ad12cd84bc3ec9dc8d3841b31225b8fdb9e59610187f5ca931ce96805fb7cd24a198d
SSDEEP 768:jliE6esE8lDldUGz3rbgFfWrEjj6GNzNK4KJ49+UL2e976JofNrp6qt:SeB85d73baS4KXST95Bp6qt
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 01b12eeb4cdb0634e2766d90abf90d68c3a9f5f6c8ee4d94bea62665f2f020e1
MD5 679f22759787bc947152b50a9867df09
SHA1 85141c527fe83016a864598a8dce7c8fff1209f1
SHA512 1f958720a23afdb322ff164646b00b4eb8e858f9176b55423a142c20da84a032cb460eef2dd52dd43242d1b9045fa3646c66e0990673889bb8beb6312e311621
MD5 SHA1 SHA512

Submit Download