hxxp://176[.]65[.]139[.]64/bins/sora[.]mips

Analysis

max time kernel
88s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://176.65.139.64/bins/sora.mips
Sample260418-mptzfset9w

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000022a0c-50.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_1171411694\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5248_1564263808\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_1171411694\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5248_302597496\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209833222894813"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{9A3713B7-6FB9-4B66-B9A3-9B2137669619}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 4416	5248	msedge.exe	84
PID 5248 wrote to memory of 5944	5248	msedge.exe	85
PID 5248 wrote to memory of 5628	5248	msedge.exe	86
PID 5248 wrote to memory of 5944	5248	msedge.exe	85
PID 5248 wrote to memory of 5944	5248	msedge.exe	85
PID 5248 wrote to memory of 3480	5248	msedge.exe	87
PID 5248 wrote to memory of 3480	5248	msedge.exe	87
PID 5248 wrote to memory of 640	5248	msedge.exe	89
PID 5248 wrote to memory of 640	5248	msedge.exe	89
PID 5248 wrote to memory of 640	5248	msedge.exe	89
PID 5248 wrote to memory of 800	5248	msedge.exe	88
PID 5248 wrote to memory of 800	5248	msedge.exe	88
PID 5248 wrote to memory of 800	5248	msedge.exe	88
PID 5248 wrote to memory of 3764	5248	msedge.exe	92
PID 5248 wrote to memory of 2308	5248	msedge.exe	93
PID 5248 wrote to memory of 3764	5248	msedge.exe	92
PID 5248 wrote to memory of 2308	5248	msedge.exe	93
PID 5248 wrote to memory of 3608	5248	msedge.exe	94
PID 5248 wrote to memory of 3608	5248	msedge.exe	94
PID 5248 wrote to memory of 1268	5248	msedge.exe	95
PID 5248 wrote to memory of 1268	5248	msedge.exe	95
PID 5248 wrote to memory of 1268	5248	msedge.exe	95
PID 5248 wrote to memory of 2356	5248	msedge.exe	96
PID 5248 wrote to memory of 1152	5248	msedge.exe	98
PID 5248 wrote to memory of 6116	5248	msedge.exe	106
PID 5248 wrote to memory of 3368	5248	msedge.exe	107
PID 5248 wrote to memory of 5152	5248	msedge.exe	108
PID 5248 wrote to memory of 4312	5248	msedge.exe	109
PID 5248 wrote to memory of 4312	5248	msedge.exe	109
PID 5248 wrote to memory of 5664	5248	msedge.exe	110
PID 5248 wrote to memory of 5664	5248	msedge.exe	110
PID 5248 wrote to memory of 1880	5248	msedge.exe	114
PID 5248 wrote to memory of 1880	5248	msedge.exe	114
PID 5248 wrote to memory of 4336	5248	msedge.exe	117
PID 5248 wrote to memory of 4336	5248	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://176.65.139.64/bins/sora.mips
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffef614c188,0x7ffef614c194,0x7ffef614c1a0
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,5134612447997204608,6721598896429737483,262144 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,11818744352537722425,5478564858727642636,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10679036298001769204,9154817209442677103,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,16215085117591001617,13245589481411363255,2097152 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,9067580704061254899,15425233073670607238,2097152 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,11171236027708878385,7224369407811872615,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,14078279354629346941,17635867822310353187,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,8176662577357172648,7742736454699672373,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5504,i,3330615168650814200,15979942413767594896,2097152 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2695584509956083856,10520433322396719164,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,6573963833795172329,8803338158444701904,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,6573963833795172329,8803338158444701904,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,16239080290115848051,3159719949023488323,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,6621855692068778225,7990704441529908195,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17625080905927260836,9713326067534637228,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9083473886256212446,10871661040603772980,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,17789220704012009830,17264658158731836565,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,9782176040053182399,10040402280120831265,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2406940849834582099,11313361671444820318,524288 --field-trial-handle=2256,i,15562385075488536723,4842652708390018904,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5248_1171411694\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5248_1171411694\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3418d7d64149510864cafdc05305e292462610d4b7979418b991a07b4bc1436a
MD5 113cb83c0f2d1b6732770e8185e25207
SHA1 bf49950a95754a292f4d57bb5f88bb118edbf587
SHA512 75329fa6acb7ec1830517a729802f5eaa191db12ca5343c24140a88aa7f51c48f0910b07c4f22d0a7b676d17219407b3b9a9501d47818245c79115c8bd693c74
TLSH
T131E02BAACC31DC6B08FD4B292052464AEB51135B6B51885F3B3D91098FF57370595C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 083af8f434323e2a56ba28655ef8ce61b9ff8c2045fded9da4af77df8a2bcd9b
MD5 98024ddf9fde9eda24d4445980db364c
SHA1 d1de3d1ff59358cf183ae0a315dde4109fbc2af6
SHA512 33bfbf4adf817991adc066491546287c07bc69863e2c5795ee28249024a8f8ddc48e3de4e729eaa26193c48f0492dd7990dac9bfbbad03579ebdedd2b7e40407
TLSH
T12D41BDF7C3E4857D89025AF0AA186F2BCE5D0954432C7C9A89E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 95362ed128b398ab1830a4bd8928dbf723a7e7bcee7f637552d607af9560b04b
MD5 7c749da992a985f75fb43de7763f189e
SHA1 5e75d7a5341cd01d3c823dba8191abe41ade1944
SHA512 1f94e5dbad74154da9dfe21834a5b722d3d7b47638f6894b12301ab9a0232a7d1e99cc630084278f1350e1c38c883391169b264aca7351dfd62c6a8ac182c3d2
SSDEEP 192:sxZORZyMqZ/K1Ml8M9//fis9VwnpZZELgvMzodpLHKNJ6+WNGYKbYrNeoIgjpJ:sxZOG1//fis9Vwp3hvPLHKkGcNbjT
TLSH
T1C162E8156A38997BCCDBD219FA457F53D6F9552392844E44AAFCCB0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1003146764de90c4f576b01b799b4204b5c846cab8c3ccf2e3eda3a02eccb03d
MD5 5abdeb74624bbe9fa523c827e55c05b1
SHA1 4fa6f807c8776523a50736b553e08c45633e0a3c
SHA512 a40e02569ff0d307a289266a2392d1af00af8796c37362ed4a52ee6dc16cc0dd0bdd5d732f32828427d7d8b5e22652c4fc70187fc96227d2f545678d749f2376
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaEx4Llhf51YroU:AasqZl+E/BlWvBDeTu1jaLEx4LXB1jAJ
TLSH
T10DF20A3B2C0CCB7E4F804E9CDC2A7E9E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eb7c02ef36f566be7926dc5fc22c61b21849cc7e9ff646ee4a41d97d69158acc
MD5 074fdd08c088ea13bd77de54e30b0a6f
SHA1 61959c8e7bee73be7984c92bafaa920b44a16960
SHA512 8d3939b4cc7dadbf9fb4a408885f2140bb424634c9f6c968a40e18c2112426baa7b71c77fbdfdb94da195784b659965c52b2310343263f9ef9694eb590332f00
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnC:+BOVglYXrbtZqRvJhnI5g9JnTHqD
TLSH
T115B25E11753B03803A7E254E9594B56F62C270A37098B82B3BB944A64F6BF20CDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2ec8623486cdcc9e6f1ad9056ed4c7337512d81e05ee838f6f5c392865c416fe
MD5 a32547837bf890f8221d3689ee03557d
SHA1 7ebb66e96407d83db0614a7eb6eb9d59625ee119
SHA512 daa57135e72267791f58722e15176f11cc4015ab3d2659918f82cab75bb1abd278b14c5974916b3941d3abe4e2cca266c2874c7a0770eed42d729903973a92bf
SSDEEP 384:nuviFavqMg3sNU8TUNTUlIm2RihYngqr8vfDYHLajdTYgCuQNS7o1dKuiNTX7rND:u6Fayv37wgTiG8YH2xThCbNmo1tiJXfp
TLSH
T19EC25B31EC98D9ABEDE79FC9E7497A07DEE00197D58C0AD8D9E44D0D108759E230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b5c7a55bed3243ab7367a0b41efffb411bf79653be1c7961e8db399e3a872059
MD5 f28e07bb611ff02272d031e386f00ae6
SHA1 795d42b19272a6aeefdb2122821ec01e21e6e1ba
SHA512 46b0cf9b33a199269ef6a035e9ecea696b6f2e27c1c2d32b4e6845ebfdebdf7674b55a6cc20329e7292476c010fee0214d7f4706c2f2545c89c0e78ed459aa4c
SSDEEP 384:nwiFavqMD3sNf8TUNTUlI4XRihCuPxb98vfDYHLajdTYgC2vctanVYfrN1k+rvIs:LFay434wgcivbaYH2xThC0JVMt
TLSH
T1D2C23A35EC54DDA7EDE64FCAE7497A07AEF001A7858C4ED8EAD85D1D008719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 77ca50190d6861eda86676b8c61a31eef33397ec8604cecbfc51d2e23346164b
MD5 a1fdf6d7fba8c54e49ec16e3c5e4db8a
SHA1 af417b48ea63f16e9fe2915f7e3b3eb97242882a
SHA512 196367f682cea51bdcf72c54ea3ef033160501d8a4a26f5ef2bb88f6ca4a58ef8167a03973169062fec16e62170ee0c092606ce9872a900df711e0682ea97eba
SSDEEP 384:nRiFJjccCs+Bt0S3ZsNf8TUNTUlI4FRihfuPxb98vfDYHLajdTYgC2vctInVSBFb:4FJccQ54wgqiobaYH2xThC0hVSPSBg
TLSH
T1CAC24A31E894CDBBEDE68F9AE3497647AEE00067869C4ED8DAD85E1C00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4cc69709516575df87f1a4a5a9b6ae48b18bacedf7ab61da4872ce816518c594
MD5 34fa3e80f9bb4ab97c08b0e47e7a1ce8
SHA1 8dc98b798e012c83864d7a65f02aedeef32d94c4
SHA512 2cba6fbabf0688a098f8a2c1537a1636ebf615d3189defa7dfe9cf9d53bf8d6e0e6f73ab0fabbe50b34eb790858b5b7ad7f8c8be25de1ea490ed4cba4de7c5ba
SSDEEP 384:nRiFavqMg3sNb8TUNTUlIm2RihCBrqi8vfDYHLajdTYgC2vctgnVS7o1dKuiNTXh:4Fayv3IwgTilTYH2xThC0ZVmo1tiJXfp
TLSH
T12EC25B31EC98D9A7EDE69F9AE7497A07DEE00297C58C0AD8DAE45D1D00C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4170e0a7ef00522fd7aab6432cad007d25bc8f2fa0440595966e02a039bd700f
MD5 4508cb691c25ffc0d06d5761f628065b
SHA1 e3107c8dd5b3cdec37bb9e73f944239fa0f4eaca
SHA512 e11ea29db43520593000c64bc418cb233fc8e95c98f61ea88b1d448fac527e0b6541824f0e283f3cd3780961018bed338777572a8c1ba475ceae0a87c674ddc3
SSDEEP 384:njhiFJjccCs+Bt0S3v1sNf8TUNTUlI4FRihfuPxb98vfDYHLajdTYgC2vctvgrVG:jIFJccQN4wgqiobaYH2xThC0E6VSPSBg
TLSH
T1C7D24A31E894CDB7EDF68F9AE3497A43AEE00067869C4ED8DAD85E1D00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 108ee2ce01c0b565b41d4d84ce361671bc3166fa0b667eb0fb00cf12b16caa33
MD5 2d245f17b4351c1e2a185274a21c3e31
SHA1 d50ea7ad50ab86c2a1ce891b3ec860a61ea7158d
SHA512 d2c567ea69afaf968ea8092fd921d401909adcdf2b0214bcadbb1085db7f5079acbd7102d6b0eff971c80600d395abf60cd9c399c90adc410099ea8b6f6ccd87
SSDEEP 384:nwiFJjccCs+Bt0S3ZsNf8TUNTUlI4FRihfuPxb98vfDYHLajdTYgC2vctInVSBFb:LFJccQ54wgqiobaYH2xThC0hVSPSBg
TLSH
T144C24A31E894CDABEDE68F9AE3497647AEE00067869C4AD8DAD85E1D008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ffd55f3e05e424d925f41a2a078a2a1975b2aef4fbb6fd8a11f5896309af673
MD5 07c31719cba67bff6cc2f66903e0c60b
SHA1 b9899879ad859677745d6e5220a9db2ea3b2b094
SHA512 4820fb5d8e3c70ede70b3b4bc7eaf4a627944c9aff7601cb1d1faedf17056a2031ccb48032834c8bdd11a3556414fdd0a9dab30c3d10ec5a963401c6c647ba5d
TLSH
T1FA413A9CB6E92158B7B76E169BF3A46D847ABC372E06D45E50010E4F0A72A00C872737
MD5 SHA1 SHA512 TLSH

Submit Download

sora.mips.crdownload

Path C:\Users\Admin\Downloads\sora.mips.crdownload
Size 28KB
SHA256 87b4da6325c09742e72874166442dca4c4b4d84c7bde546259a2f7ebecb0b521
MD5 7e0128b683969eb4425ddcdffcdf8820
SHA1 9f259c91b7c30f5a49e0c7853a9ebdb6b4f98a23
SHA512 697014e51f5b47361f9508fd87fd5c43e4173782e0ef9fcaf225d885044856e3d4155247231f0fc8e72248f589f36303fc6248087027fe995006105dc2a2ee26
SSDEEP 768:U4ylAtv6pqLJM0RXaxGyUbXtheU/S4uhJgGlzDpbuR1Jg:HMBqTRXa+Zhr/8VJu6
TLSH
T1D2D2D0BC6B1149D6CA6FE0B44EE507222E60CFB2F1436C077665D5C3BB0A8583CAADC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-214-0x0000025662CD0000-0x0000025663025000-memory.dmp

Download

memory/1152-213-0x0000025662CD0000-0x0000025663025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads