orcus | db01ee3d2bd504fc4f03cbdf1a2d5eb61f2b59bb1bb19ca66cacf29e39e2f294

Analysis

max time kernel
280s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123.exe
Size

846KB
MD5

5791306a6d85166a28c4a678ed473691
SHA1

bca4557e4cd3f7fece5c44cb81dfe91dc781f880
SHA256

db01ee3d2bd504fc4f03cbdf1a2d5eb61f2b59bb1bb19ca66cacf29e39e2f294
SHA512

6e7aa7d3b79dea99faef818f5c4d05b8bb2802eb123ac1bcc6c67d22b24d95aaaf7e939d7a771751ed2fc3c866ca76bcf15e1ed7f229e4c89c4cc77a93b70766
SSDEEP

24576:cItS04YNEMuExDiU6E5R9s8xY/2l/ddSIbt+rS:cI/4auS+UjfU2T0Ibt+r

Score

10^/10

orcus discovery ransomware rat spyware stealer

Malware Config

Extracted

Family

orcus

147.185.221.16

1tool-closes.gl.at.ply.gg

Mutex

0cfe3edb80da4dba8e916709b1465163

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
03/06/2025 19:52:41
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgZgA4ADcAYgBlADMAMAAyADQAMwAzADIANABmADcAYQA5ADQAZAA3AGQANQBjADEAMwA3ADcAZQBlADQANwAwAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDQAMgAxAGIAYwAwADEAYgBmADIANQAwADQANgA3ADAAYgAzADMAZABmAGYANgAzAGEAZQBlADMAYQBlAGUAOAABAAAEBA==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	123.exe

Executes dropped EXE 2 IoCs

pid	Process
1428	WindowsInput.exe
2380	AudioDriver.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	123.exe
File opened for modification	C:\Windows\SysWOW64\WindowsInput.InstallLog	WindowsInput.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	AudioDriver.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_405025354\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_405025354\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_405025354\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_1276346077\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_1276346077\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_648058577\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_648058577\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_648058577\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\WallpaperStyle = "1"	AudioDriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\TileWallpaper = "1"	AudioDriver.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881076177993884"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-805952410-2104024357-1716932545-1000\{E9D97363-158B-4903-B35C-A333874095C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
5348	msedge.exe
5348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	AudioDriver.exe
Token: 33	4716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4716	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
2380	AudioDriver.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2380	AudioDriver.exe
2380	AudioDriver.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1428	1076	123.exe	89
PID 1076 wrote to memory of 1428	1076	123.exe	89
PID 1076 wrote to memory of 2380	1076	123.exe	90
PID 1076 wrote to memory of 2380	1076	123.exe	90
PID 1076 wrote to memory of 2380	1076	123.exe	90
PID 2380 wrote to memory of 4192	2380	AudioDriver.exe	112
PID 2380 wrote to memory of 4192	2380	AudioDriver.exe	112
PID 4192 wrote to memory of 4880	4192	msedge.exe	113
PID 4192 wrote to memory of 4880	4192	msedge.exe	113
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 1908	4192	msedge.exe	115
PID 4192 wrote to memory of 1908	4192	msedge.exe	115
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 888	4192	msedge.exe	114
PID 4192 wrote to memory of 1788	4192	msedge.exe	116
PID 4192 wrote to memory of 1788	4192	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1428
- C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pornhub.com/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffcf3a0f208,0x7ffcf3a0f214,0x7ffcf3a0f220
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3532,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3544,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1752,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4192,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:2
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4984,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3712,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3748,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6168,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6208,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6084,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6652,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5176,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4968,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4956,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5684,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6868,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5392,i,13649829721058149842,7323888457024347680,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x420 0x3dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4192_1276346077\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4192_648058577\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db1d88802048ff847bfcf47035335bd

SHA1
bb54059e5b145da464f6521ae67353889ce00771

SHA256
416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

SHA512
32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8734b4a181214bb62f91cfa36c7e2c98

SHA1
9cff323f10778a23d73ac3dcffc038d3bf661b78

SHA256
e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

SHA512
e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7b8cc01a74836e547c54cdfbec5a1a81

SHA1
8610fb4f5517b6c9ef6e1e0adccd9e579b4aeb99

SHA256
1b3327a887b289e0d1414d58e516d4d9e71ceb19d7aa52b02446b99bc9d070f0

SHA512
aa493bd1ebcd933010c2471a3e19ef79830a6c7b294f8868064d44702918dbf53cb9f64a5849654e70493fe733a2192f3a63e5ce47e8fc3a6d185142a89f1636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b5b816b9f42c827278524e8ab44d818a

SHA1
0d3c29c8a16f902eca9108c47d00d9c7cf20ee3c

SHA256
0c42eca59f1569a796e0d1bd5a513aa6e508402fb3f870710a5812f8b443c698

SHA512
08e0a6325d51e97aa715ea73e6b3c7b5b3359425f4f50731622e86538c6a437798504e3dae5c950f1f677a92b667a06319ae116ffd17ce38ba0567f2c730213f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a45e4.TMP

Filesize
3KB

MD5
8bbe53d841ce1e79c65b0c0cd45bc6de

SHA1
62f6dd42790002fc5a116f7be708c67a620ef9db

SHA256
a80e7dc3caca24b067f6a09debb7e0f4f4584c5e541b5e9be91ddc5dee92e3c0

SHA512
45ae7aa0d1b36f7dc3ab4507bd5d35fba4e3fc961e3764a6174d851658db131acd3be44b21d7d5fee5f4e79a6f4f9cec4b467fc2ab7d7c3d7ed631a3232365db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a5de007-59fa-4150-8fac-8cc91e8287ac.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
8c2a7438d05741602ff6ad9a506f0400

SHA1
9e7b36197ee26d887c5025ce0b463caa147d98c2

SHA256
32801f49ffa290250b7626568fe415e8f1dda67e37c902795e3e325905d9dfca

SHA512
84fccaf950e3bbaa364b8af6ac9e7fadcf286f49eceb3964acb89682c14b7c02a28ab9f1223e6648008cd6921f3bbe283d9d9d82071fc6d0c0d209787a630d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4925900fe6dde62c7e845607743e4cf3

SHA1
c5a5475cef894f861f5a6fe4e61945c0b4d087be

SHA256
f475b34ed0e5ebbdf5cbeaf46e08f9b84954e6fe6cc6983989bd7f068117bb45

SHA512
de819528bc110b572d733dee2bf78d8e38db5478b9ce870e01c7028a82f940f2d4b377b0ad9e0a94a4773568a4f106d9427a849ad8d565424bdfdaae000c1425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
05124441141477dd5b3f53801f24bcc6

SHA1
9b7d71061b37d499eb816f54e2734b0e61c9c85f

SHA256
45ab7d8dced0321a8ee59ff2913b38a17b72e8421dcb356b26f7878272ea52dd

SHA512
ad28bd3c29a58aca3d9696e0e8ec7c605541d298fd6bc5c4f10b361bd0fc401b7123075211022f6ac4b609c71089eade2cb5838414ba76f3f362cb08f0d99df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
5ffbf979e3bb6359f50e14b4697be895

SHA1
7473825d1f23d3d01538108fbab721a5460c6162

SHA256
095c670d6ef372cfca2408dfdf8402ab4c93ee7b30a249510b06f35210f30879

SHA512
535c847298dbd26a61a1d8b8aa940e5186d1f4e4b2ff42fd23c66e10eca2fd8dc16a6a2d2715cb6ab87c6ff098e041389859b3b3b92f5e5307143547d5509994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
168B

MD5
d9e5bb852225bb2d49ef3ec7a6b326a3

SHA1
49b7afb4b72ae0812b57d7d299a6595cd92784cd

SHA256
83a3a8d6034f00e5ee7546bf9859886823b41af7f68ebc331f55e2b5ebcdaad2

SHA512
877a08557c0953e5880a9f56f7b406a646203ed1206b1c78bc463057793d7b852baf48097a44bbb4e8caa40c18628f2adde52cf44afd8c4d2e5120bcf9a5716f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a45a5.TMP

Filesize
48B

MD5
d4d7c9665c242285ef9c847e025e2189

SHA1
ada89c45a6846158d56ad2092abc189945396bc4

SHA256
612ebfdf43f12d61aca1c75668e5224065fc7f66f89c0f98a03038c8ff079b25

SHA512
b68f3f90564f7b9a51e79f605ab6dc8e8adaaf0c26fe955ccdf39c7e38485155a2601a635f88a653339ae7d909b7dad1837f81b37b0a80262efb5fd5ebe8ec39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
1c28f52880954c42cc12ce8a1d3385dc

SHA1
77d79f1511cca3a48e0705e26f199e1e0dd1a4f7

SHA256
484c73b9f75b5f0f6f904a5002b11bf5ca240d17f45579eca22daf88d400ac9f

SHA512
33068ad20704726e581071773472afa27fee3a9a18c5a4a666742129b727fe2c8c0300570db546e4f59ae383ade4f59eec6884630446fd24d10a3189f401a0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
933B

MD5
e4d316d4c22470acf6b8721471e434ca

SHA1
3eb6450e14baff704d8199253ee075ac15de094c

SHA256
ef07b14539085b73645ec2faecb09124312a7b3941583fd855fb0db7e869bc77

SHA512
01851ab391fa7d598f0c800004518de2fcf06e3528a042c4a9603b2eafa7d77031b402387fef8af99c9a2739d0f127b0b8a2ae768451558374465412950de024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2d9fc521-c170-454d-99c5-f58bf0f5f412.tmp

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
f3d788a2ebbee51b498a08e7015cdcdf

SHA1
89b9cebe0b923bf7cb33c7a1a81cf2e7e2daf3e4

SHA256
10ebf4e724b61ab77309814c8cb30753bcfe2fbb37339350e413bed8c6df6af2

SHA512
b20db0bff75e3349b937e806908f0bbd78551871df22ae60099d4225940b2fde7134e2af54f3b5d9a81d7d5ed9fcbae7249eccbbf80040e04880ee75c1c4e463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
093531ea8b38cd4d8b687d50a5475646

SHA1
9b237628361efb84f20d8d2147f99138b1a1b265

SHA256
972bc2826a08cf7f38bd493ce8ec32b9685c5cb6e97bb48bc420b5f2926e4df9

SHA512
ea128120e9457d16debf903be85e6de86da9da3cda79c5378a27a37379a72072722c835f9085c6e9ed9bcc9089c33c5cad9a51473d3f44886845969b9e21373a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5ad042.TMP

Filesize
467B

MD5
2e7633f2b80c97cc5a27aa19752f2df3

SHA1
b33c4bec460d2d6a9fce3084536302e252a41965

SHA256
0759c8a3bdb00b9a395e5a72ce56c05b7f753ef54ae5868ce355e16b186ecf2e

SHA512
1da9236b1f14def83b4bdc6723a4a415886a97bf2a9ec052317b1345a7493816960e0bfcbaaf143994197de0ee1e95a9bd5a7361ac0b88ad6ad301f4a2b8c3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
410de60eec2d96b35305041559f78582

SHA1
6c60dd27bdb6df9af13fd048ca9fe77f6225da4d

SHA256
20fa54f1dc8f89039aaf1e240c170fbf46950d2609a06d563daacc7e4bb84c8b

SHA512
a2ccaba68bb9433594c705cbbd557c9d5b2ae21b3ad38c8128d6112bbf41436b58712cdac6d10b2a5949d33112e3b9ffc3a57ab912c071bf967deac3e57a37f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
79cca4c8aca004ea3a2086561c8d8335

SHA1
fbb6db5914bae8cd97f0a6ec9021069ef0807ca9

SHA256
b9fa91488c402114c5f7c0ba971dfce8a7441d09294c4be2db37af3a8b3b0216

SHA512
f2b29fe101f333871a42104fedbdd8ef45d13737e2c491810fb23bbc3a275b355c56f031509bb73d81e47a2f9459e15cdf08590240109d484a352ed27fe7da12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
a45e725a6767c691d5515cec44b6152e

SHA1
d1915c474b555ed04207adaccd85b3a81d5bfed2

SHA256
2d0b4a15ea2e7998ac902f4e6bbdcbf92a258aa018f43e7fcdbc58aa15279c0f

SHA512
877f80577f82dc150b28583f062d00d223a6cbce042876d3b24e14f3302e4099562f05431c6681e1ab9d1536e194dd8143f598838d8f30db6084178f03255201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
11ad3d3ecd4401aff72e2c050bac87ef

SHA1
6057dcc88629d3be5dd078ad2aeef3d5bf9a140d

SHA256
86732a39a26230db5e9ca7df8e117beb8bde505c06c97487de33b97a6d4ebd1c

SHA512
4bb84a02a0968d02b745f27b040f3e6be6efe4eec61eeed5a8434ef9423b86fb7965d82bb15b0fa463447fffdfeb0f29eb25a271ce5e30df7e62f104e953bdf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
80f39080c0ffc8e775718ac20a55715e

SHA1
e96116fcdb9eb5841fef05a6fb00d3b4ae99b868

SHA256
b4252e17c5e7e8f494c1f58775e0b730232aa4fef2eeb80deb5edd622dcf06f0

SHA512
110f94573fec7d845af46677fff5b348ca146ed7927af5c59e7ae52edd2936a2471a4d1b7f2036c2995ad46329c5eab4a01b83a351e01e34f4d57d512e1341fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\24c9f2a0-4b21-4aa0-885b-88a2a8dd3250.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\79661096-3957-45b7-8bb6-e63d1426f134.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_2017802725\80b42c3e-d406-41bd-aff5-c2a5d330f9bc.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe

Filesize
846KB

MD5
5791306a6d85166a28c4a678ed473691

SHA1
bca4557e4cd3f7fece5c44cb81dfe91dc781f880

SHA256
db01ee3d2bd504fc4f03cbdf1a2d5eb61f2b59bb1bb19ca66cacf29e39e2f294

SHA512
6e7aa7d3b79dea99faef818f5c4d05b8bb2802eb123ac1bcc6c67d22b24d95aaaf7e939d7a771751ed2fc3c866ca76bcf15e1ed7f229e4c89c4cc77a93b70766

Download Submit
C:\Windows\SysWOW64\WindowsInput.InstallLog

Filesize
597B

MD5
c2291863df7c2d3038ce3c22fa276506

SHA1
7b7d2bc07a6c35523807342c747c9b6a19f3184e

SHA256
14504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da

SHA512
00bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
e854a4636afc652b320e12e50ba4080e

SHA1
8a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc

SHA256
94b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5

SHA512
30aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118

Download Submit
memory/1076-4-0x0000000006130000-0x00000000066D4000-memory.dmp

Filesize
5.6MB

Download
memory/1076-9-0x0000000005FF0000-0x0000000006012000-memory.dmp

Filesize
136KB

Download
memory/1076-7-0x0000000005EE0000-0x0000000005EE8000-memory.dmp

Filesize
32KB

Download
memory/1076-3-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1076-0-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/1076-10-0x0000000005FC0000-0x0000000005FCC000-memory.dmp

Filesize
48KB

Download
memory/1076-5-0x0000000005F20000-0x0000000005FB2000-memory.dmp

Filesize
584KB

Download
memory/1076-2-0x0000000003470000-0x000000000347A000-memory.dmp

Filesize
40KB

Download
memory/1076-1-0x0000000000FC0000-0x000000000109A000-memory.dmp

Filesize
872KB

Download
memory/1076-8-0x0000000005F00000-0x0000000005F08000-memory.dmp

Filesize
32KB

Download
memory/1076-6-0x0000000005E80000-0x0000000005ECC000-memory.dmp

Filesize
304KB

Download
memory/1076-58-0x0000000006BF0000-0x0000000006C3E000-memory.dmp

Filesize
312KB

Download
memory/1076-71-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1428-37-0x000000001BDF0000-0x000000001C2BE000-memory.dmp

Filesize
4.8MB

Download
memory/1428-55-0x00007FFCF2C50000-0x00007FFCF35F1000-memory.dmp

Filesize
9.6MB

Download
memory/1428-22-0x00007FFCF2F05000-0x00007FFCF2F06000-memory.dmp

Filesize
4KB

Download
memory/1428-23-0x00007FFCF2C50000-0x00007FFCF35F1000-memory.dmp

Filesize
9.6MB

Download
memory/1428-24-0x0000000000B50000-0x0000000000B68000-memory.dmp

Filesize
96KB

Download
memory/1428-25-0x0000000000E30000-0x0000000000E50000-memory.dmp

Filesize
128KB

Download
memory/1428-26-0x00007FFCF2C50000-0x00007FFCF35F1000-memory.dmp

Filesize
9.6MB

Download
memory/1428-29-0x000000001B490000-0x000000001B4B4000-memory.dmp

Filesize
144KB

Download
memory/1428-38-0x000000001C360000-0x000000001C3FC000-memory.dmp

Filesize
624KB

Download
memory/2380-81-0x0000000007350000-0x000000000738C000-memory.dmp

Filesize
240KB

Download
memory/2380-79-0x0000000007890000-0x0000000007EA8000-memory.dmp

Filesize
6.1MB

Download
memory/2380-74-0x0000000005D80000-0x0000000005D90000-memory.dmp

Filesize
64KB

Download
memory/2380-73-0x0000000005FB0000-0x0000000006172000-memory.dmp

Filesize
1.8MB

Download
memory/2380-72-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/2380-70-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/2380-78-0x0000000007200000-0x0000000007266000-memory.dmp

Filesize
408KB

Download
memory/2380-75-0x0000000006840000-0x000000000684A000-memory.dmp

Filesize
40KB

Download
memory/2380-80-0x00000000072F0000-0x0000000007302000-memory.dmp

Filesize
72KB

Download
memory/2380-86-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/2380-82-0x0000000007390000-0x00000000073DC000-memory.dmp

Filesize
304KB

Download
memory/2380-83-0x0000000007520000-0x000000000762A000-memory.dmp

Filesize
1.0MB

Download
memory/2380-1020-0x0000000008910000-0x0000000008A8A000-memory.dmp

Filesize
1.5MB

Download
memory/2380-84-0x00000000083E0000-0x000000000890C000-memory.dmp

Filesize
5.2MB

Download
memory/2380-85-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download