hxxps://gofile[.]io/d/Xfqnl7

Analysis

user interaction
yes
max time kernel
900s
max time network
727s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/Xfqnl7
Sample260715-ed73yaa15j

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4636	chacobot.exe

Loads dropped DLL 2 IoCs

pid	Process
4636	chacobot.exe
4636	chacobot.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	api.gofile.io
25	api.gofile.io
30	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285610461968378"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F6BCADCF-64A1-4948-881D-84812060600D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4636	chacobot.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2228	7zG.exe
Token: 35	2228	7zG.exe
Token: SeSecurityPrivilege	2228	7zG.exe
Token: SeSecurityPrivilege	2228	7zG.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
2228	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4636	chacobot.exe
4636	chacobot.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3752	3364	msedge.exe	86
PID 3364 wrote to memory of 2344	3364	msedge.exe	87
PID 3364 wrote to memory of 940	3364	msedge.exe	88
PID 3364 wrote to memory of 940	3364	msedge.exe	88
PID 3364 wrote to memory of 940	3364	msedge.exe	88
PID 3364 wrote to memory of 4824	3364	msedge.exe	89
PID 3364 wrote to memory of 4824	3364	msedge.exe	89
PID 3364 wrote to memory of 3412	3364	msedge.exe	90
PID 3364 wrote to memory of 3412	3364	msedge.exe	90
PID 3364 wrote to memory of 3412	3364	msedge.exe	90
PID 3364 wrote to memory of 1324	3364	msedge.exe	91
PID 3364 wrote to memory of 1324	3364	msedge.exe	91
PID 3364 wrote to memory of 1324	3364	msedge.exe	91
PID 3364 wrote to memory of 4288	3364	msedge.exe	93
PID 3364 wrote to memory of 4288	3364	msedge.exe	93
PID 3364 wrote to memory of 4288	3364	msedge.exe	93
PID 3364 wrote to memory of 4868	3364	msedge.exe	94
PID 3364 wrote to memory of 4868	3364	msedge.exe	94
PID 3364 wrote to memory of 4868	3364	msedge.exe	94
PID 3364 wrote to memory of 4060	3364	msedge.exe	97
PID 3364 wrote to memory of 4060	3364	msedge.exe	97
PID 3364 wrote to memory of 4060	3364	msedge.exe	97
PID 3364 wrote to memory of 1748	3364	msedge.exe	99
PID 3364 wrote to memory of 1120	3364	msedge.exe	100
PID 3364 wrote to memory of 1748	3364	msedge.exe	99
PID 3364 wrote to memory of 1120	3364	msedge.exe	100
PID 3364 wrote to memory of 4624	3364	msedge.exe	102
PID 3364 wrote to memory of 2868	3364	msedge.exe	103
PID 3364 wrote to memory of 2868	3364	msedge.exe	103
PID 3364 wrote to memory of 2868	3364	msedge.exe	103
PID 3364 wrote to memory of 1536	3364	msedge.exe	104
PID 3364 wrote to memory of 2504	3364	msedge.exe	105
PID 3364 wrote to memory of 1536	3364	msedge.exe	104
PID 3364 wrote to memory of 2504	3364	msedge.exe	105
PID 3364 wrote to memory of 2504	3364	msedge.exe	105
PID 3364 wrote to memory of 2228	3364	msedge.exe	106
PID 4636 wrote to memory of 3780	4636	chacobot.exe	121
PID 3780 wrote to memory of 4128	3780	cmd.exe	122
PID 3780 wrote to memory of 4828	3780	cmd.exe	123
PID 3780 wrote to memory of 3624	3780	cmd.exe	124
PID 3364 wrote to memory of 3412	3364	msedge.exe	126
PID 3364 wrote to memory of 4232	3364	msedge.exe	127
PID 3364 wrote to memory of 3200	3364	msedge.exe	128
PID 3364 wrote to memory of 5496	3364	msedge.exe	130
PID 3364 wrote to memory of 5496	3364	msedge.exe	130
PID 3364 wrote to memory of 6076	3364	msedge.exe	131
PID 3364 wrote to memory of 220	3364	msedge.exe	132
PID 3364 wrote to memory of 2140	3364	msedge.exe	133
PID 3364 wrote to memory of 220	3364	msedge.exe	132
PID 3364 wrote to memory of 2140	3364	msedge.exe	133
PID 3364 wrote to memory of 4216	3364	msedge.exe	134
PID 3364 wrote to memory of 4216	3364	msedge.exe	134
PID 3364 wrote to memory of 5580	3364	msedge.exe	137
PID 3364 wrote to memory of 5580	3364	msedge.exe	137
PID 3364 wrote to memory of 5712	3364	msedge.exe	138
PID 3364 wrote to memory of 5712	3364	msedge.exe	138
PID 3364 wrote to memory of 1468	3364	msedge.exe	139
PID 3364 wrote to memory of 1468	3364	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Xfqnl7
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff4d27c188,0x7fff4d27c194,0x7fff4d27c1a0
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13280090714855181541,527396105645677788,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,4096201590399663520,5830992637368251390,262144 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,4491241612519619144,13766851855149286808,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17246239008212424220,7053861486524646611,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16970601226186559267,3948341791962109045,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2810993870563803184,17488245926906496500,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,5094255415505142122,11043719347431893331,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3568,i,15637323762064110177,13313824180399388959,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,2158817654912260025,17014527538591716874,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,14420997298094110249,15521622230247143873,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,11155555026621381909,5029298642572318574,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,11155555026621381909,5029298642572318574,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6264,i,5437309747713628608,4891704582770980810,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,272752419426210868,215667879025488395,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5164,i,6170588539531079987,13252542573730287850,2097152 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,4284040372885966104,11011217956489794408,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,7201375467857363078,89102112238627421,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,768459601577527337,3890408369889493229,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,11221585778561884590,7927530480046265325,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17353502978463278653,2761954402089857266,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,10249924936183429384,4911955870198926874,262144 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,12635050164351503349,5021577445848895894,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,13253505434531380610,8873644262613352178,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,7980783601901844917,841262696335671564,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,17007493804330096116,7407299977094831056,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,1388565765172042018,18062512897622929443,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,8941286432070804536,14828212938698591824,524288 --field-trial-handle=2312,i,2851819383407776059,1450293177528136567,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1268

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\chacobot\" -spe -an -ai#7zMap6939:78:7zEvent13497
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2228

C:\Users\Admin\Downloads\chacobot\build\chacobot.exe
"C:\Users\Admin\Downloads\chacobot\build\chacobot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\chacobot\build\chacobot.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Downloads\chacobot\build\chacobot.exe" MD5
    3⤵
    PID:4128
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4828
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 906cb50b70c105ef8375011ba7cd43b429c5b9578861116635807114f68900fe
MD5 8dde0a38b78af27acd56227dec92cc3f
SHA1 52a1c3ed7cff9679a994452941ec9ba602dd1a84
SHA512 7a1c6804fe780fe9063d64c44df505fdef15e423f98ed71e5dc7fe65e05dcbe6df899b3505ca33a727d82d42c4af91fb8ffd9346265a2bbac8c21302da72ee03
TLSH
T1D8E020A946CCC65DE254774F41E8530C43C03F8BD2C4EA261BC4C868344138C6391552
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c490ade887b11e7da5906e499e4de64350d7533e9d7e9a13e59a738c0493db1c
MD5 ceb2ab018dca254af75cf39055784549
SHA1 ec3f69084a6ee31330bf815ce53b9c7153fc26ac
SHA512 afbeddb9adb056a253c79058ed68c8a73d86ab5664f310e5efe30213f25e7b6e8bc02bd07f7b6af23c45c0d7767cf359238bf5880d885eb94c57f7a02f769c4b
TLSH
T121E06F6A1382CDA4C142B34B8808424E5010FAC7D6EE9EAEBACCE0EC220080C83850DA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cf41a59ccc84e4e3058c890c824454a9fbf548ecc1fcdc39d6939b205b6a0df6
MD5 3df4b5e25de759f020688461a2efbd92
SHA1 a5604ecfb0cc43fc3e12d885c087d663048c305c
SHA512 0f6cb844460062a5c525b31cbc10115b10ce41a0d42174cddb91351b93bae79307596b0fa76263ead8a02ed6cd150c668e6274cf81d0f749f5d0e158a922eb55
SSDEEP 96:I6flLogw5OokS6MliGsf6MqdBniztV8S+VAVCm/YemUpNtl8sTsv:otqLb+Aov
TLSH
T11681A354816BC99ED32017B1E0E3F170FEB28FB50EDFEE95218197BE19E1F596026118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fff6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fff6.TMP
Size 3KB
SHA256 8e6e740bd756ba79ff3b53b228e97e0621d9ef751ec250eadc7cb63e54794578
MD5 3990333c1166582a6843729cd979c306
SHA1 c395bbbc8ab846d642c15e6ac3558208a87d68ad
SHA512 47144b78855f269c26e6e54800690369d5201e5c813118440624cd0fe79c66bf872628bc5d9a9d58390e8b4545a0a37293945988f51f7a92d64ed81216199868
TLSH
T12B718114126BC98AD7200331E4E33174FCB28FA90EDFEE8511855BBE19D0F6D6126008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 87fab0b12d96a8856549690298a97a8be9cb37b9d4ddcc3507f6913570594576
MD5 5516bdfd4168d51679a9daf03f205594
SHA1 345986b8405d6f8504a688044ca62df271121fae
SHA512 52caa85337efd3bc8bfe2f43c3dbc16b99caeb606059b2ae462596560bce7baba35cfd5ecc64b14c0c51cfba8d94c7fadcd4f7c146f19c4be0375bc2beaa38ed
TLSH
T121319BF783F5456EDE2192F4AE046F1BCE5C0012836C7D6A86E0AE17A3E3860E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 993897a962577ab6bc526d48f646eb7c55d83eec839e9e5f8173d9faee332a0b
MD5 33946cee979814ad99f0b73bccbc743f
SHA1 c00579d53b52c7e30715fd1202b49764bf682913
SHA512 b677c903fd99bb4a6337582257d7b7758abbb8e6a4541f98f7d83eac4d41818ca585dea78ebde4ae70af371d66361fca2a3e8f1a375c3f3ab4bc1e5cc2b0d545
TLSH
T1FF31AFF383F4456EDE2192F4AE05AF1BCE5C0112836C7D6986D06E17A3E3870E001B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bce8f14eef883acd8f3f3fce0c314a625e87860a20d050b55f20572bc4bdc599
MD5 d170fb3ba2b4642df32669f3d67932d4
SHA1 f705e5c581b2ffb6e804f6f961d3c00cd14301e1
SHA512 818c3485238a2983854f390ee63f343770f3c7b67343da700ebd102fd7269689cd5cc3339934d29b0f3697e0fa31d2757b614e9f7c94f8e4c8ac923a65daee3c
TLSH
T1D8218AF383F9956E8E2192F4AE059F1BCE5C0116836C796986D06E17A3F3871E001A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f8a72ab17f3f2130123ce16dc35f4eabcb346f106387376b0e195c2feb68e0f3
MD5 487848230aa611ed5ab3a2d0147d3682
SHA1 e8dd7962e21a780431b294f5a35320dfb49d1a90
SHA512 d69b9d441708eaa3be628d3fc1e2f720b443e1c711b52311ba088ade539ed69944986338653f666ce9f79f3b1503643f70bc1ed59396e84658625c646f2390ff
SSDEEP 192:sxZqR5yM/jK1Ml8M9I/fJsusNIdpjlZHW6+WNeHn/YwDw4+IgrJ:sxZq31I/fJsusujHbK/o9
TLSH
T1CF42FA11AA3469BBCCDBD209FA55BF53D6F50472E2900E549AFCCA0C05E6AEC231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b6f4e6560fd9e90a726157b7a5f9de45d649a48845e0e93acd622d670c99346d
MD5 bca8de4af9c38b56360465e78894295b
SHA1 f1fcdc995c91bb8c1e69b0dc80390cc062e6d2e9
SHA512 a40f0d36152716022288fcfdefa10f283d8f2a61832262c39224e56aad3161d1396da5b7a0f738cbe8b5028262882626ac2328713014a5d00fb2dfea46a5f272
SSDEEP 192:sxZqR5yM/jK1Ml8UQX9I/fJsT7NIdpRlZHW6+WNeHn/Yw3X4+Ig5bJ:sxZq3qNI/fJsT7uVHbK/D3
TLSH
T1A452E916AA345ABBCCDBD209FA557F53D6F54472E2900E449AFCCA0C05E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 8fb6cac64d279f1b67ea05b03d70cee253b00e32bef7d31aa624a30c302fe125
MD5 41c5b38e627a12293037ac8749edf58c
SHA1 12f0a1494a9dc818c7d58fc0d595af945292d597
SHA512 62d10479d89fdb4bd2347c79dacb66ae430337f61e941f51a29b88b04c9a22959615590f5bac0670ed4dae2b203dbdd47180ab7ba368ae947065ce65e5642eb8
SSDEEP 384:sxZq6qNI/fJsTT66s8qMpRiYnazAW8pZS15posJWeT+wuVHbK/y3:syFNI/fKT4Mnc7WeT+w2Hbwk
TLSH
T100D20805A924C87B9EC35D18B47D7E73D9EC40926284CEDA1AECCA0C019D5FCAF4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 104b9f41dd3d10d18a6d21893673f5163f02336d9a72169f7a3acdcd740331ca
MD5 1cbef16286409b6b9a037070aee9ca68
SHA1 56f24b3566ca1872a740a5b44a4cd32de95843c8
SHA512 34a0328ff80811e5ff5b72aa5612783d43940623b3b6a7c6abbe3fa64bb090a69f7bc6edf618b79006ddbadc013a77c9c1af7e980c2efeecc38abf44dbf6d39f
SSDEEP 768:qH4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dVrohIcCav:qH4jeXmWvmKLEu1jacPLZQdu51
TLSH
T192D2093B280CCF7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\temp-index
Size 1KB
SHA256 16f93e9492b712665fb0f994ba32ed673433842e97e7d7747db9baf826f476c2
MD5 f06ee46e7da48e9ada619c8e3be9d610
SHA1 7c6b0bfa2c843215dd86c88f3a622c8994e252e7
SHA512 08d58c8fa72f99770e1d15d9f78b92ec38f17687777d1e2a86b1f06bc424e01e47e4abc9cb9dc7088d266426ee450770cae183b90c9b365ca187f7ee8f6188c5
TLSH
T1033160498E809C5FE8A844B704B3B8F8737089CC5721E7238C2C62323E1635A1A5B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d42b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5d42b9.TMP
Size 1KB
SHA256 ea2b872f0930caf97021d88994d7064f5db183f6f250ec930f92d7d696195a45
MD5 304b64e2fc6fca00a051c17437764880
SHA1 73e4c439f08376a3f13187f16c6be1f2cda747ea
SHA512 fd3f0d0d0c79c2973e05e4c7a9b974fa70e03fc0cb16ac1cdd5fee6b3a7c7d6e97efd6b04c24697642bdf2d904aa9408329afdc1c6b5e8fd09c2f79dba5be89a
TLSH
T14A31464B8A908D1BE4D4507B0DA6F4BC73358C408322B793987C6239AD25B9E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 04999c856bf7f05e94e28d1862c8043628c8b123843a38a20ee7e99dd9428f21
MD5 3c9f5e1bc62c93d2ce7f5a5dcd55cdc6
SHA1 b0739dedf6bff7dbcff62096d53a57495ad572eb
SHA512 73711d6c7f31fedaaee60420e2d3c610a83c788630b9dfcbf8e26033c977b1755a679635b31291c9f624f1c436f8952026da5217738b1941131f70523ffbc00d
TLSH
T1F2E068FA2CD72E20AC7F47E228B204A44106B428C550AC8F2016A2E750A02282016C60
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6a17fb3a1a044305ec80beb6feaa9b549e44b08ed20d0df82650f20d331b400
MD5 cceefb0435924c6914e722afa0d12e99
SHA1 02d333e36b823e99ba8eb15fdcee59080620f630
SHA512 e02400816106382275b9750e9a535ceaaaabb266393cc317df0914ac61afe301660a210c5c873e0e967ee1a9c1585c879ee6f76781458766f233660921fdab5f
SSDEEP 24:KdRtfRoR7RSaR3dRfR7Rz4RLRv+RCIjRnRzKiRchaRJRz1ER1RjSmRdMR48R7RQB:K88I7KZiEzyNdIpKGkcu5I9KagoXyq
TLSH
T1A2911F56327B43023C3D6908975497375686B9A37119A92B3BEC00B64F27F290EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5994a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5994a5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fe046c7a4e2a92691286fb73e0cfd031b40dc36714d4a1ca7a872029a5818ab1
MD5 5a22550e7258a6a8d0d84bc87fb7e055
SHA1 c49cec6394fd4daf0000a390c461a84e727511fb
SHA512 3a747ffbde294030f80315f1f10b6758d70737c14f6d33601a17da8572dc4b5ff3bfce49a3ed0eb0e741c7cf7fa1c49b3e384ff9296d394660913ce4c7694a95
SSDEEP 384:gtNn/s3n9S4sNA6zy+bU/XZlf+98RUlXU+2mvFT2Scjmw9a:gj+9bL+6pFqlUlmtT21jha
TLSH
T193928D32AD38ACAB5ED19294F44B33578FE8516396C52F94DAEC6F0D00CA6AC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 906508d07a3d476348cce892cf1f34bc184668c7c5f0139b2885c2a01a49ca39
MD5 c37ff5f3f8b2ab483dbb2e34b2053fd8
SHA1 fc3ac998c96d43c2af90393acfce6920c3002df2
SHA512 f3016aef3a439c7a21164f05e7375c6139f6763b0ec1c11e03e6bfd45554ad119e0385884f1e73576aa9590b618feb7fd16e66c1eb2abe172b38b7d97a9baf26
SSDEEP 384:tiFGtNn/s3n9SdEsNA8TUNTUlIlHzy+bU/X9lf+98RUlXU+2mTFT2Scjmw9a:kFGj+9VBwgU+6NFqlUlmBT21jha
TLSH
T108C22AF298D7987AD9DD4747F77E2E128EBCC163B5816A90B7985A0CCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfd1ca525e82b8a8258220205ad0b8f8c6ef71fcfde7eb38f80480ed50cb7ded
MD5 257d6b17925036407df680c3b8202930
SHA1 61038c30b5a4c065b48de5068dfdf14293176629
SHA512 a3929f36a74cf0e477e900c848f0b411199d90801fdb4de006a04f16364ba86a4d5df53302d7132af4cc5b5bea6e9e7f0373ea0e95d400fcf8407607fdd6e1d8
SSDEEP 192:EONu6hZ0QmiUyY2pc/+jVnjzorRUY5wOZTtzU6:EONu6oKpu+98RUn2TVU6
TLSH
T11602EA35A8686CB78EE2AE45F48727235FE5112BE9956F84DAE85F1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4cb8e476d0f2e1e0ccb8b8d316a56127336ca68545e44329f169b3e21c2ddee8
MD5 f05760939f7467ccb6544894ba400d7d
SHA1 9a449e5822e55343ddd365b602ed1e8b4c69a4cc
SHA512 240c7571f8f52390aaa2530b342e95d0808b9d348761bc4d428d9aecfed4f437d0a97b0c7982d0e0f36fd895722ee22ce18403d14f5bbde16e58cb9cca86261b
SSDEEP 192:0ON7V6hZKQmiUy02Xc/+jVnjzorRUlXU+2mA5cOqTiqWU6:0ON56qUXu+98RUlXU+2m79T2U6
TLSH
T1BE121D36A868EC6B5DD1A651F48732135EE55117EEC67F90D6EC2F1C00CF6AC270AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d2a76b62b0b6195dacce58a264f5c2e31856d7f51d520beaf9d3de825bd33f3e
MD5 d00a8bc0892829e4ee5e715ba3f9d6c4
SHA1 7f92f90355532df5ad3bb35b55b658727e6f0631
SHA512 9cd0f2fe0e47a75ca3ff8eed084321a075a8e13383055d5bddba435921b47c314ac28d739b2ff91d90878053acdd4a05570ce05a4910add6363d6dc17ce30a3b
SSDEEP 384:9tNn/s3n9S4sNAOzy+bU/XZlf+98RUlXU+2mvFT2Scjmw9a:9j+9bX+6pFqlUlmtT21jha
TLSH
T118928D33AD28ACA75DD19294F44B3357CFF8516396C52F94DAEC6F0D00CA6AC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 20fb26897a861d422164fe07ac1994d8ce8c519aa8706ff7b52947a531c0a44d
MD5 02953b1987970a480078ab72be626db2
SHA1 a0afe73e34c3fee3821c948946531d471afb42ff
SHA512 ee23b3014223678a13c87a0172b1b0d497b1e8c487a08a56e3c7ca6fc974e58da7e2fc214e089d667afa5db9c92a188d9b84c54b18a5ad3e8dec31ee84b26bbd
SSDEEP 384:CtNn/s3n9S4sNAHzy+bU/XZlf+98RUlXU+2mvFT2Scjmw9a:Cj+9b2+6pFqlUlmtT21jha
TLSH
T15E928D33AD28ACAB5DD19294F44B3367CFF8516396C52F94DAEC6F0D00CA6AC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

799d6277-9e3a-47f1-8739-1e58257d5296.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\799d6277-9e3a-47f1-8739-1e58257d5296.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee2615f7ee445f9abbccbe383371ab03e4deeb4cec53dc012094eca353aff475
MD5 329c5c7d2678c7e1fd2ee82169d203db
SHA1 2274ab1fa4d79b9d9ddab7f97e4124ef5e262657
SHA512 577b8fceade127e0dd98aa6616341d15cda522758801cfddb71450d85aa7684386d54fb2d7b3990b4e8c3a5195195686260a0492758339b46b79f5355166f0b4
TLSH
T177410958B6FA1144B3B76E56AFF7656D487F79772A0A945D00110E4F0A63B40C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download

chacobot.zip.crdownload

Path C:\Users\Admin\Downloads\chacobot.zip.crdownload
Size 10.7MB
SHA256 2a9def9af4bca339c652f38a2fa3b6a628ea28a97c6bad6bc38f17ba5e14b35e
MD5 d31f41040258e7d0ce7e63a5463eb466
SHA1 3f1a699f1630a87af6168ed87b323f1d19cf2004
SHA512 762bae94a6c37080b934b477337edff5294e8e443a97c0f46a68311e40184c36481180ebe522e727b9ea0c172f085d28d7bba111ef4a035c19fad16936a43296
SSDEEP 196608:Ha9kVgCuDznJhaLETDFudLO6Pfu/+yuWv88rfN2oc+pYI0B8GT471vaULcRFH3gU:HKkqCWzKLETDyfXu/zbQonmIDJvuTH39
TLSH
T182B633588BBFDE04E3CF907D05D21CA92012786E8752E81AC75B7B075262BE6033B7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chacobot.exe

Path C:\Users\Admin\Downloads\chacobot\build\chacobot.exe
Size 8.0MB
SHA256 48cfbfea879e762ff027ea81b7350d973b9996dd77b19ba4bcb56dc75b13adf4
MD5 0b798233d110868c7436cdf45efea8b5
SHA1 c279bc0be9312383ff3a8f296eb3776828f1b25f
SHA512 8a6a6cc62f4f74264c40cc8c7962f80ae3b6f07a735d6c820afcabda94fa9270d05125cb4d95374cce7d26dbc265703e0fcb8a7ec69e57f7b6a2ed18bf9c53ab
SSDEEP 196608:37HjmSvgsglsp6ILmZgg7PAmkIDZqL1lFybQEd5/gklQnAP:/mSvgsglsp6ILmZJPAmkIQL1Wnd5/gkj
TLSH
T1E586BF82F3A181A8C167C138C642D767E7727C18172157EB329CAB6A2F73BE05B39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offsets.dat

Path C:\Users\Admin\Downloads\chacobot\build\offsets.dat
Size 195B
SHA256 dbe7ddfdae6c6f2cc76b5d67771bf3e3979326740d0b9e1887c74cf7d901bb38
MD5 d6d863f0023fb6bc19524c106fb488f6
SHA1 321a64f1fe4dcbfdc967bcf48bc5fa54ca145ad5
SHA512 d345b8d1d3e0f5ab36e11ea36f0e092fdd174ac686e1c0042368531e804ff4f3271b4e936c06cef7a56bd1f4e1b1b206e67d7d22995b1a7671ca384936eb937b
TLSH
T12FD0123341175965ABCD8789841191711BF24D5156D0705A054E21C56FCBE7CC85C748
MD5 SHA1 SHA512 TLSH

Submit Download

xxhash.dll

Path C:\Users\Admin\Downloads\chacobot\build\xxhash.dll
Size 57KB
SHA256 c3af6cb87a7f70b2d8546bd01c4875bd1ff6ed9daf470d98c6da55c800f9187e
MD5 466300a481b35f64f8e1478658b0a2c4
SHA1 95fe877d0ceae5b52a6d9c2f063a5fa4d2ffcbf1
SHA512 37e8b0a69fe66549985794e6ac2a48e9725d6027cf78c4c1390007fe63cb7dbd4a787807843cdcc9ec55c67dc7fefad3a2e6b5f2e4b3b5797ae42542f21fb571
SSDEEP 768:upGDuJCwTes5ovICVq1XwxMBP5+injQZOl2GnWrkiASW2fJ:KoOcxKxPjIY
TLSH
T1A1435BDFD952A87CC7C6C33CD79F6D4649B6F6200170472583A361642D136AC8FBAE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Users\Admin\Downloads\chacobot\build\zstd.dll
Size 640KB
SHA256 d580e36ca1480c544c7bf8b036dcd8062168fc966a9761358f12149a22767a23
MD5 be019017d876b97e3114d10fc38c80cc
SHA1 92cf519932d4a1f104c9f74c6094b46bd9ad4964
SHA512 3d39a64f5c618e81efd749edabb3a3888ec4ab9b139221abe570a683890bcf97e73c19d792058d3a65aabe1a5efd92d252a6de6476204d1b84af201bc1690524
SSDEEP 12288:udFgvkkkrBELbqJBPWT/ZKg39+Pedp1FLuOxAtGdiNyb:winGtWT/ZKgtqedp1FqObx
TLSH
T199D48D83F29592ECD02BD139C6565363EBB67C4513006AEB83A0EF653F13AE55B34386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4636-343-0x00007FFF4D430000-0x00007FFF4D447000-memory.dmp

Download

memory/4636-344-0x00007FFF4D430000-0x00007FFF4D447000-memory.dmp

Download