hxxp://exploit[.]in

Analysis

max time kernel
87s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2025, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://exploit.in
Sample251031-qcf4lsgr2x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3872_2101931250\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_97_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3872_220865364\_locales\cs\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134063896277349176"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-139171303-3954714288-23435696-1000\{109B09DD-2E39-44F7-BAA3-B6D9B742D211}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3708	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1456	3872	msedge.exe	88
PID 3872 wrote to memory of 1456	3872	msedge.exe	88
PID 3872 wrote to memory of 4580	3872	msedge.exe	89
PID 3872 wrote to memory of 4580	3872	msedge.exe	89
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4576	3872	msedge.exe	90
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91
PID 3872 wrote to memory of 4476	3872	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://exploit.in
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe31fff208,0x7ffe31fff214,0x7ffe31fff220
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1956,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1912,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5000,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4848,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3488,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6572,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6768,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6904,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6288,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6968,i,737931198688027158,13551421105213961199,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x48c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3872_1395460314\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc21b4591b2ea6c7594cdf520051f4daaa374b81d7d231837a5fcd68f4f71a77
MD5 6d402ade60cdb5a64c06a0be7df93c82
SHA1 2d9a78fbe34e84029b5cf974f7a17c1b751d80c9
SHA512 7e6d351eac513e8a8aeb8616a785bf250a6944e9544ebd7cb4de063e9bd3a32077184fce72c38dc07a0ebad8c6f74629caff0f3b573b593dcfdfb9e23bb68e6e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f9d117c840f116d1c594a1cb6a8c11d597f4c84a2fc25d07865b5c28661d4b78
MD5 6ba2252335600a3d7804f39220885044
SHA1 0f7adc956ead1fe246fd35e5d722c7bcb1fa1bd7
SHA512 816fcabe2281b60791b31aca494da1b6049a4525aa25f9724270d5838be7020a6c11adb8173070ab93bba635bda61f36378be5d33b3c296e05829382b0a8dec4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6ae1b346003d68e2aba42dd1cd62695735ad28eda0f174330254342ddfeda912
MD5 235d001ef0954c22a7a8dcd017756e49
SHA1 6cbc80b1db56a5d725d1ed3ce288a309219755bd
SHA512 f00c9a419b77ab9276e4ad12fb23cf2434c19359d9f12780e98c1478522b9d3848e752fc7b3b91a4fe7032d5c170b136de69c8aca3dae489c438ab63d2ed4482
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bb55f79375cb7956f8d597f614c497ceb986b59ecf29b6ce100cafb30ca9d142
MD5 492311f565c6cddeac7d3398f7d62a69
SHA1 fa8c9af0ff21c2ba971ea000345575eef1c25bbf
SHA512 6bf84b9aaa5d5d41f21bab329924f1d84056e9c7660fda24ec8dd99813865a11125a7b43cc04d2b0b2827cd2cf681281a74c578eccff4293ff744920c5eb53db
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d2a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d2a2.TMP
Size 2KB
SHA256 079190cc62983fcd165aff31a7c301b6af90ac76075ee5514d6740afc704cf73
MD5 15dfb6aba2eacc43ee726e76f2ec0c9e
SHA1 b1be8209d82f565e91197b1c935d0af6687bf5fd
SHA512 1b0a7b85031e3ab49290d90041d03cc9b5bf8c44a898a5fb62e2093eb1fea77f709dc04225f079bad56d3b4de430c93a8a1caa1dbbf8c112107d735967b0c141
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 70f87168495e500ae4e8596bcbd1b151eece8c4bbe48469212979160dca6e17c
MD5 037056f065ec3aab3e0146bc6d55869c
SHA1 5993425db06fdf431d3454b6f7b0ec145f364a92
SHA512 9d547e870310b160b33eeba1fd19160f09c3c1a86e776b6c59b78c878fce2e54b19f1ec7ecd19d10ff82728be1f63a50c8c698257bd9eab1d54ece563a0a2356
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4329b9468e54ddfd50c73b84c9e020fdc607fe8c2d72dc0f2137d47ebce75991
MD5 71c7177a960c924b992ee2c43c780eb8
SHA1 c6fc8a8a801e195a27c0deb4b499755c7519795f
SHA512 9c134a6196cad8e9d0b11bd23c38eaba349ab29af248dbb4e3adbe6b10e87bd65eff31bcad0cf0df8878776c80cf3bfd2760198cd8f448cf02755239958dc0ca
SSDEEP 384:sVJbjcsYCDOLReydXtPRqHS+HzWgHAixi:sb3ICOLdXRIHS+H6ixi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 34082f1ff200ad1f483a58bfa5200b89f04fed8e4aa4fd8653d7fa100d48f7f3
MD5 a7ba6bc9a5b6808f994ff8c6e99322b5
SHA1 cef9d58ba55efa952693ea88ca1756ae6a0b0f4d
SHA512 40a6b50e5fd8522b6f00e1e0e5596ed3a250b05c95fc3110d2a1ca73bedb13f830a779151f50c789fd9c47afb7d0c891ff3284c81e5b1fab01e750cd0bb5347d
SSDEEP 192:sVGRgyMqv/K1Ml8M7cst2PqDbL6Cey57XtZ/JNzoZ8pTdHY+WNRI/lwYtqAY78KR:sVGbjcsYCDbLReydXtPRBHSRCw7HArxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 29129cd9179ffd8e9200dd5b002d15e4871a441f8150b65d67e44cafc057cb6f
MD5 fe385d6b7305bea9c993db2b6e5aa5e7
SHA1 edde31bd49a2db8ddcde885537edf5aeeb65e8c0
SHA512 23ec06dffb6a8449b66b46f05a82811137cf6f74465c80939f2dab035bd03cc0e57458a85bf2570fcb2a4ee6e8ac5b1bdb15a8605e2627a6c3f1ab406ee73fec
SSDEEP 384:sV7bjcsYCDOLReydXtPdcHS+HzOOwtHARxi:sN3ICOLdXR6HS+HC3+xi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 90485cfb83a407e6ad9e11df8ac8bc8f9eb2249517adccb11c5d8d924989e5a8
MD5 9488f01f67854e65bb42f778bd43cb15
SHA1 96e03b8efabd50d5b847067a39959e7ec129da57
SHA512 99d611ac9cc6078739d17b2a83c797f4e73f4cebb371c168c1bfd30999f9bf8e942f5465a02887d52b1ab228703ee797e68bc1c8909c654939a7050e54abfffc
SSDEEP 768:E2NkWGL7pLSLbsnWFHBXt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEdRWLlwC/OHrol:E2NkWGd4bsnWFHBXtu1ja/dRWLyUOUD5
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 28baa4036be621e0f3e404178214be291b3e149231c7a87bf4b853450d1c4c38
MD5 3f9ae9e64f7c351b324a0147ddc95e89
SHA1 45547aa8c26b627ba5ab6abb1f3c5ec3aa5a844d
SHA512 553f9f604032ecea141de24555d0698ced039d5f5ea5bfd4883473734b0b6c9f8163b0d1b58bd6478c6152630a14738ad55e46877ae4e5b3745b1318edf7195a
SSDEEP 96:7Z4tpTvjgPnCthgKpv7hybO5tyfKnrKnCDKLdK7SXKLnKfmwK4dKriZKjzKnTphO:OgyQMeyecr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 c5563ec9a47ab87b0d75f74defcb7a08fd1c2092f10b9370cdaddf3850cdb9c1
MD5 e68bf9bd9e9b74420b1bbe2d606ee077
SHA1 d517f9f32021b0dc464ab92ffc9e025da1dcede3
SHA512 78069cfd07d450bd10a5fcb5c29abd7f25ca5e7eebbb35a3b9e209774e566fdabc23463816f7af5cb820381bd6ab3c8f83b3b4588856873eb85e46d2cd7df937
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 687868937a98950fc594c7ed04e18f65f2f4a3aa085e451016f481c9ef72ce4f
MD5 59f77f4281a4004b244ac52a2ee98de6
SHA1 a77be08716c8eafef026ac7150159a04cb729d6d
SHA512 04b2d2e75b37337be2bf15b4db6b581864f4b4995fd71d3fa6c55df0e72fb30451a675c989c66175ea09848fa954a387cddfd8ac2ef5990d087a436a4a2791fd
SSDEEP 768:qFqYfJSJLdOuDwLAt3OCg3bJaHQlUUL+x7DqwGVmzKjUsaO6DSl6:hYfEhOuZ3mSU6dAjUxlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3e738589d426e217b4a371662765195fd61902b40fab38449837d9f5093c0b33
MD5 145c0da7d07d40b484b7016aea3fafa6
SHA1 d36ff61267063c81da5eddb32b9f773350e88ac5
SHA512 76be8676343bf6da68320b2c3c2be8a8bc4ac3f7dca47eb7f423fe63d075dbce3524c37791176a03e3b9636a2daf74067d46df99d75d904b6991ba4e1009d4d3
SSDEEP 768:JFqYfJSJLdOuDwLAQ3uCgxSbJaHQlUUL+bDqwGVmzKjUsaO6DSl6:SYfEhOuc3sMSU6PAjUxlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1b669f437ecd4bda3ce46a9b68ebc607d174a3a953eb6bcbadc7fd8717df3e38
MD5 f23696be9372f4f258a760f4b9c558e9
SHA1 a48685467ed89433947a88c46cc694b7ea681006
SHA512 2e7663d25446cc84346a82c14c8ec0beb5eb3240ced21fffe8c8af415af30047f7faf8f78e61e5f4d2b02fa41cff9ec7331cd05469ab68cfb79f97465db0f00f
SSDEEP 768:bF5BLv7I5wCPFdV6Zi63rCghSJaHQlUUL+LXmsaO6DSnjm:bJUV6ZL3YSU6rmxl0jm
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 26903bf574f0e8183f96140aa71f413178661182a69baf1c31edd499b975e685
MD5 6fd9c020e088fe1fb61d25e6face0d5d
SHA1 c84b3c1306ffd44564318949729873a6eb60e148
SHA512 1263f7f626028a5e8d9a1c45cd0e737dc63502370050480853ad3b4cb4d7ea15676790b0a57b7efa37cf71903075b8999ce3da91ceb16d0a276e6bcf54e7ffef
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9befc85efa3c8dc216d756d16278f135eb0d136a48c422c27b91fa8bc1900f0a
MD5 e6617eb44b16c18776472a6eeb89583b
SHA1 e9a8ecd77a0ce301146911470f2e73934ea18438
SHA512 11c2cae8d2218b102324f805374b4aa669b0e6c01899da132522aa2a57408f2ca36dbad874140442520f936c005013b2fd2fcd2d1479aeb218338d25b4d3e259
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5830ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5830ee.TMP
Size 392B
SHA256 acca4eb38412be30e1037a2b33bf1cb8ecc778d6c196127cee42a3cb98688af4
MD5 ed5de4ff90071ff68979f07802ca920d
SHA1 19a5b026bd65a4c7b33c1e90a505880a832009db
SHA512 cfe9a313f7c1df09b554cb3547bbb65b33f0c865771f0df39a5eff7c998520fcff8691d94a28d048855f26905fb04e2b1be4772f7265f094f62844889c6374bc
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8d9cac7a8067688da8ca2efd63af796608c8677d32f73a1076e7e3c300253832
MD5 84f11206bc01fc2ccacaf094602fcd8f
SHA1 4b9394fc4a138b36b6f16662f618d211a68b60a0
SHA512 86b40e169dabef2b473da9b026fa80c1e555e758dd1710cc2fac9a4c85c40940f9b18593c5c54db302c54d486ce5045d3052dd55ec7ec74604bbd7478509a493
MD5 SHA1 SHA512

Submit Download

memory/5956-413-0x000001A101410000-0x000001A102410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads