hxxps://archive[.]org/details/huniepop64bit

Analysis

user interaction
yes
max time kernel
430s
max time network
422s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/huniepop64bit
Sample260729-131k2stdmf

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2128	GameBarPresenceWriter.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HuniePop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1168	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298366849039237"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{61DA6BEB-903F-420E-8534-513D2D98FFAE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{560E3B0E-140F-4DEC-B17B-DFA8D08E3058}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	OpenWith.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4824	2716	msedge.exe	88
PID 2716 wrote to memory of 1168	2716	msedge.exe	89
PID 2716 wrote to memory of 1872	2716	msedge.exe	90
PID 2716 wrote to memory of 1872	2716	msedge.exe	90
PID 2716 wrote to memory of 1872	2716	msedge.exe	90
PID 2716 wrote to memory of 2260	2716	msedge.exe	91
PID 2716 wrote to memory of 2260	2716	msedge.exe	91
PID 2716 wrote to memory of 3588	2716	msedge.exe	92
PID 2716 wrote to memory of 4960	2716	msedge.exe	93
PID 2716 wrote to memory of 3588	2716	msedge.exe	92
PID 2716 wrote to memory of 3588	2716	msedge.exe	92
PID 2716 wrote to memory of 4960	2716	msedge.exe	93
PID 2716 wrote to memory of 4960	2716	msedge.exe	93
PID 2716 wrote to memory of 3168	2716	msedge.exe	94
PID 2716 wrote to memory of 3168	2716	msedge.exe	94
PID 2716 wrote to memory of 3168	2716	msedge.exe	94
PID 2716 wrote to memory of 4416	2716	msedge.exe	95
PID 2716 wrote to memory of 4416	2716	msedge.exe	95
PID 2716 wrote to memory of 4416	2716	msedge.exe	95
PID 2716 wrote to memory of 2900	2716	msedge.exe	100
PID 2716 wrote to memory of 2724	2716	msedge.exe	101
PID 2716 wrote to memory of 2900	2716	msedge.exe	100
PID 2716 wrote to memory of 2724	2716	msedge.exe	101
PID 2716 wrote to memory of 2284	2716	msedge.exe	103
PID 2716 wrote to memory of 4056	2716	msedge.exe	108
PID 2716 wrote to memory of 4056	2716	msedge.exe	108
PID 2716 wrote to memory of 4056	2716	msedge.exe	108
PID 2716 wrote to memory of 3100	2716	msedge.exe	109
PID 2716 wrote to memory of 3100	2716	msedge.exe	109
PID 2716 wrote to memory of 896	2716	msedge.exe	114
PID 2716 wrote to memory of 2036	2716	msedge.exe	115
PID 2716 wrote to memory of 3040	2716	msedge.exe	116
PID 2716 wrote to memory of 1396	2716	msedge.exe	118
PID 2716 wrote to memory of 1396	2716	msedge.exe	118
PID 2716 wrote to memory of 1396	2716	msedge.exe	118
PID 2716 wrote to memory of 2784	2716	msedge.exe	121
PID 2716 wrote to memory of 2784	2716	msedge.exe	121
PID 2716 wrote to memory of 3736	2716	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/details/huniepop64bit
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffaf801c188,0x7ffaf801c194,0x7ffaf801c1a0
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3606375819344788889,6374663029042080243,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4368661457184043157,10165463350340573890,262144 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,8933607819389179235,5625242845164984590,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1957850439747688571,11841055650988172707,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10525625094566946625,7912871130566511691,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,17351640416785200829,1397154847497417564,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,4212160814612347871,2068954861106713026,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,9786396180846810697,12962832957392744201,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,9709893459195819549,3723347857462909814,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6946033209277798612,9183535436978342673,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6946033209277798612,9183535436978342673,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5896,i,15070519565575469772,5311346163070576329,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6266672153953111275,17980214837651077346,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,14188121327447122267,6722204372609244528,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11367023131655760833,5970564464743886593,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,17673170650802985719,11418411686206036694,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4212,i,6506512239543321701,3007218245783965374,2097152 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,10331007453644772547,5099310847165424582,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2158920113465442712,13033334895026440585,524288 --field-trial-handle=2184,i,15893907755374070902,14774260869726630721,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4640

C:\Users\Admin\Downloads\huniepop 64bit\huniepop 64bit\HuniePop.exe
"C:\Users\Admin\Downloads\huniepop 64bit\huniepop 64bit\HuniePop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3688

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5541837e-8907-498d-a4fa-911be8f37a39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5541837e-8907-498d-a4fa-911be8f37a39.tmp
Size 34KB
SHA256 fb1b5262d387dc794df89d56496c55ed098af8ec8fc119b4890ea6d500625f25
MD5 eadbb864b6c39aaf32e5218a3b48e55e
SHA1 f84df1453446bc913604cfbb8888b2b0da9b46b7
SHA512 e6528e95ae202a4cabb1bc469180bc422611278bd32cbe524011c992bc45944725413f7707f1c87d5542270ae22a6765882070e05e1ae67a669836eb52eb6fb9
SSDEEP 384:6iFgZcIaSsNt8TUNTUlIlsT0o8HMHfQa99d/VfErqvpASB2i/fSUsBrxKBb437iG:xFeDIwgKfZfzEwWS+BdKBb437i1jk
TLSH
T1DCF24BE288D74CB6C59D97C7A77EAD12697CC073B4984A08B3E4A92CEC5B4BFD306411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 204KB
SHA256 afa7cf72771873a76090030cb3e66da3bbd7a61f0654fc4934a3aded3a8c2104
MD5 971f1d44e8d2201b032b86a47ddf1559
SHA1 21816693760d58bb48df06b18a58cfb58085773a
SHA512 4af199efc0674dbc7c30f5682ddfbe2622fbbcea3872dd1f18de1555e27658bbe17247f4ef9cf64891465a8d72e14a90b1838da5200457de878e5de722c64b27
SSDEEP 3072:Un9ahE9fLr6Po44xgOJmMa+OsZB8Bc1TD29oBiqkh6zRmMDrIV9bcvoejsPQnImc:0a+1x3mMDhBp9VWqRm40HcpsIIKZg
TLSH
T10824237911CE427503BB000D0891BC27FEB84BF648759DC5AE815E9AC9FCE7190A7DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e8306605c0bff74101ad82dd8bf3f4294528e3d3f0f27bff17e6cd455695b082
MD5 873a5e73b2f0addb21928d28e2fb8f7c
SHA1 54a217e543cded764efab47594e9f7b56a666028
SHA512 7029b606421fc174f7633cd95696f0a8768a35937a2004b0961fdf2806dd30acc1038f2c38edec1666d51c363125dff068a86dbf71d29ea83c72880aefec94ce
TLSH
T18B718049C2590C91E7601DFAEEF2B63131B288C40993CEC1A55049FF6B0ABE98C6F847
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f1d135238f4811c03924faf9ea1fb8903307301e736b9030871f771af7e581b4
MD5 f11fc058edf9c7c67866244f1903fe1b
SHA1 0be7b4c10ea33b8974e432bf7c4bafbf24a14f7c
SHA512 518f7a045a17b0c5f286b74e558743f032c1ab0d5d2453827f171d5c9fd8d8f430064b13826ae19c1ae042bcc570547da0b1676d84592ce3fa84b456fea14d3c
SSDEEP 96:0UhG6FjWwVE+qiIUC/GkRggXPY7za3Wz3VgUUP:0edFjWOxNKdNY7za3W3UP
TLSH
T1C091A75D82A90D91EB601CBAEEF1B935337188C40553EFC2B55046FE670ABE95C2F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58876b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58876b.TMP
Size 3KB
SHA256 0faa5ef25efbe7a77b9daabfe62393ee958920ec1a0a015408a9f328ad2bbada
MD5 ede1e5fd690590af3a9b2ae37af1dbbe
SHA1 d6b9c95f7b14033de47facfd7402e52112149697
SHA512 c290f64337fdd5c0522ee75feee2267a447c2359d97528c6820d68e23e3846b19b882fd5f5715a3d5e8205197703b6706e4286dcb68979262fbeacf546aca542
TLSH
T15B717F59C64D0C91E7601CF9EEF2B27130B284C809A3CED5A51449FF6B0ABE98C6F807
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 8b9e374aa8819a072901ab797dbf2f531a699303193df66d421614931fbf9871
MD5 c08c78c5196524e4dd0ed28623078ab5
SHA1 90e53d6f8e4cef467fb956d36b288b5f16bfcdd0
SHA512 45797a5e75f85ce87329b37fc919a50df03a0b5d8794b059170eb89f4500f87f4cde886519806ce4f6b8b292e16b74b8f15ca65235b104096f93469c2f7b3fca
SSDEEP 3:MsEllllkEthXllkl2zE/lYjVl:/M/xT02zz
TLSH
T1024404047FD00417C50411304053C37113F0D41007135FC3345D4C33DDC57401C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 41cd51a4c198de2457c3fcdf50082130b1c9592851c126ce90b48c6d412091ae
MD5 76e79269ebc748e20b43725ba89bd6e7
SHA1 5af2a782e0007cf853f6783e9e1f519416540153
SHA512 00e797ec1870a64ee07dd04b6b984b65e4a1891bf0544aed42bf5c357fb06a3608d637bebae5cbcd0c18eb115a2a2ca8f5796890dc98085fad36e47ac5dd9617
TLSH
T17541ACF787B5856EDA1156F0AA04AF1FCE1C0412436C7C6985E4AF1BA3F28B1E101B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 09d7ea151cd7f37fdb3e1c3c58ade11ea1ffe222b72c7a0701b23f3dd17ff4d7
MD5 03cd2a6534c1c20face0684cd444e60e
SHA1 ebf909b629149f73ce59bec7c5defa456ee033c3
SHA512 8304b9c53fe109060fdd7ec57cab42cab1881edb597204037e9b60f23abf94340896e4ea14cda7c520f3dd3c3c51fb0f00b5150f06833d6c6b4660d5409f8235
SSDEEP 192:sxZcReyM/jK1Ml8Mkz/fksLFWJKIdp1YHW6+WNaRW/YLk50ZZIgrJ:sxZcoMz/fksLFWJDWHbB/c9
TLSH
T1AC52D7166B349977CCDBD20DF955BB53E6F50462E2904E44AAFC8A0C04F6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eea98040123b084cbe6a3ab78fa894c3e454b5dff370d8047a3d8d059ff255fa
MD5 564748632b633d4c5fafc3945c7c19d8
SHA1 866bc3dcdf74f843ee952973c00b6c09ea18a50a
SHA512 04c3c43392c7e563d81b880a37a99770bf023dbceb16fa189433f6464e1a9d99e8a1b262383e38d56c455288dfb2976f7e05e1e9b80fa08e73eb9d1edc38860c
SSDEEP 192:sxZcReyM/jK1Ml8MWPz/fksAFCJnWdpmJYHW6+WNQFtBSQP/YLTR0ZZIg5eJ:sxZcouPz/fksAFCJ2JHbax/7Y
TLSH
T16A62E816AA345A77CDDBD20DF941BB53E6F50462D2945E54AAFC8A0C04F6BED230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 529e8dd2c182b475b48e102ef42e5d8748fe477ea16e33af9705d99009266cf3
MD5 6e08e00b5d704bf1d7300da4ed2ca639
SHA1 10cfb68f0d1fb782f831df0ccca0e16b39b99c97
SHA512 41bfac7acd9ed851cd58b10659fa6c2c1948ca3025122506a0ba6788edcff1d02b3c19759becdc2bcbc026dab405e278bd6fdb95be713be929e0afd6016cd51d
SSDEEP 192:sxZcReyM/jK1Ml8S9z/fks9WpVnFCJnUzbV0ddp4nYHW6+WNQEHtBSQP/YLtsObD:sxZco1z/fks9WvnFCJUVuBHb1x/s4m
TLSH
T13A72E716A634597BCDD7D21DF916BB63E6F80422D6905E54A9FC8A0C04F6BED230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a5eaf173ab054f50c8ba97e35ecfe81136294955de63d097456af6385e9e499
MD5 9e3deee2588d113d88fff5967faaa709
SHA1 ef85416fcc26f05766b7aa849b631bf3eb33e0c3
SHA512 dcf41dc0b4e9a4fda20318bf65842ea618c6f1a432a49c1c7487cee04050e9fc4044ca24ff6c342c9b0e0be354f83381e93fc4a2a213d0471fcbc813e224beb1
SSDEEP 192:sxZcReyM/jK1Ml8M9z/fksAFWJKIdp1YHW6+WNatBXYL450ZZIg5sJ:sxZco1z/fksAFWJDWHbCX4K
TLSH
T14252D7166B345A77CCCBD20DF945BB53E5F50462E2904E44A9FC9A0C04F6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6d55dcc9939fbfa0aa8bde8fa81d0e73590634c302d44f2c9bfd396c16f6756f
MD5 b94014abe9de16b7d80cd978b5425e8b
SHA1 0f1df3e23dd8f70f5d8ffa2a6eb4f833907807ef
SHA512 edffc092f4fe533b0cc83df70c347956d73abe84fccf688b5aa4332d29ada226140a0d5aae361f9bb8d2e4b313d5ee3c399b9e3cc35f62f6d885ca4731f712f2
SSDEEP 768:8+s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNvrorl:8+s6pD1WvxzWju1jahILIsN8rl
TLSH
T16ED2FA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 12fc3369d09e7b5b1c3094b96a0c8beb93b99e3ac98020f5b440e603cc9ac9e6
MD5 eba0ec87cc80886d4c48b62aed570dd1
SHA1 a8a936ba350e253848a448198db3abd99a4ebb36
SHA512 076cd8649f1cb5f4c9106201be35a70a4e8501a1efbc5d1ea6ebc7ee3e6dcad439c81a40a3ba47e7bdcc7701af41b40cc6e9e057298f9cc0683d1cfd2b60f038
TLSH
T11331634D8EB0CD9FF8A441B21572B5A4737098DD0A22E7135C3C31327E237192A0B4DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f8e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe58f8e2.TMP
Size 1KB
SHA256 1cfb7d4ddb61888e56ce849cd4f472cf7e84177e681909523fd3a26eb56123a5
MD5 3b95e1710f0e4528fef3fd1fb35b431b
SHA1 b4f0111b0a378cbe13245beabf8a059597c76434
SHA512 626f8a575ee605ba7b8194557ce0992b2e2885ae21f73f7842845ad725ee227f599b5a6567176e6aa60692dd652bd4a34b8d2e1b1fcfb49a91bc647d1ac2d889
TLSH
T13231424A4AD18D1AE4C4507B0E63B8B8733598404311B793987C62399D25B9E2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fec6470209be76b4bbd4f498e412cbd9f2af8364a87a9652bca73ffbb97422bc
MD5 fff33617ee9a906148f7eb16411b3401
SHA1 7c4def22941a7d5305e07d404da4cbe74f1d14e2
SHA512 96255d5f3b147b2a41e304bacf7821d7c6152814a6edf895beeb7006b233a5f8129e9b164619c342ee0db915f0a4a52be5b536d9014f1970f4024daea9b23a71
TLSH
T1B5E0DFBB6EA76830EDABE3E7287094B502823D2CC805BC4F686EA6C350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 68af2c2536cdac8b58b18f02102d91d4b7173ede77c634c511c673e5da1dd26a
MD5 85e3125bade1849b3ae9edbab4309ed6
SHA1 d6e654cbc561bb2e2fed399e25eadae50e8b55b6
SHA512 a4d1b5e7271cbf66ba092692e358b118e29febda1564add46895ba58dcd7d7dcac44217d67b3ee28bb6a70f8dc778dc7d0fcfebc18945064186033f97f758bd1
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wb:KUAAKtePiwQKFWvC6EKfKuurmKA8w
TLSH
T109C11C12717B0A023D7D2B0CA255872A97427263305CE92B3BED40755E6AE3D4DFC6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f75b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f75b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3b519ae22a406eb2eb73e7068126dd51b8a52e5597e9db0614e9f544a686604f
MD5 9cd0ac236dca8bf4fab74ec485abe996
SHA1 be8647117f3d3eb7310228d617eb0803c02fe0f5
SHA512 c47896dbd0cd356d0f40b1dd8f78b34a6d5242868bf9a5dda026dd218e61f6ea3785ea44642e485d83104932471ef4148d5383c6699e98a1a8cd60782b051262
SSDEEP 192:ujm+xasuheOwQxMGsNddQho8s7+3vpRQmiU1dyzL4atb0j+Fd/cQzDRYLMZqSESN:xZcIhsNddio8HJHAUa99d/Vf/KScjmwY
TLSH
T1E7928D366C785C769EB2E045F4872617AFB88073DAD96F80D5ECAF0C01EA5BC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 528412485188e09cbc773149a5c9f25e449b18af844856d58d48b3aa7626ccee
MD5 fe0a6933c50c2038225360727b05ec5b
SHA1 3b31cfba37dbf8c8aea5cd4d16e2854cbcef161b
SHA512 6d00e62cc7c908b2d6ec9130fdb5b19c8d310c3e4a1848a3a053e20cd9f93e9f615707b5307d8b1fd6bc743de81569c67bc579801a09eba0b60d8e5c763770f7
SSDEEP 192:umf+xasuheOwQxMHsNdY9Qho8s7+3vpqQmiU1dyzL4atb0j+Fd/cQzDRPLMZqSEG:FZcIssNdsio8HMHAUa99d/VfSKScjmwY
TLSH
T1AF928D366C785C769AB2E045F4872617AFB88073DAD96F80D5EC9F0C01EA5BC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aeb7314685dbc732825688d1a8a2ae7d31edeaf4b5ec8268643523667a24c565
MD5 698b9019b0a64c2658a89a92976c1693
SHA1 d4b624c0e12413a85afa83a47ff163c6810d9668
SHA512 1453e337674c883fec30230b73950a1073a00ffe630c1790ad8f91d76a43ed0d554a1acc10b84880b66d93e89d3eda8c8a476182930daba453e2e8b1400b6471
SSDEEP 192:qONt6O7+3hQmiUyGjGttb0j+Fd/9UgGn6W8rU6:qONt61xGt99d/9ant8rU6
TLSH
T18F02D7396C7C6CB78EB2AD49F58727235FA5117BE9962F81D6E81E0C00E765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 510b99c387489a9d88c47578f9778fe0f03103ff1042281b6d5a35b954dccc07
MD5 2621d4009b100513de3177bee1c04f76
SHA1 7a5f634abd9d0456425a5933e45ef6635c5f6d4c
SHA512 d9fde14ee3c7dc8fef188a32e2a7dc26c2152b113515b0c1820652b91df02a0c6108d24a62c8d372e34172b3f2dfb953042a2b1a6662a538a387670fe34abafe
SSDEEP 192:iONY6O7+30QmiUyxVj0ttb0j+Fd/cQzDRucNZqSEU6:iONY6+ih0t99d/VfdKU6
TLSH
T1C61218366C7C6C674EA2A445F48736136FA5417BEE8A7F80D5EC5E0C00EBA6C230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a09b7d3-a1e6-40fe-82d9-f2e25219694e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a09b7d3-a1e6-40fe-82d9-f2e25219694e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 162f15cba75c0ed2ce9e529deb7a2ce9b73f0786366dcdfa77a1e63dcd85ec37
MD5 388564ae6d0904fec4cea9d60a543903
SHA1 89a3ac0a273ef79db0aac8c1ae621cbc6f6d83fb
SHA512 d74e620566281c4dc96f62ab13520d47e690a8c6dc0b63d47c5def94f32427cd06944baba5fead9cf6f1fe741d38d17235ef9035c166605f848b51430d91473b
TLSH
T1A241395CB5FA1148B3B76E5AABF6B82E547E7D372E06859D10100E4F0A63B41C861737
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads