darkcomet | hxxps://tria[.]ge/241010-x34qxsxfql

Analysis

max time kernel
283s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/241010-x34qxsxfql

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
DNgeskLTppzX
install
true
offline_keylogger
true
persistence
true
reg_key
System32.dll

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1012915358\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\runtime.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\wallet-crypto.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-mobile-hub\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1012915358\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\app-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_550501060\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_124725846\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1012915358\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_550501060\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1828559267\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-notification\it\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133888726719359824"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3078542121-369484597-920690335-1000\{094E63C7-E69C-403A-AB42-F3002005DD6F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3388	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5232	7zG.exe
Token: 35	5232	7zG.exe
Token: SeSecurityPrivilege	5232	7zG.exe
Token: SeSecurityPrivilege	5232	7zG.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
5232	7zG.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 5164	4164	msedge.exe	82
PID 4164 wrote to memory of 5164	4164	msedge.exe	82
PID 4164 wrote to memory of 2212	4164	msedge.exe	83
PID 4164 wrote to memory of 2212	4164	msedge.exe	83
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 4344	4164	msedge.exe	84
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85
PID 4164 wrote to memory of 2260	4164	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tria.ge/241010-x34qxsxfql
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f4,0x7fff4e94f208,0x7fff4e94f214,0x7fff4e94f220
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4876,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4784,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6132,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5616,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6376,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3464,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5124,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6400,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3248,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6940,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2008,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4984,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3004,i,533788620282615400,425766191658224085,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4960

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\241010-x34qxsxfql_pw_infected\" -spe -an -ai#7zMap9185:120:7zEvent16362
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\241010-x34qxsxfql_pw_infected\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118
  2⤵
  PID:1324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1012915358\manifest.json

Filesize
116B

MD5
d20acf8558cf23f01769cf4aa61237e0

SHA1
c4b21384309b0ff177d9cd3aa4198ab327eb2993

SHA256
3493b321a7fc5e183ed6f223ae55ce962541717d0b332d16bdc7cbcadf7e6f78

SHA512
73d082cbd71f6d0f06c7afc1bf63ee41c9a8e501df3e56f21a551b2d369a0afc8306894c8e0a38d0324e2ac403ec506ac1ecd8e9b61a9cb27134a229ccb13725

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_124725846\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1701878972\manifest.json

Filesize
122B

MD5
0d77c27baa669b0714c49b73e68447ea

SHA1
65103c9707e083c5503ad9979560ba1bb7634ae4

SHA256
c853d6a286d9d31a382c6d3fb109d5336d275651950f22b8243289eb6125b516

SHA512
1f011c405ec558229a1f5e2923b38b7054144c66d4c69d658c9c2c371f6cc365317485c274cafcab80bcb88f989b0be4c43c763933de3f86362a79ec1e962ff3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1828559267\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_1828559267\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_501402431\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_550501060\manifest.json

Filesize
145B

MD5
a3842aa29862631e5548a02b38a07ffa

SHA1
d4b345c8f29d091bf67df12a17b72df84ff1d24a

SHA256
86408cbb3cb0c03520762e8d59f5dfb8887d68219bef2ce95bb50b5486d6d5bc

SHA512
3f0171c91a973b0910538eca3f2802a8ec54f7b615a525206896f4feeba61332c40089db7b655d156e32a654480cad3ffafa7caa3c042cf6ba94619c0cc93cb8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4164_817617275\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
576f64b8f21f4203eed3f6c7b065f527

SHA1
e0c4e8f914319e112a4b3562d2d6f4107750aba8

SHA256
c39a636afaeae67ebd98682bf35ff7afafceac020ed21cb564ab954ab1ef6f87

SHA512
af606a5d7d4d96afd80d8e0117f2d5f02cc82b810149f50e26d46a5b8fd7c6b2aa119aa1b7123c54d2ef19d05ca92ca738994e047e24e567e53765fc1c52f653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e2bdb54-4094-49cd-a9c6-4589ab872d26.tmp

