Malware Analysis Report

2025-01-03 09:34

Sample ID 240603-3rg1nsde3y
Target tin.zip
SHA256 03342bbc76d065ff51aa005c1a4b54e80694c19b808dc0284f466f095b31b1b6
Tags
bootkit persistence
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

03342bbc76d065ff51aa005c1a4b54e80694c19b808dc0284f466f095b31b1b6

Threat Level: Shows suspicious behavior

The file tin.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit persistence

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Opens file in notepad (likely ransom note)

Modifies registry class

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 23:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 23:44

Reported

2024-06-04 00:21

Platform

win10v2004-20240508-en

Max time kernel

1770s

Max time network

1431s

Command Line

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

Signatures

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\readme.txt

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp

Files

C:\Windows\SoftwareDistribution

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

MD5 3dd6d73a9bd330761875d99cb167d393
SHA1 ea492639e5c74db2733c2e8f089653259188a391
SHA256 082f4061e0bce65a115c095229f5149f0f21828babd7ea6f4a073a58320e7b9f
SHA512 5438385d176c257a89fe9df6f6d8c3135d5ebaef4beaadf742a9d9e6dd67adf5abbb05417e97e9ed7972eaed9d2064cbfc6797b20f1a71e0a415f0add3d5c28b

C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

MD5 9ceed525058366d7aab02e3b2946ef33
SHA1 bad5b8e44cd462b53b6e768523f60e9d79ab2d37
SHA256 e3c9be35e351ff470536ba97c345cc72e821b839a704b74a8fcfd54bfbe19cf9
SHA512 e44e56a005ccae30c4d53c15a973ceaf72f4f617a3ee65ceb92169c26b912b1725e2116e9bc09f062d6af59587ba41427dfc3cbe3661e2797cfb5516edd8dc95

C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

MD5 6e56587da8cf0d924b2f62ae7283e795
SHA1 4d6c4a76c1a6a18bf923e2d4c3219c642c84e672
SHA256 1ff4ba196dcdc5bf880ba03e506fa58f9369e841a34013d1f377c28041e78351
SHA512 21f4016aff123faa1753517d48a759d3f448dbf8dc4a26f209c0152cb8b9d9441f13c052639e022b9afb45237b8e647c5b206ccb5b5ff9474a38a2600d991e70

C:\vcredist2010_x64.log.html

MD5 29fa3abf8498e05a3c7da6229d87ca20
SHA1 66a81d4913a0c55d6f983de502df37d0cc5a5a37
SHA256 9540ca5f8874cfd2e8028923581430be48cd3b6fccfbb4835b471b9e867b334f
SHA512 a0caed283fcfc113c5d8e0e32cc0c1bb33799aac27881cc4bbd23c82354455f2ed54de54f765e247cd955476b6986fee8b95869d5b87be1b8ace1fc90b7a4cae

C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

MD5 50e19e7ffcc48878c5a2cfbe4f80be4f
SHA1 f2ec9fa8a1a084f8d63c201f72d994eb73588f4a
SHA256 9b866addabe851abe05861fb1644619040970911f1284db9e3ea0055cc2d93a0
SHA512 b4927aa8237e3667ba8e58d522021284a184de2c399a4addda1dc76f13e928fb2bf44513696bfaebdc327042fb2245c6ea61f11169d85e0d8f2b15e1c13bbc5e

C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

MD5 8e16d5fb5a327b485dbdaa1618ba88e0
SHA1 0c189cdbb7662a3ebe9157636b666285db338044
SHA256 35c2746e3826fee257685d6e031e5adde0dca5b03988c137a5619035bacd6a98
SHA512 945d4b77c105e0d44e8943f1cd9791580937d50c041c5a42665149595a3bfe0e60752987823615b0ab2d8bdffe9ead598a63b5b3a8edfe978267fe17368bbdda

C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

MD5 d0f06dfe065d480846a96547704962a1
SHA1 25774772beb875ad08548a76d411ac61342de75a
SHA256 2894aa9ce588c8a5b3a8cb6d66cddd27410487b4eccf00a02cf14393db47feb3
SHA512 8e590ccfed137f25056ab0180c1f63bc486c4b2c1f7c62f27501e16e88c0df1b19d05a719e16027bfa926380526fc395cdc35f16eb2a7e0abd0788d7a38ba969

C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

MD5 d19c4e2ac7a15a8ee0449e064d42caf2
SHA1 7c76b45126d99e0be5cf5606b2782210e1361b37
SHA256 9d64313f303aae37d6186843d4b5137d07590ead89299209ed6bb24c501fe898
SHA512 db47db432511c0df5ab5411061bef523a9187671710a8d92d1550630d5303ea7f03bc5ef0cd0ceaeb8c30181fcb9f0c02151aee029ff6d719decc940c65efddf

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

MD5 76e933518ce70f771a1ac3ae77cceeb1
SHA1 1534b2ea46d32e17c493be71edc438170d011048
SHA256 37c6e6ad897eacf1afbfd757d2a2b3cd34a069481a95654d9fe8e62b6d48a499
SHA512 9322723a6c0c13c5b939d942d58ea877375154b75894acf8484133ad5345d959898df4f933a387ee43deec6ca6b1a780ec6619dae14822ac0c4c34efbf10021e

C:\Windows\win.ini

MD5 23cf8138f49416231807e6de371fb9e6
SHA1 973672eeae5a05447e47395cde37e8121b7c90fe
SHA256 6b3d6e268dcb76e175a7db3d9e031349ab2c32654c7e57581a851e64dd6214ab
SHA512 42ae18a96645289cb0246d545daa955d2fb0784993726414d0bc723dfb58b33cf11bb6b62ba7f5a3765e0c6c5713e8a02cd63638877ca032b82d4806e79950cf

C:\Windows\Professional.xml

MD5 c186ef70e6825d333e0077831c58baaa
SHA1 13164d000f4e7dfcb5b73b837944efb7c8e4df2f
SHA256 4f3a12fc3e94b4fd72989532b43f9d98a6afa4792493e308ab8dac43e5d3748e
SHA512 02680c6ffac6753a32d1505b9489f5f215e47ebdd0df3c0b26746956044f1cdd33f5edace41dabc7bcc0b7340d31619b580655d8400f08a1549c99bc0bd9c394

C:\Windows\system.ini

MD5 286a9edb379dc3423a528b0864a0f111
SHA1 18db3e3dfb6b1d4dc9bc2226109112466de28db0
SHA256 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b
SHA512 588720a82941b44338196f1808b810fecbbc56cb9979628f1126048c28f80b946314092a8dd26f5e7aca234b7163c4b9c1283a65c9b36be2a4da9966feb8b2cb

C:\vcredist2010_x86.log.html

MD5 379e5a62729b3f11dae2a788fee685a6
SHA1 ffbb0d3261283088bd9a6e9bfec168e5fabec7e4
SHA256 1ca819d4ed56eebd4fef2886487b0b0a5cb867ac0d9c15cb4f3d8bc282c65275
SHA512 49a9cdd0b707b9d3693bcb57b17a87e7af031b6969453a8331e7e95ce966c5e1d974ffff11bc4ad5ea81c86cd776116de423a6515a43ae01b975904438cbe1d3

C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

MD5 7fa6c7a8401e9107ee0b97cc071ffd06
SHA1 bb5e186f4fa27543c242329a5a7a852f1033aad6
SHA256 8cffd7c4b3684ccae656fcf42c0fcc10277f2e9fb20bafd34dc3e7a7cfd1f814
SHA512 07a358dc47b681b6032e6b6679a8a96fec99979bfe7ff1d4a933f038fd528df856bbe232a11bfd05a5be4562f0d0ebeedefb2e92500c9bb41199342c173d1ac5

C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

MD5 80a338b1029ca48be813c9d31919ad80
SHA1 9f7a43be779c51c4038f6637f3bb44a015255714
SHA256 47e71f40f561c8a360018f98b98ccde13a3b054675aa5f83866139ff81459a6d
SHA512 3f0ffee36ce7a4fa340cb5e2649418ee7d35204d927aef3a95a82ccb0e4d729bfacdccf72388f2bb7a326c88556b7c9f62350b88fc0acd96b1936544bfba498e

C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

MD5 62fccb002f87090379c02bf17dd982f5
SHA1 ab84c05080cafc02993f8b689267e8d147050156
SHA256 46c6f75e4db12ded5064356f31a88731d3636c460db5e34d8105e6daee5681d9
SHA512 f2aa41843f48266be0f3f49079725c02f91c46461e0dbfd14df52b79919bd26e4f854af5ccfa190292cc42dfd0114937ba155c8fdf6a759ac28036308d0a7d63

C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log

MD5 9fac291f79714e0c91f770f3fc816b79
SHA1 fc37c6acc862a7727c964b418b8e459f5d0549a5
SHA256 7ca39089591590d11d0646fbabfe60e62e7ec5d0f5d9da24717d5088e6c3cc8a
SHA512 cac75ec803bbeee002ba49c91c4d8a6be5dcac477b9915a0d34fe5f7af39f40c53d7793f1a81c8415017fb5deb639b5d8aade6ce2048d02a9a0190ed69cd3590

C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log

MD5 ad0db0c654535e25f77cd5d6d1aecdee
SHA1 b1ccc0c3569dbaaaa139e1c77978a31c453f71b2
SHA256 af1ccd58655ad736f8a3f7793fadcf96fcb469cc0e2a9869e7e0dc9d00ba5765
SHA512 63cbc269440dbd44accae273eceff388e5b3345132a1747136fc8b5a5d0053dd5c609f569f527cbd0442afe730d8cf8796619be8bd1c335344778f31064c33cd

C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

MD5 61737c9efdaa729f78ee3c78e0a57534
SHA1 9e4018393f97928d0d9a1a3034c3d2605be1535a
SHA256 88acf3b26535d00d0b68bd45e4be798ad79dd0f32086c72cf5bd4fba406668d8
SHA512 12e14166cf174ad16370cb5f0b331cc2b08dbd76da154dc6f055f1c21b7a2d700ccd4f4483184ee5c2c8f9f850948edfd3f59791a2eea6d0f85b3e1e4a99b515

C:\Windows\SysmonDrv.sys

MD5 ed700f1552e668ee3b7e28d4b1c0a5f5
SHA1 c620f8ab8c725ba70cf4d785035c795baaf307e1
SHA256 e856ac7870bc9ed7a02e09ff0548c880746fdae08401e059b853478dbf034626
SHA512 02bb9d6dc7ecfa3b31eb4b8cfae27c03d7f3d5da2be06f858f843172491281f3cd43d607321c9889d3c1476183a340f2993b5dc922072d8fffd3e45a8a5ca8e0

C:\Windows\PFRO.log

MD5 856127c0b5522ccfbf73080a7c6c85e2
SHA1 5cc21bc6be3f77d25e2e8ebfdd1a8ccc7e59572c
SHA256 2c2ef24b9f59f37619ab1d3fbf8ce9b2a907aad169c745c90d8d9c24588d1339
SHA512 66672fd2962facb2f8b205e636478c8c65050337422d0fe04b0f0721f46496726dc692d970fe7c448cff6c8f34a979baade36919ff3944bc991c2ee58044199e

C:\Windows\lsasetup.log

MD5 eb33f5192061130474d940d542829d83
SHA1 885459aab6d94a4e3aea0188d5f39ee7502f0d59
SHA256 e591a0cb170f2878ad6078865db3ebb2961693e93903f57cde04fee6e5d51530
SHA512 89c61bc55c0170cd008cb6c847041fa4642f197e620f5ba4b99012c7fc6d042b1c051ef7071b8fcd051c82d806bb33abb08a76ed6ea916fd4d4e1ad186ea2403

C:\Windows\DtcInstall.log

MD5 b886b587ae0f354148212f8e1398cbe8
SHA1 f85b92ffe650e3148f5c47432860fd2ace798e6b
SHA256 3f8aee449bd30f0eb03ebfe52b1be1eea076085bf230ca9bd549c8d5d3f1e756
SHA512 a4ac03eaac57c983b26df0cc51972df919ff0e3b09dd3eb398ba447c32633341b188914fa9b05b4afc1e9ce99b3414978d8ec05e60234e8f689f6499e4c4a4ef

C:\Windows\WindowsUpdate.log

MD5 2cc83d93dd1dde691158cf5e9882420b
SHA1 49bfdc6e1e73e09a0dec345ca15b72d167add3b6
SHA256 455ec4f5b15557762b893388b591ca9f3e822675ab94fc6664aa4ec8c41cb295
SHA512 e67f883a016b7a410f4461492bce124421bddccf4544322b9a460a56df469170b2323fd0325e2cf928193fb6a1323c31cb0d464097f25d2f9b11af3bf9ca1b4d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 23:44

Reported

2024-06-04 00:12

Platform

win10v2004-20240508-en

Max time kernel

1007s

Max time network

873s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tin-safety.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Downloads\tin\tin.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{79862AEB-6338-467E-AA5D-47B0F8EE7E54} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\tin\tin.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\tin\tin.exe N/A
N/A N/A C:\Users\Admin\Downloads\tin\tin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1692 wrote to memory of 2176 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 2176 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1692 wrote to memory of 1160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tin-safety.exe

"C:\Users\Admin\AppData\Local\Temp\tin-safety.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x308 0x310

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffeea4346f8,0x7ffeea434708,0x7ffeea434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4944 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x308 0x310

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,17531743493100916052,8835777949613644365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_tin.zip\readme.txt

C:\Users\Admin\Downloads\tin\tin.exe

"C:\Users\Admin\Downloads\tin\tin.exe"

C:\Users\Admin\Downloads\tin\tin-safety.exe

"C:\Users\Admin\Downloads\tin\tin-safety.exe"

C:\Users\Admin\Downloads\tin\tin.exe

"C:\Users\Admin\Downloads\tin\tin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 98.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 23.62.61.129:443 www.bing.com tcp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 40.126.31.71:443 login.microsoftonline.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.154.64.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 rr5---sn-aigl6nzr.googlevideo.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 74.125.175.138:443 rr5---sn-aigl6nzr.googlevideo.com tcp
GB 74.125.175.138:443 rr5---sn-aigl6nzr.googlevideo.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 246.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 138.175.125.74.in-addr.arpa udp
GB 216.58.212.246:443 i.ytimg.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 rr1---sn-aigl6nzr.googlevideo.com udp
GB 74.125.175.134:443 rr1---sn-aigl6nzr.googlevideo.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 134.175.125.74.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.187.194:443 googleads.g.doubleclick.net tcp
GB 142.250.187.194:443 googleads.g.doubleclick.net tcp
GB 142.250.187.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.200.42:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 static.doubleclick.net udp
GB 216.58.213.6:443 static.doubleclick.net tcp
GB 142.250.200.42:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 yt3.ggpht.com udp
GB 142.250.180.1:443 yt3.ggpht.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.200.46:443 youtube.com tcp
GB 142.250.180.1:443 yt3.ggpht.com udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.112.22:443 collector.github.com tcp
US 140.82.112.22:443 collector.github.com tcp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp

Files

memory/4048-0-0x0000000000370000-0x000000000040D000-memory.dmp

memory/4048-1-0x0000000000370000-0x000000000040D000-memory.dmp

memory/4048-2-0x0000000000370000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_1692_OWXOPWDTPFWSIATE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b220d198bd9c34d367b885829ebc16dc
SHA1 ded6fd41a5a9b70b28502a981d21dfee51306441
SHA256 f213ba8eb05d05b65e49e1ab1b4a18c54692e0312560381f97e16b347898f5d4
SHA512 25a35624c3374c50982df9890a22c94cf15610e6aebf01e5058a7a79cc75cd94b75cc77d35e5e2958bf8eb12461e3def23d4bf7daddf6bd1a792559b574e945c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 401390fdc3c94d226fd5308f8a4f029e
SHA1 fc91ec66c2bd2834421ec9deefc8beca84e7707a
SHA256 eddeee5348c55bb1095060b1f982caae3b6080def55781884c0ee4b0e4a5aada
SHA512 76bb2e54f25a10ab2a34a8a4fe46298a3a574cb52811c55815ef6b9607af96b30a021dab66c9c2c23667a1a3d89d34c19022ac7afdd43132b585b93e84bed9cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 28f3ca00a6cae544748f2792fef16c27
SHA1 91ddc35c5289b9e977bf702c95294c7c2ba2a154
SHA256 ee7c6b687780f3153fc2d1c91d45c8892dbb860e6ba0b80796079851da1c72e8
SHA512 0e2c779a9cacc52623178bdafdf8d0a79bd071cf3d31fef46dc80a1b621d293fdaed9bbabcaedd1060c84fcf7aaf7548156c7df30575e758a229b0eae8c584ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0d9f133b94bcb6e0fb20eda188a656d1
SHA1 0a83bc6a5226544d6c8ac094c58865f1ee929533
SHA256 8a8490969f98b521e8d2422a9f01db668356934bf5aaa06bf41d4618e8f977b9
SHA512 c3aee0ba9c5e78cb7d4fbc11ea83766f017be78d541c259c22e6395699b7c1eaf19603b655442fdb55f09309bc22390268777daef26d00b09cc9a47f308d766f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d0cb4fdada4d7a0cad299f9ddbf8f350
SHA1 bedbd41c31609b9833f89d8fa74cd2786615c4b1
SHA256 92504e927dfa0a90b586ada229aaf1cd65a32ffe79480949aeb77ec5e61edf55
SHA512 86b4ef0575e7cd5118cdd22373452af11a778ad2db4b570b9013026f378a8940b2d29d84d889b6cbb67986c9e2a64e32e2a10e88c3c6d19676422ee9b4ed118d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 18fd29e1816cfb6a3a2f28702dbd7cf5
SHA1 11d478ad69677116be62fa5d9084d9f1cc3a0777
SHA256 e75965104c548a6b8894fb4bac3e5045f54058492076e43eea3c6a4dfc15628a
SHA512 bfd5e5c9803968f40964b1be7e1a7ab840ba0bdffb1111a7a92da811611fbbf093bb54180156317339febb8b98c586422e2a4f08f54990e37621fda205beeb0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 30fea94c8ca6b31860f61ed2d1c18287
SHA1 25524d8d08afac2283919f0df0013909469bb260
SHA256 66a811042a3c18614421b403fbdd7b91fad4e0db7688957c396de80062c5d44d
SHA512 e64b394d2644b8dc377201246d9421e53b73e20c312ed70d6be48fd4b1708fdc2bfa03ed13f8b58a28ba5f9c39b69b16e3fad5a933acf6beb30412e9373506fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 dc427a6b25bb3ac8d2e07e508bacaaa2
SHA1 7ae397f742cd0a45762567c53975777aee04b61d
SHA256 ebd50b726d63ced0c198cb6fdad6e43bfed52ecf231b4b5ccaa84fadc51cd9ac
SHA512 f8787591f079de507f9842a9be36e1626bc5b9de2bb1b04a60efd076c127726832e159e2c52507ef8d7bd1dd6b657ee2d9f6c200b1723a6e83e01104192a7fc4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 0589079e33b348ed34c08856971b96c8
SHA1 41e63113c23eab172aa09335da1d4a658df11710
SHA256 cf1c0aaababeb3f758bda4ee9be3199559189d37da551e46f67db1da3a572046
SHA512 45f0bdefcb66b4458e7541b8935b4987f16b9ead9a101bc2c8a81ccd6c95c577a8437c69d84f2307f70f317588531ae45d65603498dd015a2cd67ed0b904ef7f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe632e68.TMP

MD5 fda2e1cd6e2bb661f5073afec7f5a29b
SHA1 6d5f0225ebf00046d96b3862cd1cece6ebcf04e2
SHA256 42792f772a9111df31423728a0ea95bf0147213984e70aeb09b8c8f73e160d45
SHA512 51cf237d17214f0664f2a30569c4c9102044a3f8c7e0ef8b731c981271f49b7d84e84b1794a8337ed40b21883f71dfa4837bc7ada031a59472ada9c124fff561

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 dfa32a4f91fd46b0e307fd87a0a50eb3
SHA1 7e7a4a0ea0ccb3322ce6a53ff06f98362a841bde
SHA256 c5d1a07e422824d8088612d6a1d13fceae86417a743c5e4a64dc87dfeaf4262c
SHA512 6b8239589f508ef3f1afa7d045236563d4eb682af8e91ea82ca51edb2328e430b642063371d37e80e0c10b52d7eb13f79c4b3cb0cb3a5219d74626a55ca4c951

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 91c33fa6674afbd1209fa06b2bbac09d
SHA1 915ef905f975e26257064bc490d35585726828f1
SHA256 a6470f7cabc76aca78671529eb6f1977f59393669111cced8396857d35952b5b
SHA512 af9b494e14ed2c17dc57fff71d27a3ed952ee7020c71f3e48bee2af188d20cd0da8febf39757c5258922c6237e04b3d79b6b00a7f9c67c33b17e69edb5f21759

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e10c2cac21d53c8c2f7b907d7fd90520
SHA1 8df8d8f7e95ed08d4b26d3152b97caeadfed68f7
SHA256 bc141733812bfe9ba9bb5c4d2578c026eecb8db323b5a79a349b84fe2b4f15f5
SHA512 2cc7a46528ec1c4ac4908f946d2f73ffb184d7e49f5c4fc11abe265339f8171f27472bffef360c52dfd5a725c1ad96072b8f262a2818ac01a564c8cdf2a28189

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe634b85.TMP

MD5 6b973367738c7cb8e4cc6f98ce46b14c
SHA1 ce6b8953967e987611083238291f44ae1320a2e9
SHA256 3ce13b927e45f5d0962281c3d4933a61079a6928394647101304880d11f3d8f0
SHA512 0e5ed32742550b9e30928ba00f33911f5d4ad3a7ea1dc132efb3d763baad76f835372026e2d43915d9d970ecc103d83778efb860f54677d23375fe2766c7c3c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 83ef81c6a0482e43e5bc64b7ed802d09
SHA1 c74cd1314d440a042f883619de888fb677f68289
SHA256 e4882fdc67570ca6f9510f78025198cf968a03019af050c5e09cc605384d137d
SHA512 6fdd9f0d89738c47b413d32b9a5b985581180da0a19a9328dc1a6938f26d344bd09b40c76e0d6f2ce0a1af6680a912df11ea70d017305a132570dd5b1bce2182

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 c9981885aa070b589b57bd644570456c
SHA1 496a4cd5531d5b194675cf4f445810918d388815
SHA256 686a5e45ab2b40878c6d7269e6a486e61a52f31309d1285bf03cecf5fbc7baee
SHA512 05d42194c1e05a15a80772173b3142b4b8fd7d9700d76b86106319458fd9d4100d369419873ee8f854ca2000d61d8560fffd6906107a6c66e4b4e3e0d191a559

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe637de0.TMP

MD5 d8f234802d32a39251373674cc7e2e7b
SHA1 29900296a63c90e693bf6642008ce66fa0c71fd1
SHA256 84bea45dc5b9ca8f5fdb9c90e3a59d69369ec53287cf4920d1f45c0669e46e8f
SHA512 baba608fd21807088d2c6887f783a5aad393935547cb0b4ba673263dff523bedfb2097ad77dc60f8ec2d749a78ab217da33b568a21338fdbc226711f4237f6a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\491ba3f6-4c90-47b3-b450-88e26f3d8cbe\index-dir\the-real-index

MD5 4fac78d512e3da8779b3db3b214e332e
SHA1 67f2f0ebd05ddd00d8f4dc2bd2418f1be526a3a5
SHA256 8241044bac3f90366a82b47fe777a3eeabb89981af5963f3154fd5bba346d8ef
SHA512 ff2fdbde7ecc0152c7f6b699b630ae61a2215c8d3c6878981883f28d2ca91ec174ab07819433240d83bc1a35bd9bb0f5ee0a6646533a0caeb02834b9ab78c084

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\491ba3f6-4c90-47b3-b450-88e26f3d8cbe\index-dir\the-real-index~RFe638b9c.TMP

MD5 2234b3715f37bbe74ddc9be2b3d02a58
SHA1 34b251b91bd47c33321d669f5998ea2f248d28c8
SHA256 52f0ee161e534243e54a1d9c4023026c04c2386608e2b6a9ff4f07e5f8bd3cf7
SHA512 dc97df958c6ef4cfe14182f823db4be0e431a6ebc9cee7c5101f9ea96b7a9ce056d8cb3c4abdf4d0909aebbc777ecb64076d99ba6230b3ac972056fbfbf305f1

C:\Users\Admin\Downloads\tin.zip

MD5 152f7e0dca914dcd1bf8be3b5fc17be7
SHA1 67702bad91c3068bfa5e66e6d6c6119301f4cc1e
SHA256 03342bbc76d065ff51aa005c1a4b54e80694c19b808dc0284f466f095b31b1b6
SHA512 2cfd446cc218f4bdcfa0558cbf91aae7d653351fcb28c5cc25b4b7fda47d17e19b6ef2194bcab673d6f4ae27a71b65278899d90b67a3860688952ad5f1ecb462

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 647f971b669d8e5d9ab9d4feca827b77
SHA1 941c87fe4eba1bd95d3f51d5c71a64e7a07b8dfd
SHA256 68ab97d8d20f8d97fa42a3d16c08e410d9f33599c49c650d23d2e2ad58a16eff
SHA512 263797940451a710938b8c7bdca028c0dbd3582bf7880690113d6173daff6e87f964fc6724a3f6f813ebda8872b7cf923c260bc01cfcfee78ae87d340adec7d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e95b309e342c5698d4300d9852b45548
SHA1 502f2e729e88f9ce621dd7d801c08d5b35e53d00
SHA256 bb0996903926c3123e5607dbf3eb29dfbf26c994991717ae9e17773008f0df19
SHA512 eea66da8032641077c81810ccb9e3075d10733b005a2f9cafe2771ed8b4b7380105e56525c045854299f8df786e925be412b0a27e22cf47059e1946be1ef15a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\540746b0-a0c7-4de3-bec4-4ca418ef1efb\index-dir\the-real-index~RFe63acc0.TMP

MD5 1a1d654d6550ba07ce83dc5765fbd2d2
SHA1 54f3a7d4ab4d4d16418ea9325e132a261610ecfd
SHA256 d96170ca02fe77f738b6f71fd8280ba668eb7bc1486d0334cca41bcbb6b1d993
SHA512 a9000a16f508ceec6e398d77cd465f5effe76f40b4dcd46fad7d9365c07099b3874f7e9e76e7e6488eb2487d811f8f7f5e939fed6ea0792976fbf99e141c25ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\540746b0-a0c7-4de3-bec4-4ca418ef1efb\index-dir\the-real-index

MD5 c21535786768a430210cd8f2b6934a78
SHA1 0fa7b6592b7adfd863554714f17cc9bd01d66892
SHA256 3f444adb461822d34596a859deeedbd30c6e6cebd7a9ccdfb39ad9b1aa55425e
SHA512 fdb77584b895720445f908cd5ea4206084d6071d035384f97fe16cee6d8a9af1eb6af53d6cc83df016af9bad5ece7fd1f81f70208709b6d8feee1b13b0745f70

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 84bfd891eeb9d72fd56e061beedb7c0f
SHA1 1212e197b8b510f84adfae30f6712dc22c720595
SHA256 a10dbbc63b481eb1c35a0be4e275c39792bf6b0f1cf61b5224f9c5c5322e85ba
SHA512 88717dd96bd5ba5029497648e9d8d5922754188e1b1b4fd7bc2bf5da6218357d16a219fed20c0342c9c0b96408430aa72a57a848406ca0c636b8c7061327116c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3d00d2c48a507111335129a1e10a9fa7
SHA1 35b3c02605054dceaaf5886f88170ee3cabcfb19
SHA256 e633cd4f0afd2960d36dede7cb6ea091934501d614fb051a30a9726a700679a9
SHA512 3254691244a51e80f83f7e21b3088bc8c10a5f3add5b163f3d91e4ded40b622c3e0ed7a7a144e449064f74f6727af3e4910794607f36fd7e856c1e1b29c86b5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f670391fb8f17875fe57d9742d872722
SHA1 abc0278955c400d43ab365c97986508f1fb22844
SHA256 a04cdbdece57c1f914d4cf0a0aaef5c36005acf1a2d6f84d3f926cf947cededc
SHA512 9d2cd9382b8ec4c7ebff43cbfab023d72a2c69c461c57bf2a4ae489d0f37f70510c51e135493747f1c06aecab2cb50dc88a851891f71ef13404df7c526077cd3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e07d7b1b7da9efedfa57201b61783a6b
SHA1 453a47dee3859ed7039dcd6a99bab5821eae79f5
SHA256 e5ab462518b8797c261eb41b554406af552d0c1d9b6723faec602e1f14264e01
SHA512 af6f41afd67fe90e5a53edc1e173116d0bc91be42cb6b85250ce8e8754e104a05f588787e20b97c4aaa8b1c11a0c456e977bb2e6744a789b67eb3ff272420903

memory/4004-870-0x0000000000600000-0x000000000069D000-memory.dmp

memory/4004-873-0x0000000000600000-0x000000000069D000-memory.dmp

memory/1448-874-0x0000000000B90000-0x0000000000C2D000-memory.dmp

memory/1448-875-0x0000000000B90000-0x0000000000C2D000-memory.dmp

memory/4872-876-0x0000000000600000-0x000000000069D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c8fa50d971d854225476551cfa4d23c3
SHA1 33d7e1186dd88e095dc9da9290ff4120ba43a18d
SHA256 f5edeb1ddd834f23779fabdb883dccf236a602d26d910457019b278017ae41b5
SHA512 27b751e24c6f57e8d7e06f4e2b3ab26020ca76ba992fbc3fe8a0705130c23594d425b6044467edbe3242160ea42e77ec60f3261ca279424e7ce3db6bb78286b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f20c419e32855da7801b726c6a42edaa
SHA1 53927d3c41e2f13e8148ce80b02719877c7e5526
SHA256 ca6486797b1c73793b014cfefd4a856196fc9b3eb07bc49309eec9218e2ec0ab
SHA512 730f796f9b4cb50261bc47ac29e837df281581ca41b35d143f7350a615b1141f017e6eccf39410e288b285c0dd5cfde577bd28a4f4b423eaf52af3a6587060bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ac8e460e634b59e99bbfd294472c9f91
SHA1 5153cdd61f7b610b7504aacdaa5b8f963ec1aebc
SHA256 cfd5619d85474dc5cdd9907d16c36b712bf44d793fa691e311b0bf98d9f7d1e6
SHA512 54c29ddbe2a8c2b4615f1f53627f46cd9b675f7920e5a70f52519b97074233e0bcb269e7237ec49ed02651060cf66d7364a4387972274609b4e06d53cd3f2d0c

memory/4872-1015-0x0000000000600000-0x000000000069D000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-03 23:44

Reported

2024-06-04 00:40

Platform

win10v2004-20240226-en

Max time kernel

160s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tin.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\tin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tin.exe

"C:\Users\Admin\AppData\Local\Temp\tin.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x424 0x3d8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.42:443 chromewebstore.googleapis.com tcp

Files

memory/3696-0-0x0000000000380000-0x000000000041D000-memory.dmp

memory/3696-1-0x0000000000380000-0x000000000041D000-memory.dmp