hxxp://tungtunghook[.]cc

Analysis

user interaction
yes
max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tungtunghook.cc
Sample260629-2df1sagx21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
93	discord.com
95	discord.com
313	bitbucket.org
314	bitbucket.org
315	bitbucket.org
92	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272456920491194"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CBDDFE09-6384-42E8-822B-637DE19C3134}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{112975A6-181B-4B51-A006-BEA3771E9535}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5876	CredentialUIBroker.exe
1512	CredentialUIBroker.exe
6112	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4300	2304	msedge.exe	83
PID 2304 wrote to memory of 2996	2304	msedge.exe	84
PID 2304 wrote to memory of 4728	2304	msedge.exe	85
PID 2304 wrote to memory of 4728	2304	msedge.exe	85
PID 2304 wrote to memory of 4728	2304	msedge.exe	85
PID 2304 wrote to memory of 2312	2304	msedge.exe	86
PID 2304 wrote to memory of 2312	2304	msedge.exe	86
PID 2304 wrote to memory of 4784	2304	msedge.exe	87
PID 2304 wrote to memory of 4832	2304	msedge.exe	88
PID 2304 wrote to memory of 4784	2304	msedge.exe	87
PID 2304 wrote to memory of 4784	2304	msedge.exe	87
PID 2304 wrote to memory of 4832	2304	msedge.exe	88
PID 2304 wrote to memory of 4832	2304	msedge.exe	88
PID 2304 wrote to memory of 1392	2304	msedge.exe	89
PID 2304 wrote to memory of 1392	2304	msedge.exe	89
PID 2304 wrote to memory of 1392	2304	msedge.exe	89
PID 2304 wrote to memory of 564	2304	msedge.exe	90
PID 2304 wrote to memory of 564	2304	msedge.exe	90
PID 2304 wrote to memory of 564	2304	msedge.exe	90
PID 2304 wrote to memory of 4112	2304	msedge.exe	94
PID 2304 wrote to memory of 4112	2304	msedge.exe	94
PID 2304 wrote to memory of 4112	2304	msedge.exe	94
PID 2304 wrote to memory of 1676	2304	msedge.exe	96
PID 2304 wrote to memory of 4264	2304	msedge.exe	97
PID 2304 wrote to memory of 1676	2304	msedge.exe	96
PID 2304 wrote to memory of 4264	2304	msedge.exe	97
PID 2304 wrote to memory of 4572	2304	msedge.exe	102
PID 2304 wrote to memory of 5216	2304	msedge.exe	111
PID 2304 wrote to memory of 5216	2304	msedge.exe	111
PID 2304 wrote to memory of 5216	2304	msedge.exe	111
PID 2304 wrote to memory of 5284	2304	msedge.exe	112
PID 2304 wrote to memory of 5284	2304	msedge.exe	112
PID 2304 wrote to memory of 5284	2304	msedge.exe	112
PID 2304 wrote to memory of 5544	2304	msedge.exe	116
PID 2304 wrote to memory of 5544	2304	msedge.exe	116
PID 2304 wrote to memory of 5608	2304	msedge.exe	117
PID 2304 wrote to memory of 5892	2304	msedge.exe	119
PID 2304 wrote to memory of 5892	2304	msedge.exe	119
PID 2304 wrote to memory of 5900	2304	msedge.exe	120
PID 2304 wrote to memory of 5900	2304	msedge.exe	120
PID 2304 wrote to memory of 5900	2304	msedge.exe	120
PID 2304 wrote to memory of 5908	2304	msedge.exe	121
PID 2304 wrote to memory of 6136	2304	msedge.exe	124
PID 2304 wrote to memory of 6048	2304	msedge.exe	125
PID 2304 wrote to memory of 4816	2304	msedge.exe	126
PID 2304 wrote to memory of 3500	2304	msedge.exe	128
PID 2304 wrote to memory of 3500	2304	msedge.exe	128
PID 2304 wrote to memory of 3500	2304	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tungtunghook.cc
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16874351338187910428,7834449062407151867,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8455901142357833094,14518614311871978407,262144 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,13119191320758823455,9179092835724604848,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5078088806646561454,17875605779711111744,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3378362679497140867,11634350522099703601,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11259505155971502561,1754361398895021838,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,14034844119426433285,16371271782885424167,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,16379423118550419223,11501384473600275505,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,6468497298767148076,3357989357136160312,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6734423907602430587,14961673753748266566,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8735587233586424669,262134985000270131,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8735587233586424669,262134985000270131,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6384,i,15942013412838810562,1764861634792259226,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6588,i,4253918087951931212,11096750799131349930,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,16240462724961515420,15126383021382455663,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,6661664949612543200,14367589748150224078,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,379440014450228654,6760820925448507602,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7836,i,11801924728085041244,2459134373834360377,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8060,i,5232137059018847412,8632529686679682343,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,12999235051590809971,1124053856910178898,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8132,i,5940132035212559325,15910591572440916929,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8144,i,16860974233532517799,9782316928950740469,524288 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4464,i,9494264306130736610,11471522600858238821,2097152 --field-trial-handle=2432,i,9413734668400290312,18155492946261732699,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc 0x408
1⤵
PID:5416

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000011
Size 10B
SHA256 65f3e6f2819e44fec302be2de4c71d8040db5e4947b36ea757df4faf907d4f0b
MD5 35c3304767a981f21370676a118529a6
SHA1 e0de81afc1a90f3d08564e304ade1db9c19fe9cc
SHA512 84b6c5c28848df6bee181b224e073f6ebc50d662cf94934e8f9b426083fc0fad4dd0d602cb49b72941af641b0645e5b58063a2e6fad7fa301d5b9cf06436ea0a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_tungtunghook.cc_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_tungtunghook.cc_0.indexeddb.leveldb\LOG
Size 353B
SHA256 da1d512d14e6001532088221162628afc81a0d87943c404a919e32e90aaaee4e
MD5 497c67e9e28be651475f66986a992f86
SHA1 07d3dc055766c802ca4c00327d99574b36e4deb1
SHA512 b2b62eff01589ffc915f2556b0179917e0b2fd5f7efc3e8913cc91219e12ccf86720d5eee406ab85ac2dd852de264fb42d3ad5f6146e89af70d71e5f34f235a4
TLSH
T101E06858C0CED31F311450E201216B0DD6A3620E97887A8A8F04CD28B88204498AEDF8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_tungtunghook.cc_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 71684650723ecb1482c2a33ef4a3d7f7f96163451b5027fbdefaba8910bb2d90
MD5 5e1672547375577c1021aa0fd2625d36
SHA1 8213cc1c4c59374ca724452149eaf013276ba838
SHA512 a42085fefdf2bf9142fc939c48908bbd5068933be42a4aa112b5dfc6080f83887a8068b9f4c845ae3b038c370b45106dfb8ba1f9196b35f27831cf837f8ad697
SSDEEP 192:sxZbiR3yM/jK1Ml8MkXW/f4sZGdjIdpGJHW6+WNlf0/YIXpjaYIgrJ:sxZezMXW/f4sZ68KHbi/P9
TLSH
T14D42D8126B34697BCCDBD209F955BF53D6F90462A2900E44ADFCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a0243dad056cb9d6d68c5529aeef9cf695a1cd146a28a8faf51a8e07d5ae1cbe
MD5 8df0dc4e8597a861a662d868720e9d25
SHA1 339cb7466cf26177012fb3932f96e6d518243b9f
SHA512 f1d020c914be5bd9162caa8f13cd5bf5ba310034983c4b3aff216c6bedc529fd2f43f3d8b0aad5231b9b1f77aa4d04f62f243d2481276bf4a6e9770578d06b14
SSDEEP 192:sxZbwR3yM/jK1Ml8MUXW/f4sTidlIdp8EyfJHW6+WNl9KIF2/YI7JjaYIg5dJ:sxZU98XW/f4sTmWEHbuB/Tp
TLSH
T12C52D9536A346977CCDBD20AB955BF53E6F5046292900E44AEFCCA0C05E7ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c084cb0aea83ef3fef7abda7fd83c3626edaba20cc735ac2e256f7b16e8adf5a
MD5 905aaf3c64574b3d2c88842a640a977f
SHA1 3ab05b0880d03f58c11549e1f0dea42190ccf726
SHA512 9e4d823974a8417baf27663bdfc7e02592a243bb959f4724b2980ddde6b1481c1d67d9896f6a700b03d44e525d4a3c8f28609f932707a1902ca32c21782b1aec
SSDEEP 192:sxZbwR3yM/jK1Ml8M9XW/f4sTGdlIdpqyfJHW6+WNlf0/YIXvjaYIg5/J:sxZU91XW/f4sT6WPHbi/13
TLSH
T10E52D8126A346A77CCDBD209F955BF53D6F5046292940E44AAFCCA0C05E7AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f4b065a923ff7db17aee9e14d10645dbc538941a51907bed025b9f8814c9db83
MD5 7f72d3435137ce98427bd5ba66774595
SHA1 1f7149cc5c6cfdab04b0e72f58e33ff052807ff0
SHA512 8cbb34397119b26d59607d908c6327bc482dc1f6ed54b42a1cfe20a42709f08fe5b4c12e64f2f5c1f25895602b1b2e8513bd44446dbd6ba20883c3b1002f37ea
SSDEEP 768:bXsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9MroVR0F8:bXsqxXlWvJD0Tu1ja54LAs9XVRN
TLSH
T1B7E20B3B694CC77E4F840E5DEC26AFD66ED801CBA7988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\07607e01-dc1f-43c6-b6ac-a7a935d4d2ab\index-dir\the-real-index
Size 168B
SHA256 47a45be3e57125afeae918a4b3924a55c291199874c3fc76d9a259bbfa3c9a2b
MD5 feecdbfa2cccd39474d37c28ae1fce4b
SHA1 2d3b6e6203e6e5387d0f0538661475ca2fb08fb9
SHA512 17b5b71259a13ca5da0d60017245ec2a58618591fca6346050d316ca7686d3fcb75399e5a1893d4a178a2b33de8d63552aadcffb5f8322c3f2e1af13f92c173b
TLSH
T117C01271BD134017F0904BF04CE31609B1330825575FA22E0DFC827FD0727444A58611
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\07607e01-dc1f-43c6-b6ac-a7a935d4d2ab\index-dir\the-real-index~RFe58ae6b.TMP
Size 48B
SHA256 72f249a6dd7a14cb6bde22082423d451a4cde3f8fcd2c6921206601c18b7478f
MD5 de8155597895d2f200740aed1bf1b296
SHA1 0d8c98e64389dd1c0f4cd05d02bb838041e3c35c
SHA512 8071752f2dc3a8794c3639634806d3ca68675de9aa91cdb3652533b93257233a2873591cfb451e702750ee57120150aa077054af1f324bf89ac45751ed9b28ea
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt
Size 208B
SHA256 2bf965b3b01c224bbfa62848153bef369cba0fceee143c890df53999a2b542fb
MD5 5fb04ed00e3a46cef9e6d96c98b5ff4c
SHA1 cb3bde62255006d1a91e57415afbd8ec0955aa68
SHA512 8b315ba1f3b2a3154159e47d32813dd22dc7d2f50daed40f6fa7d0b5e05f8f05449696ca84ee5f8753ee627db738f15475d426344c9f662bbe936bbda35e48d1
TLSH
T1E4D023ED011729143950530850375578F5374D13DA70A1859D10B8391D794318D04DBC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5840cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt~RFe5840cd.TMP
Size 140B
SHA256 bb6595b1a115f5d52fc3be6889279e8d85a81337186f3dada698384c8551025d
MD5 1f6202f4b55eabf1bf97805d9e7a1fe8
SHA1 8fb63356011b151b9e4c8cff824f7f7e30c3b5e0
SHA512 6c236ba38fa87bdcb622b1a3db1f7d2b58252cffdde9a3165db6fbf235c30a130e39a8a335bd084bc2e80ff004c7fce87b4638bb4d1984a1034ab60d12c6e845
TLSH
