Overview

overview

10

Static

static

3

3372c1edab...70.exe

windows10-2004-x64

10

3372c1edab...70.exe

windows11-21h2-x64

10

51B4EF5DC9...67.exe

windows10-2004-x64

3

51B4EF5DC9...67.exe

windows11-21h2-x64

3

E906FA3D51...56.exe

windows10-2004-x64

3

E906FA3D51...56.exe

windows11-21h2-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251229-en
  • resource tags

    arch:x64arch:x86image:win11-20251229-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/01/2026, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
  • Size 284KB
  • Sample260125-wcdalscv3g
  • SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryteslacryptpersistenceransomwarespywarestealer

Malware Config

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Renames multiple (4485) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 60 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 40 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
    "C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Users\Admin\AppData\Roaming\arceqgq.exe
      C:\Users\Admin\AppData\Roaming\arceqgq.exe
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
          4⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:5544
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
        3⤵
          PID:3588
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
          3⤵
            PID:8
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5400
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:3848
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5276
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4360
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:6044
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4800
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2fc,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:676
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5324
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:224
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4484
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:3728
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1180
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2292
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:1920
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5144
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2148
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2856
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:1844
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:8
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:5376
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3552
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x324,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:1480
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4864
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4572
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1032
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:5436
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4144
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:5224
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:6004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc01d6c188,0x7ffc01d6c194,0x7ffc01d6c1a0
              4⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2208
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3372C1~1.EXE >> NUL
          2⤵
            PID:3716