Filesize
16KB

MD5
75bcbba692037fd52f516cdd831c4170

SHA1
c0b1cb10df9e531f335a83d10a4d6181d21ff327

SHA256
ccaf1c754829d977ff0cf0f1460f107e3caa179c7d1d86cc69ec87165d6a591c

SHA512
e134e47a1e7df69288de97c5705b34593072fbe137ee0f016b4ecd6238ed794f5c71c95d4809b66aa1ba5e7c78077f0382410aace3f7926d947d1c9601aa3516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
73e20c339f750a2b174ddbf492f2894c

SHA1
c16c5fa4746a27ed75375c83ba292a5e18bf4a93

SHA256
b0532e86abbc638e80cb20af9eda09c5b0e6e5378a3166ca36098f5543ab37ec

SHA512
a1db7f4f08d376de5d8c96539b93c4f6050db015045865396eba1b4bb2a156113c4d0e1762d2d5610eb939d20e600f28b0ffbe18a6e60b0f3e3b8b8146ddab5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
31e0f5d18eda21d1131683d156c886cd

SHA1
76d809e2f13a37123095cffb361c65cab3545c1a

SHA256
a553faf191dd00ba03fecc5e51a832b322e26e79a77f8ad0aea935c4dcecc1f6

SHA512
518cdb0681759bd2bc19dbd47fd950eeaaaa121bf598ecbdebd2119722add2bb097c0d5dbacc18c6bb2427fba7234775bf230a6e13fe313e4b558823dc7bf495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bb2b2.TMP

Filesize
3KB

MD5
2a888c85fbb62a489e8dd81b7e090edf

SHA1
52328e8e70aa191cdd043787f5dffe9936483c80

SHA256
54b1cd36d3481873a73b7e881b93f56f9831448ecb9c77a7d3b1f9e1b2155b27

SHA512
b2ba108201de8edd7369344988c58ea4c390ca8ed1f98fb13b8fc52eda25ce165e6397833cfaf2941a27570f0c8f09b92c02d95e8328112a604d33231704c2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
4a73a874b2a6277c9973ec412c8928ba

SHA1
f5054bd698cd4a52e8e4fac7ea2977ad89456df5

SHA256
afaec6c4f7a5c3535853911f58f7a8a8e14689c2bf81988ddc57f4a8022215b6

SHA512
a4f9e5f1b63f232e695d5766576ce071d6c82c71846ddc8f99df878972c18c5269583e5e2f47caaee528aa1017bbeefe451410b3df3fd760d33e9858fd1356da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
712237a4f9c1e0a17ae40e9de4dc4fda

SHA1
55a0b55a949016c49699f32ff36a55096bcaa887

SHA256
8d56aede85442f93678a943a858f4bc16cb2e87e2c3377902dd452e9cf169076

SHA512
0932be6359fa9a5a0e97b48716d555c1f00beacc2444de3f60ffd57e49ba7ce71474d33c1d35ab612ccb72067e01d93dff62f18d801b1cbc48bba95ca6fa2e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a83e88c07b9b10feb3f14879812f9244

SHA1
86192abcfe1707ec4afa658b3e7801313c590a04

SHA256
45940527cf4ac0bbfc156bc85c682619a9442999adb7ab8a42c49429b92f1938

SHA512
501db8978a4eabc4476c3ad31ded71c0ea97f41d3bd3eb8c9508b2345cc1fe6660ded978534ddfdf3845ee88fb2ade43e8d05cb91f3e3f0842d08c80c5f7cb34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
81254831c090f85ab1e54b5d0a481c2e

SHA1
fe9e3c3961aee8bc644344aa437658a4cab4fdf7

SHA256
3d4147e1eb23797c2b5e7f98ee79f75b32f2b5efa9a627968f3f65e872a69102

SHA512
de4126f9f344ba6dc5ca533820a46b973f12a1d4c2051192aaf66b3aa42e39a8a45b2c58e8284aa61492a4735953a387201f4715a79e5ff90e19c53ff1e39dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
430d6536429c7e017ae66cefdaa737d4

SHA1
82b80378ec673146ac234116ec58c38723fc6c39

SHA256
37ef784479a319b531d3f473d4053e48c2249cd6a99f681c82d6dbbfcaf1fecf

SHA512
a836266b531ec24543c69cb9243c154796c83444d51868d4371cb11cd3ec7e24bf8fa6070d58c51b2bddff838774b3f1548c728e765021de003db174a79378c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6af5d68bdea2aca7c1ca262abeb31cb4

SHA1
61e2c8282766f7f0b983ae3de0b0ba07118381b2

SHA256
c6be97f5bb1b758c09b679680fd9c564bf6ca47feb95ca3394281a60b5b546eb

SHA512
7666e263408202c41e1b398e0cd1cf919489b88f4261c02c5c0cd671d9aa389f2d3edbabb27ad502f11855de4225313c891792e13c101bebd263809643e09ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
00bab8dd6bb60ec8a4ed31633418e4b7

SHA1
97d35aa0d6b65397f72d76ad73ab01053146aa13

SHA256
dc95316278ca24a29d0896e4ad76fad2e46229a71513c491ef05636acbfc5c80

SHA512
e89bf70782c1be292a7aeeb684e317e74771ee1191498e4517600d255d8065c254bf19ea5d9803d2f1236aa14d6bcca37310a6a68a67c1e2b4f964518d1cd64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
bfd24af68b278b5d5478d316f8fb515c

SHA1
b4f5dba6d21286cdbca0582b3dea57589d7382c7

SHA256
518706153fe372370857259dfedd7f987839f3a4fd9c7f393ea228bf8b204a3a

SHA512
d809f9688be8fa87084a8aea422a3d8d324c04456593e76c0fc837bb1c39bd4ad52fef22b72577fbeb672a692a210068c578fb9870f5e3384d50ca747d7313e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
47b5dd20da6f86db28b0e8bffbb8cc3f

SHA1
b30d06a5176cf05cc7705c709e95cb30e72493f1

SHA256
ec8779ad22caaf729b08abee1b9e730741301d93deb024b3ec2a5960f2c27c3b

SHA512
5b84ecc4a12dadeabc17830409abf3ad9d0571e97882b02c3c3ed2a1ac470d954d2a1dd1cf21646239bc54b694fd27f262a600dc7aebff9b46be79325723faa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
c77c04d9ce80ce9723b6ae026d8893e7

SHA1
52fa962c6cbc16f31c9d1fa11b7edd4ef8239967

SHA256
2b72260c97f373cce85ce3d1f8d27c2ab093b5aaf1ec0de6cb4b442b43b37f18

SHA512
e48eebb9f318c843e415cf922e117ea20e79e0117d0df1b9572dfc7f0a7a5348e11e6c43ed531e9a740161c3e111bed7dde9de7a27eb1124d6d953ad87b11ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
08edded5c9efa502830344cd68e04996

SHA1
87e481f52162ee92ea044c83a6a327da56192a6c

SHA256
fd57279ed2bcf4d415c1cacc8346566cdd2616618a009de4a1348bed67ece01f

SHA512
e397a691230de338f01e8a8ce0f9224069c1e95b032c3d03a48306b0907feac088eb476ead603568db0e04c870f76f2f568f3e2e270f3e40751ab998c0c10ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.37.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
003fe9be736ed918d1fa5738e03dee2a

SHA1
1875f50d89bfa23064db1a7c2d80f97e3f4fa1e3

SHA256
3bb1b93f917e9d8e76afa18c3f6d88bd7708b26f5142b29b8e977af80e93d8af

SHA512
e6af65d2586da8a96014faeb9ce5986aeecb04145f66b32be0d2cf849d6e56c22c179ac8adb9211e7ab7cc41d9d8e0a8f7910210b8adfd810f13f43563c4c5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-stable.json

Filesize
81KB

MD5
05f65948a88bd669597fc3b4e225ecae

SHA1
5397b14065e49ff908c66c51fc09f53fff7caed7

SHA256
0e329e63d8457bef61d0986a521f81d747a09dadf3b1136f2011942ba14d9fc0

SHA512
ed7b767a741d18c0dd35e0311db752120e0f090d39ef976d541cbc5ae78fa32655cb3f9c27cddef6ca8091ca8bf31513254a748bc8b95353897f6198a667cf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
88a6230827665465e6173a9da15a5990

SHA1
645ae58d4cd40e7b451ed8641040d8cb9ea78f1d

SHA256
ab71f4b45e857d96cb906df9dc96a43b78e93078dac63b80e8739e1fddbd9a47

SHA512
fc529976228c32948af4add520b790026d6fc3e7bba1ba886d0bb8cdb28ee648ed4784942d39c388d82024a8c4fb2ffe08d5facc0a0a69a5cc80a7dc794de98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c2c09f456dd0fc75c795bd8b7e29c9cc

SHA1
ab1c25d0848cc9e85951bee6765e73f47f1f6b06

SHA256
ba8f1ec913ede5fdfc1ac9fa8304b022a096f4df63e5e1c3aa11f9b988fbc1ab

SHA512
6ee5f26e1ff694897bfffbbfa5a41301cc97cece1feeaa532add91383f96564e68e04731ebbd664c35b3404fa1b2414d48d935662c650d5356d9a47f63f94ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
7fac7ef5479196f66152c003a1a83848

SHA1
457cb4410e78b5fda32f20b5fdc8b5605a0fd994

SHA256
ebd79ad47ff3c120d0b1b7f385f9824ac128cd0239ff7c8371b3ebb342739050

SHA512
b7580f47f7ba8bd4514c5454835f562476511531c57e8ac6c96469679a6097b435ad14e8ec7dc669c5e4a8bd133cabed8b15809fa1d637b8cdb090a748582593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
13197b544c677514aee41675a7976396

SHA1
84a5efe99203046d69168c56516e4f5be4909ce9

SHA256
1ea706a8208bd95bd08aea58239bd886f69ad137e6ec5617d0032d3346448b8c

SHA512
59f3ef859c376e430efa3089a038fc6426571fe5eaded43ec9145e4a4a33f0d6dd72dd0d6dd7ad86daa850ded9a6a95d3c79d70f4161d00dea7765d504f6ac6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
e50b0f998975824d699e8a930b62ab2b

SHA1
cdb5ccffadfe9790557a72b61c2280759fbc9737

SHA256
56b33420de9b7f775f314c1ca52af15a03c2749e97e6896d1466ff79112fe774

SHA512
e003d8b79d6551d1535f3112d68a46c060f5a21b504ac247bd9334bbd8400cb571220255f79277186f3c7a292e67fe8890a4501b0fde2eb10ef4553eebce90a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5be200.TMP

Filesize
392B

MD5
8039da8652ddf95e3a5d6931ba6e3002

SHA1
45b862cebfb893c0b1c8a4095a3d587b22af58e0

SHA256
b5737e7e43de11dd58e704488e54e4b1c9eb965dcf05f137b66dd8e9847a192b

SHA512
9b07bcf973391c098f0cdb8d70995e31780ba7d36d315631047de5ae4e3b58468169bf7fc315ccc97a8178f91822091530bfa65d5b47c5c3b283b884a00fb82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
d3624f624de83138912af3a7a4c02424

SHA1
4451be609c0daed68c7c4507a9b34c53cc0b8bcb

SHA256
5527168b208adc9aecbdae8bb4abba068c0362959db5afcdb538086715fef19c

SHA512
c691dd1c1f57532650a07e9d354efc86cc81de4cb6859c2c73f0f58e21bd099506c4fa3f3211a732356a22beb6a59044e1dbd1f58367d43a1486e771a99da77a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\241010-x34qxsxfql_pw_infected.zip

Filesize
350KB

MD5
314c3c542c31a9550b9491d59ec376bf

SHA1
c006917f9efe3f11bff15a077230f60d0b2f1820

SHA256
9d9eda821e80c47d9a966a5c8cff825bbe61947d11ffdb2321f8795f8e211d5e

SHA512
7f598455aff2276a46f4bc58eab8dd630d3f158c7d54c8715c7416fed6433578d7bb4918b6dd4bb27449eb9cf1b6b125ee22e12edfe2d07dc22e21e6bfb12335

Download Submit
C:\Users\Admin\Downloads\241010-x34qxsxfql_pw_infected\3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118

Filesize
658KB

MD5
3178fcad2d2c2f3c0f4f70aecfb18db7

SHA1
0ecad6522214f9bef4dd8f2f8eb927827bc4971c

SHA256
dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

SHA512
57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

Download Submit