teslacrypt | 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370

Resubmissions

16/06/2026, 08:41

260616-klpt8abz3x10

10/06/2026, 07:23

260610-h7srwsfs3s10

Analysis

user interaction
yes
max time kernel
127s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/06/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Size 284KB
Sample260616-klpt8abz3x
SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
MD5 209a288c68207d57e0ce6e60ebf60729
SHA1 e654d39cd13414b5151e8cf0d8f5b166dddd45cb
SHA512 ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
SSDEEP 3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
TLSH
T1C3549D02B7EBC0F3E86744744666D3BB467E2D432739D2C7AB503E1AEA311D26638716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery teslacrypt persistence ransomware spyware stealer

Malware Config

Signatures

Family: TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 988 created 384	988	taskmgr.exe	90
PID 988 created 384	988	taskmgr.exe	90

Renames multiple (4515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	tjqobeb.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe

Executes dropped EXE 1 IoCs

pid	Process
384	tjqobeb.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crypto13 = "C:\\Users\\Admin\\AppData\\Roaming\\tjqobeb.exe"	tjqobeb.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\uk-UA\PackageProvider.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\MSFT_RegistryResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ja-JP\MSFT_ServiceResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\uk-UA\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\de-DE\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\uk-UA\MSFT_ProcessResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\MSFT_ScriptResourceStrings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\lpeula.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsCodecsRaw.txt	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\AssignedAccessMsg.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr-FR\TestDtc.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\PSDSCxMachine.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-constraints.js	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\AppLocker.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\WindowsPackageCab.Strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\MSFT_UserResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\EventTracingManagement\EventTracingManagement.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\lipeula.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\ScheduledTasks.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\UEV.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\NetLbfo.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\PrintManagement.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\Microsoft.PowerShell.ODataUtilsStrings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\TestDtc.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\PSDesiredStateConfiguration.Resource.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ja-JP\MSFT_ProcessResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\MSFT_RegistryResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\@WirelessDisplayToast.png	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\es-ES\ArchiveProvider.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\MSFT_RoleResourceStrings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\System32\LogFiles\WMI\SpoolerLogger.etl.001	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\it-IT\MSFT_EnvironmentResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\en-US\PSDesiredStateConfiguration.Resource.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\StorageBusCache\StorageBusCache.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\en-US\lpeula.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\NetAdapter.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\TrustedPlatformModule.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\it-IT\WindowsPackageCab.Strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\RunAsHelper.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\Licenses\_Default\Professional\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\AssignedAccessMsg.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\ArchiveProvider.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\MSFT_EnvironmentResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\MSFT_EnvironmentResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\de-license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\fr-FR\PackageProvider.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\MSFT_ProcessResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\uk-UA\MSFT_RoleResourceStrings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\MSFT_ScriptResourceStrings.psd1	tjqobeb.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HELP_TO_DECRYPT_YOUR_FILES.bmp"	tjqobeb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-125.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-150.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-32.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-200.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\vi.pak	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-48_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-400.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\nn.pak.DATA	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-125.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.strings.psd1	tjqobeb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\FirstRunIllustration.theme-dark.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ca-Es-VALENCIA.pak	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-24.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-100.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\159.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ms.pak	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\manifest.json	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-54_altform-unplated.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\export.svg	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ka.pak.DATA	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\qu.pak.DATA	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-lightunplated.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-200.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Kiss.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\kb-unlocked.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_da_135x40.svg	tjqobeb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-125.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-16.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\th.pak.DATA	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-white_scale-200.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Medium.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-400.png	tjqobeb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-300.png	tjqobeb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\memoryAnalyzer\images\i_snapshot.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\n\privacy-icon.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\TextReply.scale-300.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.19041.1_de-de_8ecbf4db5ea63fd0\MSFT_UserResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square150x150Logo.contrast-white_scale-150.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\LeftClick.png	tjqobeb.exe
File opened for modification	C:\Windows\Cursors\move.svg	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile71x71.scale-100.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Search\Images\logo.scale-80.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-20_altform-unplated.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\SquareTile310x150.scale-400.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.processmitigations.commands_31bf3856ad364e35_10.0.19041.662_none_2a8c125210169f86\ProcessMitigations.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars35.contrast-black_scale-200.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-125.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\SendPhone.scale-150.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square44x44logo.scale-400.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c2a27e4da57557ee\RS_IESecuritylevels.psd1	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-400.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-t..riventextservice-yi_31bf3856ad364e35_10.0.19041.1_none_01c32b9392659611\TableTextServiceYi.txt	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\Square44x44Logo.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-network-qos-wmi_31bf3856ad364e35_10.0.19041.1_none_98eba0f0661858b2\NetQos.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-20_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-150_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\BreadcrumbScrollRightHover.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square150x150Logo.contrast-black_scale-125.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Wide310x150Logo.scale-125.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Oobe-ReadEbook.png	tjqobeb.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\de-DE\RS_RestoreIEconnection.psd1	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Splashscreen.scale-125.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\status_heap_decrease.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.19041.1_es-es_41dcd20a820bff35\MSFT_RegistryResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\ErrorPageStyles.css	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-l..efault-professional_31bf3856ad364e35_10.0.19041.1288_none_0fb30e7d925e4d06\f\license.rtf	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-200.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\Manifests\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4e324b10e3e4ff85.manifest	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.19041.1_none_b6de35efa82cca34\SmbShare.psd1	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\diffTabIcon.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\objectTreeView.css	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\networkRemote.bundle.js	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated_contrast-white.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.19041.1_en-us_37bccad44d844b95\MSFT_EnvironmentResource.strings.psd1	tjqobeb.exe
File opened for modification	C:\Windows\diagnostics\system\Keyboard\it-IT\CL_LocalizationData.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-400_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\AppListIcon.scale-100.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-update-settings.svg	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\PasswordExpiry.contrast-white_scale-125.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-150.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\oobe-chrome-footer-vm.js	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\Manifests\msil_multipoint-wms.dashboardcommon.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_de94aee0cd1bb119.manifest	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\language\typescript\src\worker.js	tjqobeb.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\RibbonToast.scale-100.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobesettings-multipage-page.js	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square310x310Logo.contrast-black_scale-200.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-200_contrast-black.png	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\16.txt	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\diffIcon.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\r\oobeprovisioningprogress-page.js	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-16_altform-unplated.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.19041.1_none_910333b84fcf455a\img0_3840x2160.jpg	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_e994a1eda802405a\CL_LocalizationData.psd1	tjqobeb.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-64_altform-unplated.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\NavOverFlow_Start.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\SIMLockToast.scale-400.png	tjqobeb.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\SquareTile71x71.scale-200.png	tjqobeb.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tjqobeb.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3260	msedge.exe
2008	msedge.exe
4664	msedge.exe
3476	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\WallpaperStyle = "0"	tjqobeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\TileWallpaper = "0"	tjqobeb.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134260729580211066"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BFC7A71B-10D2-4282-9110-F7E4F0AA3BF2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{79FBF0F4-AEA8-4238-8232-9BD18287B0E4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{8C108E60-E7EC-4B72-9170-255B9773A0C7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1A03CC22-2B81-42FB-B5E5-B6C925BB290D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe
384	tjqobeb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
3544	msedge.exe
3544	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	taskmgr.exe
Token: SeSystemProfilePrivilege	988	taskmgr.exe
Token: SeCreateGlobalPrivilege	988	taskmgr.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
384	tjqobeb.exe
3544	msedge.exe
3544	msedge.exe
4316	msedge.exe
4316	msedge.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe
988	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 384	1584	3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe	90
PID 1584 wrote to memory of 844	1584	3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe	91
PID 384 wrote to memory of 532	384	tjqobeb.exe	94
PID 532 wrote to memory of 3808	532	msedge.exe	95
PID 532 wrote to memory of 3260	532	msedge.exe	97
PID 532 wrote to memory of 1664	532	msedge.exe	98
PID 532 wrote to memory of 1664	532	msedge.exe	98
PID 532 wrote to memory of 4336	532	msedge.exe	99
PID 532 wrote to memory of 1664	532	msedge.exe	98
PID 532 wrote to memory of 4336	532	msedge.exe	99
PID 532 wrote to memory of 3784	532	msedge.exe	100
PID 532 wrote to memory of 4432	532	msedge.exe	101
PID 532 wrote to memory of 3784	532	msedge.exe	100
PID 532 wrote to memory of 3784	532	msedge.exe	100
PID 532 wrote to memory of 4432	532	msedge.exe	101
PID 532 wrote to memory of 4432	532	msedge.exe	101
PID 532 wrote to memory of 4088	532	msedge.exe	103
PID 532 wrote to memory of 3268	532	msedge.exe	102
PID 532 wrote to memory of 4088	532	msedge.exe	103
PID 532 wrote to memory of 4088	532	msedge.exe	103
PID 532 wrote to memory of 3268	532	msedge.exe	102
PID 532 wrote to memory of 3268	532	msedge.exe	102
PID 532 wrote to memory of 628	532	msedge.exe	104
PID 532 wrote to memory of 628	532	msedge.exe	104
PID 532 wrote to memory of 628	532	msedge.exe	104
PID 532 wrote to memory of 3916	532	msedge.exe	107
PID 532 wrote to memory of 3916	532	msedge.exe	107
PID 532 wrote to memory of 3000	532	msedge.exe	108
PID 532 wrote to memory of 3000	532	msedge.exe	108
PID 384 wrote to memory of 3076	384	tjqobeb.exe	109
PID 532 wrote to memory of 4608	532	msedge.exe	110
PID 532 wrote to memory of 4608	532	msedge.exe	110
PID 532 wrote to memory of 4608	532	msedge.exe	110
PID 532 wrote to memory of 2520	532	msedge.exe	113
PID 384 wrote to memory of 3544	384	tjqobeb.exe	124
PID 3544 wrote to memory of 4288	3544	msedge.exe	125
PID 3544 wrote to memory of 2008	3544	msedge.exe	127
PID 3544 wrote to memory of 1840	3544	msedge.exe	128
PID 3544 wrote to memory of 1840	3544	msedge.exe	128
PID 3544 wrote to memory of 1840	3544	msedge.exe	128
PID 3544 wrote to memory of 4808	3544	msedge.exe	129
PID 3544 wrote to memory of 4808	3544	msedge.exe	129
PID 3544 wrote to memory of 4400	3544	msedge.exe	130
PID 3544 wrote to memory of 4400	3544	msedge.exe	130
PID 3544 wrote to memory of 4400	3544	msedge.exe	130
PID 3544 wrote to memory of 2156	3544	msedge.exe	131
PID 3544 wrote to memory of 2156	3544	msedge.exe	131
PID 3544 wrote to memory of 2156	3544	msedge.exe	131
PID 3544 wrote to memory of 2712	3544	msedge.exe	132
PID 3544 wrote to memory of 2712	3544	msedge.exe	132
PID 3544 wrote to memory of 2712	3544	msedge.exe	132
PID 3544 wrote to memory of 4184	3544	msedge.exe	133
PID 3544 wrote to memory of 4184	3544	msedge.exe	133
PID 3544 wrote to memory of 4184	3544	msedge.exe	133
PID 3544 wrote to memory of 4340	3544	msedge.exe	134
PID 3544 wrote to memory of 512	3544	msedge.exe	135
PID 3544 wrote to memory of 4340	3544	msedge.exe	134
PID 3544 wrote to memory of 512	3544	msedge.exe	135
PID 3544 wrote to memory of 3964	3544	msedge.exe	137
PID 3544 wrote to memory of 4316	3544	msedge.exe	140
PID 4316 wrote to memory of 3080	4316	msedge.exe	141
PID 4316 wrote to memory of 1276	4316	msedge.exe	143
PID 4316 wrote to memory of 4664	4316	msedge.exe	142
PID 4316 wrote to memory of 1276	4316	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
"C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\tjqobeb.exe
  C:\Users\Admin\AppData\Roaming\tjqobeb.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x33c,0x7ffaead3c188,0x7ffaead3c194,0x7ffaead3c1a0
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,3171524450643753644,17818671211785008586,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3
      4⤵
      System Time Discovery
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,6615366495748245832,12348387621731170375,262144 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,6935190860232947974,17114355682556987872,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9682206940629953191,12302322735159445263,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16335831919961001989,430525576069280688,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,4912006185493490270,5197979349195826856,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,8867743296500137680,1024344983572989746,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4692,i,3761783794461147747,14369506344150615302,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,2888334281634967611,10991184674123714862,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,3340927939922225868,11689573254985448789,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5708,i,5244181767672365073,9038826353397248535,2097152 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,9823477337461739346,2056051796153512498,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,9823477337461739346,2056051796153512498,524288 --field-trial-handle=2492,i,18110360749513823089,14432514231854547589,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d8,0x7ffaead3c188,0x7ffaead3c194,0x7ffaead3c1a0
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,17372065804097425861,12108678444248923881,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      System Time Discovery
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,7370468178562112976,6512213441436101945,262144 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,16709420628405419420,14521087758213299454,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,10282191917041441292,13286359850842738845,2097152 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,9135470031232496613,16384789773243699497,2097152 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2308,i,15120341722922911929,2055727123983486213,262144 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:2
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,18078239532046000180,16619428658254655175,262144 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,3877161874363043301,7748125450454726172,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:8
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,4502701240853972156,117411876104484335,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3988822636682111865,1918533897914603910,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3988822636682111865,1918533897914603910,524288 --field-trial-handle=2312,i,11526886414994328354,11510260042178164651,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaead3c188,0x7ffaead3c194,0x7ffaead3c1a0
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3771099985198471696,12515320743862924800,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16521255083627237018,4754578254016620321,262144 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:1276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,2630747606725908159,8774691847523210867,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:8
        5⤵
        
        PID:2516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=3756,i,1753957917065318773,15721198002456178027,262144 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
        5⤵
        
        PID:1732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,1016687541288398771,6684004401358271928,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,1016687541288398771,6684004401358271928,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --always-read-main-dll --metrics-shmem-handle=2868,i,15989444697592389588,13475890185140867077,262144 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:2
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4952,i,6253726890987610943,6501523601278272643,2097152 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        5⤵
        
        PID:1156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4956,i,10500655715139592181,7142454845160091850,2097152 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,8907018167858858690,10942795459034061148,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16115129318641294496,62330144770207588,524288 --field-trial-handle=2264,i,1213026023564697662,14160805212231895431,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaead3c188,0x7ffaead3c194,0x7ffaead3c1a0
        6⤵
        
        PID:2396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17723875914641475620,11119152714903684077,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,592409542575249773,7681205860200196945,262144 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        6⤵
        
        PID:4088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,2158695752793611945,7238968449088835235,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
        6⤵
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1744,i,16888405436713913649,17740864553386749321,262144 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
        6⤵
        
        PID:3948
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,16283045341176961171,116146868714503738,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
        6⤵
        
        PID:3728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,13119578159948875917,3726672040082535414,262144 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
        6⤵
        
        PID:4184
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,16283045341176961171,116146868714503738,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
        6⤵
        
        PID:1664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,8968412545198687861,14674020607180410914,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
        6⤵
        
        PID:3192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,11403376111154888323,15290508132651350079,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
        6⤵
        
        PID:4580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,1341711954680000294,7426328980706230403,524288 --field-trial-handle=2228,i,13195405415291062492,13570531178742252009,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
        6⤵
        
        PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://34r6hq26q2h4jkzj.tor2web.fi/
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3372C1~1.EXE >> NUL
  2⤵
  PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:988

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\d3d2861604974bc1834150bf8d2f8f2b /t 3944 /p 384
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 56a7e53836bd86df3d82381f72a813921d8798dad842035687a7fd85c50e9885
MD5 c9ab98f205fb98f32f715387bdee7cbb
SHA1 d725a63e6ddf8eadd9c967d1e080d7a9130e3710
SHA512 9988d4efe411f72f836a2738b9db4a495d4073083f4c1905cacc50e7ec4c67386707ae00140430c010262670cbdb2159b20fde95c12e25ce79b8f462307f7498
TLSH
T12CD022722A8CAC00EA090170D42383022EA6859824839B02A104C01C44A42D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1957b1f667018fdc60a29b2b98f2570490f5e2fef058896efece183962c4c9e1
MD5 8880ab1f6bed1d8c5d1afd22cf91625c
SHA1 8387ba24e9fb9471d74f9b9d383f4737d45bdbf0
SHA512 270a81f6038a8a4760f6b00bac41f34d935fa2cb56b87e276072abd2bf0b3992c69e84c1689ea9ea245b1658ce59266470055d251151ce931987a521ae37089f
TLSH
T196D0C073378C7C00EA090170D013C3031FA7855824C39F03B200C02C44B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6c693aa635991ba25c5add6c7d7e7d2b1c0ea3dbe2cafd02687ed1dc4bd33606
MD5 c48efe62a78771e98b4337cfc8052edd
SHA1 404a9a89883d255829ef3bd4623df88e306c5a66
SHA512 f1fcc8bf32a1fdd7be94543e441f0dda20c2461e489216f480ac47c2bf7e6cbb6319348ec306aa30480e01b3a2291d3dcaacffd6f91df3af2a4c6237bf23b41d
SSDEEP 384:JPkRM5JCC0k4edEWdcdTYmwv8gGa6m/z6VGz2w:VkRM5ACN4emLAlz6A2
TLSH
T16E13073D72910E92C2E6023C964B4BF2A33DC8B1E1D5671FB3B6F42C8721762992E546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c53455e04e1c4a0f49d4dd2a85ded1e47fbbeb0cb035576f6cc861732a4ff7d1
MD5 0fe0f3b70e2c2ece6f6a8c9abc674efe
SHA1 07060631a51d0326ae2fd80c3bc0ea96d8c743a7
SHA512 80423846492417655df7d318ead8b59ea93e7629f203c685fded9e18b2e7d9b302476cda4ea94d805ac36c8bad888d5b1ce614714b6e30e4518d7204c78230e5
SSDEEP 384:EPkRM5JCC0k4edEWdcdTYmwv8gGa6m/z6VGz2w:okRM5ACN4emLAlz6A2
TLSH
T18213F73D72910E96C2E6023C974B4BF2A33DC8B1E1D5671FB3B6F42C8712762992E542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b29b23fbddc50144d7a943112d2350febd2464cb008432c655577f02c69a56c6
MD5 d2a7e63ee4d1a206b623eb81f4c34faf
SHA1 8621ad9067cea85125f8b00dbd29f09da1130e34
SHA512 77e47dd739cd4f369c67d58c5a29d531c1b2269aad45c5b0197522dccb63d6e0aab8c5edc90ac2bd1e402667a1eed1486bc5c8f1ae880afc101fe59c2572d47f
SSDEEP 1536:9L/9w3L/w6aRJHLoWI9UGZL/ZL/NkjFHlENOggIWMA/qD:9L/CL/6JkL/ZL/5gIWj
TLSH
T1F6443BF70941A01BCFA812F5E2133A7DD17B055D7CE1F8E9E2784CC56825B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 932e75f3c3f929ec17a2da225f6f70779da648918ac500fa147fb27738a36420
MD5 53d6db59d4dbb8379a73b2d10c9919c2
SHA1 69d070bfc3c0b90f43e709bd963c60a335ac6e83
SHA512 622dc2c41636e6a576d4ead9b6521844b128e814d27cc76d2411b5813960d12a9ba6106aae649bc6bb5389b2c9493bb9d902d23d8d4d3132bddf80258a185b5b
SSDEEP 49152:zY6zmJVY5Oaab2xYY1lhWIw+pPQNkgDZEHW:zPsV4Oapf1p7ot9E
TLSH
T1B4867DEDCA6898C3CD639970B0F0ED877C7413C3F5A5C1D68858C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 044a9835e3d5aa030268f9e2fb42d60ba098872332b7eba571095ab8a865cd73
MD5 fd30850f5d6f40259c39616ae6384778
SHA1 a49e2c893a1771524c94cc981ff6862f71aa8896
SHA512 e88b6435b473202212ae5613876f94fb32d58c9b049652d580f34c1bfba0a30e1c1b68efea86b4eb0ee4c1b19d845599cc2b7d080cb3dcecd88d27e984b98482
TLSH
T1FC711ADD7322D492D3600E30F7DF0693B9F241980A8F6D56F218597E6A0AB6F427B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bea8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bea8.TMP
Size 3KB
SHA256 e448a6bfd828d4b2f72e5295bfea78c950dc97f89d78a285263555e9bd233c56
MD5 18b622412360e5280c98ea7985e64cc9
SHA1 15204af70180dac5ca8cd1d44d81d73885a3226b
SHA512 beec7213657818d997aa96c6d0fd9e4e354fcac6c9c1732a071bffecd4691813f96161a7716633ddf616eb981e387c6f4672c3898158f265ca64c3ca444d5e13
TLSH
T1D2712ADD3322D492D3200E30F7EF0293B9F241880A8F6D56F208597D6A0AB6F427B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Consumer.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Consumer.json
Size 36B
SHA256 0a810145cb1171af59529fa8ee522744453d42b6798e7fa38379a96bad107c5e
MD5 c6a09d92bfda0d8b716fbf96568518a5
SHA1 90138ff588c0a2c42f370618fed8bf2405ef5e84
SHA512 87721d8e1c3438b21757205122f07ca0602d19cd33f1593620521671c57cea77422de03124227a52544af622ede371527d46570278da8ddbf529dd181656e7de
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 36B
SHA256 fb5ee93b95506e6b3a4cbd9fb9bd9955db93085359a0df8a72681641635ee482
MD5 1f193ee37aeee81f512dbf8e0df363d4
SHA1 0c3594290487d03b2a6a41a97d0977a1f2e66262
SHA512 99a8c36f476b28333e4ffd83deb5914f6c007b131645f4f43206b47528a16eec73d823bf6af186d9d885a831984dbdd910a04b6bb9097eb47815c3efb14c9fa1
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 86b62cf16785b32f36c63818679d5f19afc06c48eea8f605e814f930617f46ee
MD5 58fc05cbe9ef649c563e8b9b343bfd50
SHA1 19ad02e5d8765e9fed6b40570d84a4d5cf368427
SHA512 cfa19d6486f2f930c504b4bf433e47d6d90c9434ffd23ac437baf123b19b4d096b8b1a8811a0ff971d37698c87b15c94671188b5ade3ccc54ce90d3c7776f1f5
TLSH
T1DDE07D0815CCE9299CEE6897C7684708C7D0B88BFAC83E865FC998847103242FA9B785
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 dc4260d920c658a4e73a0614865962b96115bf5233f9f9f012c16bbf09702ad8
MD5 46dd970d7b72d9ffd35923b67655e967
SHA1 a3b1ba17a336de20aad27a18f9a1825bdcc54dcc
SHA512 9d77f6bd1dde8dea613c8cfc92e9685f08c772bcd5796cfd2a025876e5ecc4bcf0af867c537a0e7af8b32a16395bee98e89b11855c6a6453174b0d559fbaa7f8
TLSH
T1F9E0D8A046CDE51956482157C228670CD3F0784BE6893BC61B44B884B987004A6866C5
MD5 SHA1 SHA512 TLSH

Submit Download

2198d139-1225-42be-a4bd-4dca10698ac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2198d139-1225-42be-a4bd-4dca10698ac5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a80003e594d2caa4c02ccaa7af5d1cb679df93fc1d02981240a4d2c649ea85bb
MD5 35245f0a7f9cb776d4f365f2da7eb106
SHA1 97b0da3d03bf6ef940b67a38ae0a91ebbdcc25cc
SHA512 d938944bc8f8dbb2d12597127828deb27b71421aae917419f4655c6492f9a5127b71dc520120980fafb01b397edaf3172a81288e9a901d2c0233e3232ec9e7a1
SSDEEP 192:sxZs/yM/jK1Ml87Zb/ftslWpVawIdpdAHW6+WNGYI2VA1IgyJ:sxZs7Wb/ftslWvaRiHbG1O
TLSH
T1FA52E705BA34997BCCDBD209FA557F53D6F90572A2940E48A9FCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 767fb6bbf20e9afaeaa4fcc903da7438c6bc275dfae16379c52e5b060a05a394
MD5 1dc8d83508defc128385d0c2e023664a
SHA1 2cf7b881306d853cb9f0743c6512af5532a963d7
SHA512 086b35c306ddf0cdbbbbca7b95e39ced6043d6edd391582a0a5727ecc724e483c096b0b9c187be7f2ea751889e13cc2e2806c0ed72b0f57d770c588dc8fbfa9d
SSDEEP 192:sxZs/yM/jK1hl8x5Zb/ftsIWpVcwzodpdWHW6+WNGYI21J1IgyJ:sxZsU+b/ftsIWvczQHbG8O
TLSH
T1DF52D705AA34997BCCDBD209FA557F53D6F90563A2940E48A9FCCA1C01E7EED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cfd3081d6c0e72f51d27395e139e7eeb4ea320804b371ec56795d0dea8901ad6
MD5 060583b7415a75b14cdaeb6be187ee0d
SHA1 ce82cb57f3edd6c49fb41d8703d148f390b8cb2d
SHA512 8aa644e8504903cd5915c3c45450bf2dfd4272769ca5a4876aaa7f75c5a991df3ffdd55881e14631a25bf9a90d157df1a4e079b75bedddd2c1a8d3de167c1f7c
SSDEEP 192:sxZs/yM/jK1Wl82Zb/ftsspWpVcwzodpdWHW6+WNGYI2q11IgyJ:sxZsJZb/ftsUWvczQHbGnO
TLSH
T18452E805AA34997BCCDBD209FA557F53D6F90573A2944E4899FC8A0C01E7EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 032348e15b1cba7a127fe614325e5bcc5faf70eae461947de255adabcaec613d
MD5 4a2888ea30192e5dc896730b5f01a959
SHA1 a8fc9e4e820c9092f2eef7ead0c24b7a2b907d68
SHA512 2ce83b052151631a2707cd9f724f0136347c6a33e89856e6101ded520bd32a5964d07bae6211e2220ff42a2252619c3119842f424cf621cf4fa314429cf13ca5
SSDEEP 768:4Z4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+drroh2cIaN:4Z4jeXmWvmKLEu1jacPLZQdYPp
TLSH
T144D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 f18f47dd88db481635fafd00f4a656f15ad85679f066e62e38347c95883974f5
MD5 794ee9869875dee9e5b9b37cdf6f787d
SHA1 d588d6a071a5c4d4cc48ece87322145914b59c96
SHA512 0b88ec4172e7c4c56af5f7100649578de9eaace9760a7ed7a43ba662e4308e5a28506597c9bb5827ad4694815dc125ca3e84734fa1c56aa0da37ea0168cfe23e
TLSH
T17EE0DF1407C8E979609D30434224C70CC2A4B54FF2C83E866F8888A46543E04B197680
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 716B
SHA256 f572d42c4781e91fac28363e265c8e784f359094e666d377f272a577f3f464e5
MD5 a4fa3e960fceaf02b3b61f90e6609c9a
SHA1 88d244ac69db9f03e7dd0a51b692fd44155433ab
SHA512 e1ddd03917dcae9a4031388ced129815f444f7ec1c552c3b8fe76e03d60e339e2d5553e342656694aaf87e0e1062f8780bff9378876c1d9b42afcb9d2abe0fb5
TLSH
T153017DE30A0C9AA4CE4DC3B42CC663F49372518D97E9CBC3962E119712677367C19C43
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 19fb1327115e7256de0327fb91b6b8cf6586449502f7e1bb2e54e6ec09e740dd
MD5 c0bb750a36816b88688685e9f04ae0d5
SHA1 41cc56077bfd3c2dde4940ede95c0f56fd8b2bb5
SHA512 fb31f16af40081fa7aed54f7d9bdceeef3d9a4fb5c59b34763d3befc052cb9a811b50db48f71a50f0f55356b9c5102fc74c55f011b71e3577cda720a05db6432
TLSH
T13DE026E446C8E929629865774238530CC3F4BC4BF3883E861B40E8846F43505B3976D5
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13426072953571296

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13426072953571296
Size 2KB
SHA256 42f2eeb6b343e9b4122aa186cbe600d1c195c79f7a1c0dea2fc848c8a1540854
MD5 32c46e475548c1c8ca7c803464c7cc3c
SHA1 8fa1bd6c90ca059275b46c2ad0dd9dc31aad23f6
SHA512 8a9a1066b2d84722f2fb70b8100a07a9cc10054808e1951a8d34da8805da408a44dbbf7f9bb293cbb40d9fb1ba378b887ddc6b0a5f6e89726a532604437468c4
TLSH
T19851CD0261DD013FD4BA423F94A220EF3970ED737A894D47A0B1752A9C737662FA1D9C
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13426072960031996

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13426072960031996
Size 1KB
SHA256 452f91fc82083785d48c2ec3ab09a4ccf90a6bdab3af930092007a3f539dcbdf
MD5 bad379ebbc43849bf9a2b1ce2ac9d5c0
SHA1 de1bb665338a71ce59695e17030e2ef30765cca6
SHA512 78f47a4ecbfa25a2dcc8ee0ee6c588b0c7caf924eb3f6d93b4c9b11faeccad69629091129094dd4fb8ffc0cd9f353322c37e3d339878f253ad1528e1213db093
TLSH
T1B741688555E8127FD1BF453F94F310F276B0FAA236444D5B81B2A1180C11B6A2EE9E68
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 0ecab33a8ac5a0bd551ae636da60169207e26a19603785df55f30bc9c0a1b72a
MD5 132a4d10fe1d378e1d1d2327bf9374c2
SHA1 c7296eb3259e572df106ecbe58245145a0b2283b
SHA512 f3564b3f016729c3ab7dc977890b5e5b0bb71f15e7274ff7b9cce8871817a1e7aa81434e58481ba30e145b3ceaf6d4a7925a86b1f35adaf5ef830e15b68f2e84
TLSH
T157E0D82417C9DA2AA59971878228D70881A2F48BEACB3A963B48948462079407347645
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fb84666997cb479ea5a7f23acd861f5e0e493b816a8d69b3bc6e2d8bb7d7d8d7
MD5 9c7a58c3662e38c466a724f9a1195982
SHA1 03e79030e4524507dbc2c577992e8e6bf28c3147
SHA512 7f27bb922049b5e0b1d6e20888ca3cbc68fd7d151f1c7ec68f7ceb31624e9d4ee129ae549f8b15193c6c1d679ac39c533316ef8194eb1de6e5ad34ac371c6580
TLSH
T1D2E0807447C5DA399954B18382689B0C82F4F88FA7C73BC76748449465029547769685
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0838caa92c7c52235483dae1447da0efe21d1e0850943f3a9f950a35a3259811
MD5 ed535d554234a6e313ab593aeafe7977
SHA1 24e2fc085a906935c6e6586d389736c3c3f7ab85
SHA512 c99d0b6c317330307d54124c9bdb613ff541786f37dbc94d509a5b61fa745e1ff027acf5e090c923c2acc97d45eee66fa2890f03277bc090718135a4114454b1
SSDEEP 24:Kd9f4LiandPrD4bf+4fP8tayd6qm4a2+NIjQmKilhaum1EY2SmsM18w3yXYlfQDg:K0CFI9K+IgXyp6IfKP6AjCI/Kbi0byD
TLSH
T19E912402717B62413C7F280CA6548B1A0B4271A33559B96B7FA804B75E37F684DFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 1375954125686089f6bfd14cfd9a2e981eca8e35b50f6154606552d3394df977
MD5 dd1c4289c33abbd78717f8af343053d8
SHA1 4dab126b8af1b50e6ac8f5b1aa24fd0dcf006969
SHA512 d8f82bed39e90718e49872b584a0d1aba5176e45835cbbeeb3615c4d396d983b9dc0aafb1b71cef88473df9f8abd2d0a6756f5e7c0c6c051634ce5055e820da3
SSDEEP 192:/+5WMfCbfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5FGfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1AE24730A7B747001EDE6D9725CB080771A3CB16DCF22A6915DB264698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be4534a9-36e4-4a12-932a-54682edc0007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be4534a9-36e4-4a12-932a-54682edc0007.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d4c45b03-aea7-4c78-85e5-975535078a28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4c45b03-aea7-4c78-85e5-975535078a28.tmp
Size 414B
SHA256 b9ad0f59d95796dd93484e10c2e02ce07c4caad82fc4aac707b53d9da94fef88
MD5 87074444bc3ef767d5e2d106e0195a4f
SHA1 a965419270f5ec2e241f1382d2d19346109ade8b
SHA512 6b465c5d90c1479a73f429752364de06559bcb8229481a7ed065f4fa21203934643f25880e1c5d04d10dfc5d61d6bfa3bcc9a677c4ba353db9e66e454daa10df
TLSH
T1ACE02BA6C965AC2709FE0B59B4544786EB5453573BA0850F373D810CCFF55361585C5C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 120KB
SHA256 588b05ac3387c8cef26239f040f34835a8a46075d00b6864f0d78da10e573e23
MD5 6c53f9c1d791ace21ae26ffd4d519293
SHA1 73cc00cbdb44545699a7bfc458c8c833a077c4ee
SHA512 8228d42b28766b149595a843c157997bcb2fcde1c1028d13225be7246957a632b9631f7ea5afab7d888076ab24dcdfdf3fe59afb92b7c5765d992b0093e23a50
SSDEEP 768:s/0BBs5Qlg+ljkA/R7IlU+olP/vKTO2IIpADaooYMVOB1GT34CHUgUMHrAmFbhTy:1Zdnqi/YLAYQJZsWx+vVzA52py
TLSH
T1DCC32FF76D0B90A6DACD91B4D45BEF08447316218620E8E5AE3D08C33B7D60BBE795C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 ccfe7c2d12791aca5ca4ea29a348d3ca25a210de0672f8c075eb9429c7280c8a
MD5 e5333143f308821a611501ae7b5d97ba
SHA1 7eae31bc9660cb65b4290ed4513cd4842f7c32ba
SHA512 d4dc85eecc675342460dd8e41e687c74f353227d399b2c5194358bf879f5371ce3f35f6d9f0718b2526e93f07fe905cd1e5ea0361e13743bc60db36b9842a1ff
SSDEEP 192:PkGOAJAsslrhHsstkCLQXIIImbGMIMslYcY:PWAqs2ust3QXIIImbGMIMuB
TLSH
T14842821A1A152B7BC09E6F7E2252C7945BD98881457021AD32612C5F9DF3EE783C23F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3c84221a1dcea5bda38c9ad02d1763bb567f4e3b834a081b892a6f9916e66d82
MD5 ea50b9e90821b89cd6f9d272dcefe0a7
SHA1 0dc3fffaaf3acbf55df5fdcf0dd3d364ae42e5f8
SHA512 71602588bf519861594446f4d70943fdc175b8cd5ec024ee2cc58fbdacf044daac5b969390af21fd86bce816d412ee437702ce914412fb6636b443f0cca8be68
TLSH
T197E07D30AAC8FD6FB55C20874138430CD38CB84BFAC83ECA7F40C4F8A603100B68A685
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 eaa4ba2e271ee81884749eac971c57d08a9aff180fc95028b3d2016c0346d849
MD5 f64856c30b9812736249ead5165ec62e
SHA1 0fc2078be8a239ea4c7e9e83558efeacc69e7485
SHA512 98d076399b14b678d5b905908d81753f489a2915e3349fef95726973dd5373f88b3e02b321798f0fadf7ce74f3aa5121bc72dba59255b948b8c617f76d26b5e1
TLSH
T1A621F566F334C159D18A467B103E5B151328E8029FB8EC0F59B930652E72F140E4B6D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 73120b07c0c349df1fe36a8c1729e9a3b82dabe9216ed698837db8cc01b4d496
MD5 04c481bd9f5bc9b68039a6932da8686a
SHA1 168799e273b6029b073bd8a3a0688fe93d908bab
SHA512 f6886c066fbd84b39341dacddb3c707b55461b6fb92e808a8153121066299cec85675921302be6459fb0a03a9ece7fa1b4bc0d077a2846cc5d769108d0f09cda
TLSH
T138E0206075C5DD5F615C208341788348D3997C5BFA843F856F48CC985603141764F641
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2d01c8e764bb12334b822628896a6ee9295f27c8259b88e455dbedd4931f5219
MD5 f1accfbae3cd174f5e13671402984b0c
SHA1 1ad7ac7a89ad6216d98cda8ba59a50d1928a3be1
SHA512 d9b691a7eaf3778b240d13b46ba641a653931cad1530640134553193994550347d34659fb16d0ec3222f48b81cf745d898bf45d0b87db11e16936b3bee1aa9db
SSDEEP 384:zpsNtgwJzP2f+G8WYWXKnz1jNVjxKBb437nUn:lmPmxKzPVFKBb437nUn
TLSH
T12372E93D9C646C7F44EFBB09A54E25335DA9113BDAB45A48EBD80B0DC077A5CF346422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 7beeaf3f0ca5647505dc4f9eaf03f1a94b08adc8015022fe520ce3d3c95c7de5
MD5 7127bec217743fc52caed44de3ce0474
SHA1 08fb0e63bc88de033e6dfba3696ce97536ff9807
SHA512 57a234db98af449303f86818687d7a0c73805a2ed506513c6dfd7095f73d3667a7b9fb408e523af657f509800b9e7d84e24ed8fffdf2e70904796e7599cd5f2b
SSDEEP 384:zgsNuMw60P2f+G8WYWXCFh2A8whIloAQo96MxU8:89PmxUD84AQo9hxU8
TLSH
T14372F870E8689CE744E2E5C9B546F1132DA80637C9899E4CE3F97B39309F5FC2716826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 862c728a149b3a5aee76a152138cb4ea624423bbf13d7095afe22eb49efe769a
MD5 960032c6d3ce89c83294a52d14a735e9
SHA1 bbcb82de7091de448c482db1897e1d6878658dd2
SHA512 417df31097d0d631b2ff4deb921e8e206fcfa6c6fc2cbb9f2e1bad950c0a8f802e75d5dfc9e8690f8117946306cffb8754d78001f07f5ca5d76a2df029d61016
SSDEEP 384:zgsNuMw6zP2f+G8WYWXCFh2A8whIloAQo96MxU8:8CPmxUD84AQo9hxU8
TLSH
T11E72F870E8689CE744E2E5C9B546F1132DA80637C9899E4CE3F97B39309F5FC2716826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2a9607b07405dfca838ee2e6440b2b68034ab68b0e92fcb8de74464d9e0794ad
MD5 8948375ca8b73e66dd116684129171b8
SHA1 123bb64c3a61fc89ab36c1e0996541fd56a5cd48
SHA512 ebc2ce8191a0685a677d05dfeda7aabee801de698842f090e3abc00ab2e77b92d822e1a9e1a616626cced35c3c1dd145011dab9c4b4832f9a1bb4cf50cbf6d5a
SSDEEP 192:zKtsNcMQ63ZEQhQmiU2daP8BH/+jV0jzorWYWXv5bFipqziU8:zgsNcMw6tP2f+G8WYWXlk7U8
TLSH
T13F32F8356838EC7758E3F505F49B36535EE821B7AE856F44E6EC5B0C008779C274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b8143fe5982ad3ed637c7bcf6c227d3024a25b44bc4be4ca90937209a452ef93
MD5 e64be9e807ce5d01e63aee904257a38d
SHA1 8375fd7b2333ecd40a6075b58e42c2f6494f64e8
SHA512 7b7adc035da76cb946a40f0968c1523a0f04a98a9303f8bb3f40eeabc06552a47a6eb4307ba0a3582cfba91e821cec37fa5111c50fdf79eab80b84e9b5cb3b8d
SSDEEP 192:zusNuPQ63ZEQAQmiU1WWBZH/+jV0jzorWYWXv5cOTlAqCdU8:zusNuPwtFff+G8WYWXCclWU8
TLSH
T1EA32F8356838EC7758E3F545F48B36534EE821B7AD856F44E6E85B1C00C76AC274B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 10e119db2b19daa86e2c92bc661225232a4a4c10c113dbe39ce0f7764d9ca7bd
MD5 fc8baa29f606e61da4370d1913f5221d
SHA1 b02a06b4051b939960b8d3e19f7c6f1aafd38c77
SHA512 347aa8a08b177a3f442a679befba399d19e84cf604c9c2d589f61a3c7d1e75216bffce8eb4a43668203f0135a0137c4df18ab5daef733c6de10467f174cf23dc
SSDEEP 192:zKGsNcgQ63ZEQfQmiU1cQP8BH/+jV0jzorWYWXA5bFipqziUt:zZsNcgwYxP2f+G8WYWX8k7Ut
TLSH
T1F232F835A838EC7759E7F505F49B36539EE82077AE856F84E6EC5B0C008779C234A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1b7831583c120c62e2d7059731380727c84087e82b511841ea6f9aa8a280e39b
MD5 8e992ed09d2700af8299e5519ed69df6
SHA1 cfa4583ee85078080653180295cd24e6cc084452
SHA512 a80fde43da09e18ea9a24ee4f117b7540f67ef76cf2812afab13d91c37658d9ae94a642f789200b9616e9220fe99e2d336df51a28a4d2313f357ddecc213de6b
SSDEEP 192:zKksNbYgQ63ZEQYQmiU2HKEP8BH/+jV0jzorWYWXKy54FEdqbUn:zpsNbYgwJsP2f+G8WYWXKLC6Un
TLSH
T155421A326C68AC7B5DE3E545F44B36135EE95127ABC97F84D6EC1F1C00CB6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00f5a501c0f1d056f1bccdf064f5dd76184fdc74c88a51adbd152ece7aca3110
MD5 cddac5691dc2262466ee2938a07f24a0
SHA1 706d0e80a0c5797885903490f486e8535c2b0ff3
SHA512 ad4a7a52137deac9982e4d9d81a8a9cbef71b55dbeba698f7bf997ae23664496391dc4bb96c0f52a38f5a1378f73b3bf87b1b9208cabdb0f85b5a743c60499e6
SSDEEP 192:EONC6hZ0QmiUyrfpc/+jV0jzorWYt5wOZl/iU6:EONC6ospu+G8WYc2lKU6
TLSH
T18F02EA35A8686C778EE2AE45F48777235FE5112BA9956F84DBEC1B1C00D779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 434687f003625bb9bb4a5a9e5ef71efca72d0896e10d3af07b72ea04e21ce60b
MD5 e32d049f6f9bd53237b362734ca06a01
SHA1 16fc06c55a7767220501a63193100e626cbbc4da
SHA512 42184112f200ceafb057613b5c23d07ff7558a3bb3e5d06085a476acfe85c171dd482e56ee029011832c37e499ea03b6196819c55b4b85dd164d3494bbf52b6a
SSDEEP 384:zQ3sNcgwAAP2f+G8WYWX8kFjI9xKBb4375Ut:M3jPmxrqDKBb4375Ut
TLSH
T13D72E83D9C646C7F44EEB708A54E35235DA9113BDAB89A48E7DD1B0CC0BB95CF346422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7bb16ce21a58afbc3e708317a75ebb98f76c0a338dfaa9ecee48a05c396d3a02
MD5 3b1f733d14ce1156cf33cc1dafe4f914
SHA1 a1f12df0b7fd673e8745a596456292a0a4a570b2
SHA512 614c8489947ab56b042e324b2e26f092d56670e6d695f7804dede12d80321f9af86be813c0038621532edec14bdcf901a9040e7c77e23b3c4a5f352c739e46c2
SSDEEP 192:zKX3sNggQ63ZEQHQmiU2tOP8BH/+jV0jzorWYWXA5eFl3qiUt:zQ3sNggwADP2f+G8WYWX5zlUt
TLSH
T1EE3209326C68AC7B5DE3E545F04B36135EE95127AB896F84D6EC1B1C00CB6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 50c8e3743d21f9fd712396060092890d9962473bc70c72d9b430a0aa4952da09
MD5 8882c5df8950dbfe8bd5a372d5b1fc02
SHA1 7c6af859cfe3774519b4753348905f7ddff8c1f5
SHA512 c0ee55b893b9b75c3eb80877caaab401793610c56fe37d384a29ac633948bdc19e3f63f3329fe5aa604972043b352800f12d0a1e087ea3c4781577ccb609a519
SSDEEP 192:kONf6hZVQmiUyBfKc/+jV0jzorWYWX05cOqlAqCdU6:kONf6HEKu+G8WYWXH9lWU6
TLSH
T1B012EA35A86CAC6749D3B545F4CB32635ED82177AD85AF84E6E81B1C00C779C374A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 f262a68435501a05a1688a83a9a52da43156e832271674461c3767c442ba3994
MD5 d3b29df44badc172b4e6c4a595fe9d29
SHA1 ac06fc6ee9a117d010dd100045ff6ca09f87263b
SHA512 35258b2e6b7689e8b080ba89a9d435cca626a6df1969eb7b1a2bfcd3ef0e276587782767749883404c4973c3016c3b9256f850ac9e64e5791cd87542718de4d1
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtydukzbd5vaUf:TLyT5UOl0afDdWec9sJ7MvpejB5fc
TLSH
T12A92A2236D352033D8DE8776F98345D10EB9135EC9A7B844CDD04D620DB1BC2A2995FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 148c6c9865f146af2c310e6812fe9f6e9d9796a4833b22f47dcfe8f6e9958f0d
MD5 2a46314d214661a47753b15b4bd55c68
SHA1 7c623ec03b24d2bce106f692152a08a6fa88aba2
SHA512 518c6c648540f7e2e0d14ff309dd4f16349aa75b6d27e20b542f86038e2201049f19005b0afb74b47d769db00560d7e8ef9df72e3704838521c8e595ce83dc95
TLSH
T144412A58AAEA1158B3B76E4AAFF6596D887E78772E07D49D00110E4F0A63F00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 50eaae0fe5e7416d7d17662dd54d0b862248ebc81b72ff25a9db0f44a944fc10
MD5 b363b2714fcde01b65a05dea6c49ca08
SHA1 6973934bcb9a6c4a0881007c5438f591ec6444ae
SHA512 c935129713a9885ea0108406cbb0fc4a5d87d361914d21589252e6ad8e515eba4d780c147320451d32dc76426fdc9fdbcf11c78e87b2fee7d64d7bbd17aaa494
TLSH
T1AC517058AAEE1108B3B37E97AFF6756D847BB9732F06959E10010E4F0623A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

log.html

Path C:\Users\Admin\AppData\Roaming\log.html
Size 1.2MB
SHA256 8ebcef8091c16daee1dd6ed6e762bdd398757921defe394cf2e26f9cf8c739d1
MD5 f8a47d5aca34699cc7051de028c0f431
SHA1 e977f6729ca2a3dc718f73d5541179d3ffd41982
SHA512 ea9a12d7aeee4621c8a2ae996056240d5103cbd448c61a83ebb5d971afcfa9460e8292e1fab2e2e202e4350eab12a1ac0c5bea4248cb3ce3f7729325d13a9010
SSDEEP 6144:mJkgSf+VEqddTNV2s3xUq3zh8tWX5eewuWFfUySZJISBbtX4CJzl/DQFfiYBSWMu:t
TLSH
T10445A3616BF42208F3F36F6A6EF245655A3FF861AD74D54D014A02CE88B2E54CE34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tjqobeb.exe

Path C:\Users\Admin\AppData\Roaming\tjqobeb.exe
Size 284KB
SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
MD5 209a288c68207d57e0ce6e60ebf60729
SHA1 e654d39cd13414b5151e8cf0d8f5b166dddd45cb
SHA512 ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
SSDEEP 3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
TLSH
T1C3549D02B7EBC0F3E86744744666D3BB467E2D432739D2C7AB503E1AEA311D26638716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-9860-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9859-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9858-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9870-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9869-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9868-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9867-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9866-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9865-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download

memory/988-9864-0x0000028C92920000-0x0000028C92921000-memory.dmp

Download