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 114B
              • SHA256 f6e150ff339f2b13c3afbc559d59de7654fa4c68b509a6fde53684a3926ab549
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 212B
              • SHA256 5e3af99cca9a2d29626ae76f24330bed5dd90284aa3e7cb470c46f4f4e94358b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 310B
              • SHA256 72da2b0dcd9d294ff3ba7fe112ab697ef49d527375d2bac46ffa670e3b807bac
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 408B
              • SHA256 775b025859ce08331c42a6f9428df8e87c7a1428251b4ce306e7d6e1557c6b67
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 506B
              • SHA256 097cdd8214d00b727f83642f837ad18300671ed4a9fa27d2011410798e5025c7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 604B
              • SHA256 7d45a31ee49075bbfd4fe6110ba46b5987a81b1e9172b2321de6c62a11acf598
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 702B
              • SHA256 edd9fc1b0ebbd95bea4a366e48c538a0ea6a3e16570b57b588683cf0793be585
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 800B
              • SHA256 8e31be5b0a8f317437ccc74ccb982ea818d122b41c3455af639646d33043ab78
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 898B
              • SHA256 8a313a45b043e9254e5a362fa2d274ac8f2a10cde256b6c6c7bc28b02c706318
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
              • Size 996B
              • SHA256 97711397451760cc6dfe45d4ec118592508c6b2a5d1148c4a590ddf2dda46d15
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0cc49e00-e3a1-47f0-9506-b52ae859966d.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0cc49e00-e3a1-47f0-9506-b52ae859966d.dmp
              • Size 4.8MB
              • SHA256 27e0e016affdb79c31bb446705f7ba293766f4cd6e06936c32048b0e77139b88
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              12430e35-5c08-48db-9057-53409f94f793.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\12430e35-5c08-48db-9057-53409f94f793.dmp
              • Size 4.9MB
              • SHA256 ce102421993189af89f3b073ded61e54766b3cfeb653e644ac60b46030344e44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              325469e0-16e2-4355-9716-bec3c8cbfbba.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\325469e0-16e2-4355-9716-bec3c8cbfbba.dmp
              • Size 4.9MB
              • SHA256 33d27709f79836c2ed509aff36568585fed49302726c6fa1552fdb688530f9c0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3e9796ee-c482-4844-9e84-357e9733fc9c.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\3e9796ee-c482-4844-9e84-357e9733fc9c.dmp
              • Size 4.8MB
              • SHA256 b5e0c965189dc9e495bfc521ce1934576d543021ab165703b0b85d89c5ccb33e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              49eada33-5291-488d-b62b-44250feb79d0.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\49eada33-5291-488d-b62b-44250feb79d0.dmp
              • Size 4.8MB
              • SHA256 41dadbae0ab9c94bc405fa3359d089340f223aa8acdb7f289f5be07d6c768bc7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              4cbf74e5-ace3-41a9-b5c6-16d0726bc748.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4cbf74e5-ace3-41a9-b5c6-16d0726bc748.dmp
              • Size 4.9MB
              • SHA256 96bda2936f34c1a85a08c19d7cced015fc6a672908e0662b5223c494377c75fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              615f36d5-b46e-4622-a618-dafb0813a2ed.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\615f36d5-b46e-4622-a618-dafb0813a2ed.dmp
              • Size 4.8MB
              • SHA256 7ea729e87964af74a3e827539a1573bee9b1d58a4de689b8b36207f85406b3e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              657306a3-bfb8-4cbe-b351-98b365872b09.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\657306a3-bfb8-4cbe-b351-98b365872b09.dmp
              • Size 4.8MB
              • SHA256 b2f9c667a25b164b90a5e12c901736729c49848c7bf748c849233dcb5b2ac587
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7a34e425-6972-429f-8282-9c2bd318bce6.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7a34e425-6972-429f-8282-9c2bd318bce6.dmp
              • Size 4.8MB
              • SHA256 6b891333e35242d580d3363d420e844bdc01f34ce9b36c92cd2689086487ac44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7fd0f185-4475-491d-9d4d-bbc9f5b756ed.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7fd0f185-4475-491d-9d4d-bbc9f5b756ed.dmp
              • Size 4.9MB
              • SHA256 2d9ab7d1861995ded0e4fa7c01fa73d9d8a74b12fe88459eecb60526b2fd4435
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              80a3b979-ca4c-42e4-970b-34ea2af27c71.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\80a3b979-ca4c-42e4-970b-34ea2af27c71.dmp
              • Size 4.8MB
              • SHA256 a993566de046237c5bb77c08b8d8c7c8636e4bab0c96c80a6ed644d94b0161a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              83a5b525-9183-42d4-a604-0c3a1fcb97d7.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\83a5b525-9183-42d4-a604-0c3a1fcb97d7.dmp
              • Size 4.9MB
              • SHA256 628a33ab9fce6df15b0e20cc812c9e6ed9084c40282c5d02e30a5d5cc57f18c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              9f1a9b83-5af3-42af-9f46-1a469dcf9bfb.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9f1a9b83-5af3-42af-9f46-1a469dcf9bfb.dmp
              • Size 4.8MB
              • SHA256 f2affe502eb344e2806e67d6fbacda10db529d928f5bebcc969d948d99c2afed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              b500d676-f345-49ce-a76f-8ac566454045.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b500d676-f345-49ce-a76f-8ac566454045.dmp
              • Size 4.9MB
              • SHA256 dabf4e6254779801bb8441e57a80cba0619eab8a06484970c9e9974c52e09054
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c44fadd8-9ec4-49bd-a7cf-0beca26c45f9.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c44fadd8-9ec4-49bd-a7cf-0beca26c45f9.dmp
              • Size 4.8MB
              • SHA256 b2ac3c404e5a7ff2f1fe9a2163369b37255fe34627a74f3bb83b47362e2ce119
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              db74bd43-f10b-4d83-8598-c5d28645289d.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\db74bd43-f10b-4d83-8598-c5d28645289d.dmp
              • Size 4.8MB
              • SHA256 b321e2364123a655df36d66a7016376820c1dc752d2a2accc8588196b14e969b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e2b69c76-9ecb-469a-bac2-9e075e76d046.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e2b69c76-9ecb-469a-bac2-9e075e76d046.dmp
              • Size 4.8MB
              • SHA256 77cb7554420fdcd0df709ac151bda6e354e46853c81fd9dcf7fb90b30592a948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5cdb2f7-78b6-412b-a85d-d2f4de1aa8bd.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e5cdb2f7-78b6-412b-a85d-d2f4de1aa8bd.dmp
              • Size 4.8MB
              • SHA256 bcec492e07611786ee164442f69f8eb935687f94c0bc2a7b44c0a0825396d985
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f20e1e44-02c6-4256-ad4c-4314d55d5e0b.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f20e1e44-02c6-4256-ad4c-4314d55d5e0b.dmp
              • Size 36B
              • SHA256 d754d38bc8ac1e461793af45f2be86a3b72b9dae8baca85986ab4ff499c1ab6b
              • MD5 SHA1 SHA512
              Submit Download

              f20e1e44-02c6-4256-ad4c-4314d55d5e0b.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f20e1e44-02c6-4256-ad4c-4314d55d5e0b.dmp
              • Size 4.8MB
              • SHA256 27caf6177e952c9145b7e984b115e486ebfb48ba2285bb7c4b54e0050ef3dcfe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f5a41dc2-22a7-47f8-8146-f3c83188e57d.dmp
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f5a41dc2-22a7-47f8-8146-f3c83188e57d.dmp
              • Size 4.8MB
              • SHA256 31daa27477a5477268ed43f87074eb09b4931875ec94614e1d5b4006fbf62bb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 e20144d9f197f9d95e285724f396b4f0ac7dcb4d8eff654b8b2663414a032c2a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 8e4e6561b5ea0c4fc408b7a5e3335e43a10977fab8a515c541a241e93a9e1479
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 31cec305bf7a29ee60a7f57240be684ae054fe25717c3f82c602dbc650fbaedd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 fa71defe7b25dab57dd7f033795e3d4f74802fd38fb6eb8ba643d25451783283
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 ce68b11de4d32f8e2f410f9644494973c94a66885c356b03deccb1e9645dd323
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 9f0ff9bfaa16ed726ce1461d9dae1ceb858e0d7373c85932615d98fa53f726f3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 f3efeab9e9474cb5b576c0279f21e403dfbcf0dd8691a7187c2970355eea8996
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 7944c12fb4659aab1fd72ce273d2e508b4a029d8feacf11c03e29c05352b0ef9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 2e762ebee4deddce412230f462a09014574f5d9c4a4b7a76e0819544ec829854
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 fb0cd59eadb44def6f0c6752425f0916b07af4448975f72b725f57d5087a88b0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 07e5663727f879c1a2f92e0c766c7e6b10b108b4b53b5374a253eaf8ac5bd010
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              edge_shutdown_crash.txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\temp\edge_shutdown_crash.txt
              • Size 36B
              • SHA256 27fcd6b817991a25699a9ac8adfd0c06dcd3a66054f4eb8decc036dfcf84b1c5
              • MD5 SHA1 SHA512
              Submit Download

              edge_shutdown_crash.txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\temp\edge_shutdown_crash.txt
              • Size 1B
              • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
              • MD5 SHA1 SHA512
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 1KB
              • SHA256 fe9a86bb7144d27694c0405fce132962eac45c1c98c91618968b9752fe2bfeca
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 2KB
              • SHA256 5a88514bc303910ad93c90262d1ed294752590ac088d7840c663c94c0c40602c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 3KB
              • SHA256 67ee64a82d8d9265597208289ed10649b4a9a2538dea0bba6d4858bbff68c177
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 4KB
              • SHA256 5d57d2647e38806a1e6b043b51634eeeac682073eee57af7830215d386f51388
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 5KB
              • SHA256 6cfec99cf4ef0cc6eac6be435e6330e626816bad619960b28b6d183450bec5e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 6KB
              • SHA256 3f40709803fa9ea062c7d84fc8364d620ccaadd84080f8572d8820210b9f43ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              watson_metadata
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata
              • Size 8KB
              • SHA256 53cf8e333ddbd1e715a2a8dfbb03ef14afaa8779f76bcf1c77c9137ec1182675
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 b20ca4589c8f379b43c13ae0409461361bb90cecb1dee885333c0ee1d066e862
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 0922ee618bd87370d4be05b633a50563878891f30505a5d8b43dcaf2613e4ab9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 5636d04faeaffdeaee26982f4ed7ebeba6550192144718714f03de7b4e97747e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 7c782809649ae44d26ad9ec63f900a8b306e91ed01410eedd6a9ab778770ed2b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 7e6daad7c6a4c97abcd6a0d03ee9d31d736e1f427084384e37058ccffc80187a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 d3609e7d600fb844a1aae55cff64b42f65897262c5824ca95ab9ee8af65ddabe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 d18f8b12dfbb48a709b45a803ceeb34c0148254f1e1869e802d6327684a204ae
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 9fede40832365e4933635c74a4bfa3699e1b1ab869c9de13943ff40b9f9eb914
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 d58993216fb0cbf52ced6da4fcaebfc8fcc7c1a37191954397ba77951b16be9b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 87B
              • SHA256 7525924447609f1052fdb182a80195f650bd4ad2a0dad37515899fd72019ddea
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              arceqgq.exe
              • Path C:\Users\Admin\AppData\Roaming\arceqgq.exe
              • Size 284KB
              • SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              log.html
              • Path C:\Users\Admin\AppData\Roaming\log.html
              • Size 1.2MB
              • SHA256 e9fe1b753115f0d5c52dbebf76f61f3c0bf57f6b1c34b197e3a3e49776ed8f5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download