T13BC02BDF020739282D30031800B76554F53B8D43C9B09153CC04BC321C300228E00CBC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e7c118de9945224eb32d2fb9c68fe456e500259ab164b220b5c646f65e066539
MD5 ce63e97892a7129a2e044bbc0611d19a
SHA1 405a477a14b0b906ea72ec2cacbabad367933783
SHA512 e202af1671f25e699af6358fee64912002bec4de8b1321d977c0fd98d2e3cc2f8dc9a298c408e02b369e1c9394a53a5776d00be09a7aa93f1f92fc882e4d7b8d
TLSH
T1CCA0029051C46E82DC414270228395C1E7229C1E67029693C1D04599CC9724A5901200
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5a3d4ab0a3f82e7db3ba2abe7a2514dd8381cf622c80f27db4f5dc6073561d81
MD5 11c598b528717829d307149d31cfa300
SHA1 f069965daa58dc7b453296ede83a9903d3b08032
SHA512 7bdff7e03cda39c4c5c1a1d575b75a02856acc9ea7c048550657266e3c68b09f7fd93c736ee3285a6eac2b20d30987e7bd41e74eb9b24b1bc1d44e2aa002c5a3
SSDEEP 384:NtNn/s3n9SSsNncvbUfMVRN3OKZ9QYkLmn15wbAjEJOM:Nj+9ZkiH3Om9XkLmn12bfJOM
TLSH
T108926B366C385C775EE3A546F54B22179FF8817B92C42E94C5EC9F0D02DB6C8131AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f555f49f57ca0f1db2e3e5ff09dd7752a78bc1d7aff4ad0504b95bdb719fc9c9
MD5 fe29bd867b60b53c874f70f900e9e525
SHA1 ee3d255388cf17dcc578d74dfbbee67bd6453083
SHA512 8cf0c23ca20c52dd38410b39701a50e78bfa8bcb3bd5bf7daaf6000eb8f9faa5ae893b14b5e4311d9285603ddd09928ce79faef7456f024e9695c8b9398e499f
SSDEEP 384:stNn/s3n9S2sNnRvbUfMVRN3OKZ9QYkLmn15wbAjEJOM:sj+9hRiH3Om9XkLmn12bfJOM
TLSH
T138927C366C385C775EE3A546F54B22179FF8817B92C42E94C5EC9F0D02DB6C8131AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e1c8981e645589aede36f62b3fde3906ef1a4a20f3f3f03f8aede19cf05bece
MD5 b7ebe55b1fe1686fd8e724d930f7d89f
SHA1 ead199dcc2b131096dd2fad71f2bb7bc4109ad9f
SHA512 2a56ea14bb84b19fd0b1e88321e7d5fb90a4e4e8600b1c96b295845d68461c23bf77efe52ceec5e6f443793f0987cad960af77f428346b4b426944ef21c75854
SSDEEP 192:tONK6JkRtQmiUyzRW+RN3OmNOmFHh3IROFU6:tONK6Ur6W+RN3OKBp9U6
TLSH
T16A02EA357D386C778EF2AD49F98B27135FA4206BE9952F84DAD81B0C01D769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc835722dccf97f30bb6a832c61c769dbf19f479aa0d6064b7bc7725c188b076
MD5 1f575d750ac22bce8addfbf24c74cc95
SHA1 9e1b18197c733cd992527b01eae7b3032d1ed060
SHA512 99898ec1590970cf3e0f1a7fa573cfd29f9d7b27b41536e169c8da87b21d33923fd28e585128cb562afc5c2b49ead304474ed90232f6ec7437ace14e4bb9760e
SSDEEP 192:+ONi6JkRDQmiUyKRi+RN3OmNOmSC9QjMmVcfqHBLU6:+ONi6U1Vi+RN3OKZ9QSkLU6
TLSH
T120120A366C385C775EE2A845F58732175FE8512BEA896F80D5DC2F1C02DFA9C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b0ddbe1d3476695f5090450662614ac9ca54e77624be2595656fb8ce43b92d6e
MD5 b4a14c3f8956695465ed9f972c70d5f5
SHA1 a47bdc594ef423bd618a01a8237f8f99e8a4786d
SHA512 f87d3b6569b6856bc9b6b53ae4e945e12563de82ad70cc8640fc23a64114c6358b3090fab048a239372f4c35b8b21eb7d0fec809b6cce9086195ddce4897d9e2
SSDEEP 384:stNn/s3n9SfsNnvvbm+2VRN3OKZ9QYkLmn15wbAjEJOM:sj+9UcUH3Om9XkLmn12bfJOM
TLSH
T1CF926C36AC385C771EE3A546F54B22179FF8917792C42E94C5EC9F0D02DB6C8131AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15478485cee7a4b03439f1574c6a42f5937840dedceef46f86f337b3f36cc8d3
MD5 123f09d6ae9920d1325681b8ab1cf616
SHA1 535d0255ad2bcb1c16882f9c2f610226a1f5be37
SHA512 ca10bffeeb9d3dfdb3b8482c077cba2a65abd36a6cd986c863580c658ee6e532e86976e94609e3ba5fb5833ca45bebbfe3342edd0eede60f51a6936e30e7cb66
TLSH
T13E411958BAEA1158B3B37F5A9BF7A86D487E7D772F0A955E00010D4E0623A00C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5416-288-0x000001E4BDA90000-0x000001E4BDC98000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads