1ac60122a83adf3b5aed0835095ef7de9c440df1a27aec0846fdb44a4d2ab3d2

Analysis

user interaction
yes
max time kernel
35s
max time network
50s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
DELTA CRACK.exe
Size 454KB
Sample260701-w7tk3sd15z
SHA256 1ac60122a83adf3b5aed0835095ef7de9c440df1a27aec0846fdb44a4d2ab3d2
MD5 6b661d90903d6d0adde704994d21d6df
SHA1 e3f58b9591f92821e1eddb903e3ba28950e2cd2e
SHA512 194b3640d4a7076c8c482bdfcad7e0f6f125c34011e4abaca74487685b0f7d175af1c8759c82f195ed4e1cb72f59b66e122feb3ecdb8d9177884ae7070c1e831
SSDEEP 12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t43:xuDXTIGaPhEYzUzA0/03
TLSH
T1C5A47D0AE7E809F8E0B7E57889574902E7773C4903719A8F13AD156B1F673A0DE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6120	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
920	powershell.exe
2500	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3912	msedge.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
6140	timeout.exe
4360	timeout.exe
5272	timeout.exe
5204	timeout.exe
1756	timeout.exe
5580	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	DELTA CRACK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
920	powershell.exe
920	powershell.exe
2500	powershell.exe
2500	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	powershell.exe
Token: 33	6076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6076	AUDIODG.EXE
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2500	powershell.exe
2380	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 6120	1040	DELTA CRACK.exe	88
PID 6120 wrote to memory of 6072	6120	WScript.exe	89
PID 6072 wrote to memory of 1016	6072	cmd.exe	91
PID 6072 wrote to memory of 1756	6072	cmd.exe	92
PID 6072 wrote to memory of 5580	6072	cmd.exe	93
PID 6072 wrote to memory of 6140	6072	cmd.exe	94
PID 6072 wrote to memory of 4360	6072	cmd.exe	95
PID 6072 wrote to memory of 5272	6072	cmd.exe	96
PID 6072 wrote to memory of 5204	6072	cmd.exe	97
PID 6120 wrote to memory of 920	6120	WScript.exe	98
PID 6120 wrote to memory of 2500	6120	WScript.exe	101
PID 6120 wrote to memory of 2380	6120	WScript.exe	104
PID 2380 wrote to memory of 2324	2380	msedge.exe	105
PID 2380 wrote to memory of 4400	2380	msedge.exe	107
PID 2380 wrote to memory of 3912	2380	msedge.exe	108
PID 2380 wrote to memory of 4400	2380	msedge.exe	107
PID 2380 wrote to memory of 4400	2380	msedge.exe	107
PID 2380 wrote to memory of 3536	2380	msedge.exe	109
PID 2380 wrote to memory of 3536	2380	msedge.exe	109
PID 2380 wrote to memory of 1320	2380	msedge.exe	110
PID 2380 wrote to memory of 1320	2380	msedge.exe	110
PID 2380 wrote to memory of 1320	2380	msedge.exe	110
PID 2380 wrote to memory of 3044	2380	msedge.exe	111
PID 2380 wrote to memory of 3044	2380	msedge.exe	111
PID 2380 wrote to memory of 3044	2380	msedge.exe	111
PID 2380 wrote to memory of 1176	2380	msedge.exe	112
PID 2380 wrote to memory of 3584	2380	msedge.exe	113
PID 2380 wrote to memory of 1176	2380	msedge.exe	112
PID 2380 wrote to memory of 1176	2380	msedge.exe	112
PID 2380 wrote to memory of 3584	2380	msedge.exe	113
PID 2380 wrote to memory of 3584	2380	msedge.exe	113
PID 6120 wrote to memory of 2352	6120	WScript.exe	115

C:\Users\Admin\AppData\Local\Temp\DELTA CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\DELTA CRACK.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DELTA CRACK.vbs"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mc_launch_log.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\mode.com
      mode con: cols=110 lines=32
      4⤵
      PID:1016
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1756
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5580
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6140
  - - C:\Windows\system32\timeout.exe
      timeout /t 4 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4360
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5272
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $form = New-Object System.Windows.Forms.Form; $form.Text = 'Minecraft 1.16.5'; $form.Width = 854; $form.Height = 480; $form.StartPosition = 'CenterScreen'; $form.BackColor = [System.Drawing.Color]::FromArgb(255, 34, 34, 34); $label = New-Object System.Windows.Forms.Label; $label.Text = 'MOJANG'; $label.Font = New-Object System.Drawing.Font('Arial', 36, [System.Drawing.FontStyle]::Bold); $label.ForeColor = [System.Drawing.Color]::White; $label.AutoSize = $true; $label.Location = New-Object System.Drawing.Point(320, 180); $form.Controls.Add($label); $timer = New-Object System.Windows.Forms.Timer; $timer.Interval = 3000; $timer.Add_Tick({ $form.Close() }); $timer.Start(); [System.Windows.Forms.Application]::Run($form)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Asta -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).MinimizeAll(); Add-Type -AssemblyName System.Windows.Forms; $text = [string][char]69 + [char]823 + [char]82 + [char]823 + [char]82 + [char]823 + [char]79 + [char]823 + [char]82 + [char]823 + [char]58 + [char]823 + [char]32 + [char]823 + [char]68 + [char]823 + [char]76 + [char]823 + [char]76 + [char]823 + [char]32 + [char]823 + [char]74 + [char]823 + [char]65 + [char]823 + [char]73 + [char]823 + [char]76 + [char]823 + [char]85 + [char]823 + [char]82 + [char]823 + [char]69 + [char]823; $title = [string][char]178 + [char]194 + [char]178 + [char]212 + [char]194 + [char]178 + [char]212 + [char]194 + [char]206 + [char]194 + [char]203 + [char]212 + [char]194 + [char]203 + [char]212 + [char]212 + [char]203 + [char]196 + [char]194 + [char]208 + [char]212 + [char]194 + [char]203 + [char]196 + [char]212 + [char]208 + [char]194 + [char]196 + [char]203; for ($i=0; $i -lt 7; $i++) { [System.Windows.Forms.MessageBox]::Show($text, $title, 0, 16); Start-Sleep -Milliseconds 150 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://upload.wikimedia.org/wikipedia/ru/b/b4/Herobrine.png
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8b81fc188,0x7ff8b81fc194,0x7ff8b81fc1a0
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,13347349594445935771,293355817073591130,262144 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2156,i,4621092431245093373,7711921500003617200,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2608,i,3371632499218569147,16949078137232040927,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,13521399923686649844,8003711257699864603,2097152 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,7227798834714499147,12330841645854594069,2097152 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4064,i,14071205983812942305,2864828465275482659,2097152 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,12462267162363985095,3823193006674921121,2097152 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3692,i,14450254256581675714,3484788570375787525,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5284,i,10535984030890405072,11291514665631813705,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5236,i,7138944947139912210,2224706270766077091,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5944,i,12547156541484659437,17177272802050611319,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5944,i,12547156541484659437,17177272802050611319,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6180,i,16153466141177744842,8155031839596135513,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6196,i,12633289139287896786,16943685422861458710,524288 --field-trial-handle=2528,i,483277758513618775,10529968662920573163,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:4524
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c shutdown /s /t 10 /c "Â²Ã‚Â²Ã”Ã‚Â²Ã”ÃŽÃ‚Ã‹Ã”Ã‚Ã‹Ã”Ã”Ã‹Ã„Ã‚ÃÃ”Ã‚Ã‹Ã„Ã”ÃÃ‚Ã„Ã‹"
    3⤵
    PID:2352
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /t 10 /c "Â²Ã‚Â²Ã”Ã‚Â²Ã”ÃŽÃ‚Ã‹Ã”Ã‚Ã‹Ã”Ã”Ã‹Ã„Ã‚ÃÃ”Ã‚Ã‹Ã„Ã”ÃÃ‚Ã„Ã‹"
      4⤵
      PID:5720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2888

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:124

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
1⤵
PID:5420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6c25419e866e05d07f490f268f601ca3d3c2c049bef269de48fc0a29af7ab2e5
MD5 7a5bb20551af92cf7b282224ab31c0c4
SHA1 04ee31b7ca2358b75c000d87078472a8ad2f3843
SHA512 5c7ec7e56a268827576ee1997689aef2cee66be235d074d14d1da6ab87982262a2203cdc846d0a5e405498c458ec9d2d5113fecc6b13126f186bb498b1406b1a
SSDEEP 192:sxR7RUyM/jK1Ml8wvI/fCst9JWZ3F58zoA8pun/g6+WN3NZR/YQ2Ae0qGgIgtJ:sxR7ihI/fCstXg3F/U/53l/5e0e3
TLSH
T13762E956AA34997B8CDBD20DF9517F53D6FC1533A2941E44AAFC8A0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 44e2b0c88f5e1a5d60e2f591bbd71d2dbd60f5bcb47deb650d4a05f3831a43fb
MD5 816e99d539c97ea07bdc3e780ce09bae
SHA1 c0b3713f864a5880b35a6f840425714565dcc6f3
SHA512 4216ed6ceb343ff563162d58f33b3d5332384ebe8bf0f10ff453d3c4c546a240abde6053658bfdd3823601503ce7a5f019c22e9db72cff065ac7d22d1597d9c3
SSDEEP 192:sxRoRUyM/jK1Ml8wvI/fCsZ9JWZ3F58zoA8pun/g6+WN3NZR/Y49Ae0EGgIgtJ:sxRoihI/fCsZXg3F/U/53l/Ce0c3
TLSH
T1B262F916AA3499778CDBD20DFA557F53D2F81573A2941E44ADFC8A0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ceedb15d91b99e6165b0f32aa5b26217ea920eb1e8ea8960db7ed99d47abbf48
MD5 047c28fa93c0e8c88ccfe30d2ec2b4a9
SHA1 fe939672ac44698d9e150796f28438d512e205c5
SHA512 efba6ecf7b28403f69c2f8d55f4a7326fee806d69a783b24a0945b9b04ad0050e14dee8c626b3ccf75c1d4d0947fe30669bceaf321ae07ccc09ae05f13ed7d9f
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUdMXNG+roKTpDR:Tqi0NHE7C3WgNxfezu1ja3dM9GV0
TLSH
T11AE2EC7B680CCB7E4F804E9CEC2A7E8A6DE802CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 840259a2496601c226ebdfebcf3503116edc3a237ec873ba6bfaf8dbda2c4e7f
MD5 723da30f90d215197d641ac8fcba228f
SHA1 36c3df5293e8b64af79f43f6f2002b17e95707ef
SHA512 679ad7166b0fea5b3f1d8add2fa7aa475604b43d1a0cde55b369e80996b77dc8f0b5cba7a5625e6e8af531a9915e1f4d7f1451f2ed603b57e60f78adcb49a3a7
SSDEEP 96:KobeKUgWyUIK5WiXAlf1vz3Wx+EgpJK4AgnJcPnmZl6HS3eyEkUyz:odznXAlf1vzGx+VpjAgnWPnmZl6HS3ee
TLSH
T17B91941471BB2740393D2D1995A4D85A868170B330AEE4BB3FE924E59F67E024FFC9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 884841548eab9fc50ad4ae589d8717943a33bb025ac4359176a1eef5b8129249
MD5 987d5511b826b72728aedd908cdea7d2
SHA1 0ff58c55b544538fe511250e5bdbbc332ac4c4ab
SHA512 59527bcfcd61c1b1d984a396a075125e6ff77dee55dd443089b3c454af72e3c64189c18b79b67d16984b5244bb31e9303fac1cac4eff13360ca9e9f9eb955c1b
SSDEEP 768:Arv+4UNbd23TPthX9ltIB+AW+152MvSCa2ckr+8rir9:Absbs3n9IBpx2p7krDriR
TLSH
T11703CF32D869A9738CF6C6C4764B36037EB4519386C10B94CDDE2B4E429B6CD230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 faeb5f928e5ced161676978b5a2323ae641986c30e5514048b73820ea9f492ff
MD5 a6dd4bd68c065b7500787d3775cca736
SHA1 c5360a29c47c131a44c354e4e147a020e2782418
SHA512 2a48da992329fc98df4bc49e6c8ad20ed19920fe0924e1d3db6e0f5d8fc541cd81377d254e4be7155afa6b395ee39d28caf90fd6bc1b7bd8d4bbc57c401c5369
SSDEEP 768:Trv+4UNbd23CKthX9ltI9Kh+AW+152MvSCai1c8Kzir:Tbsbs339I9opx2pOctzir
TLSH
T1CB13BF32A869DD738DE692C4728B3B537EB4126386820F54C9C95B4D028768E374BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5c519c5bb5edbfc7ee0115aa11d0b2ed5b2d39e8743b0df500f32d1f4684fe3e
MD5 09b7ca0ecd910f71fb262a83c7461fcf
SHA1 a8c33fd55c94d7cfa89eeef0fe93c6a1818668b2
SHA512 0fa5ad57d638b067395ab8815c62afc5070a27d702ce7b488b9c4cdc9fb81833ccb1c6f4b31ffd6f693e0e55a22f537e664583e7337f601948f314bfcbc13c08
SSDEEP 768:Rrv+4UNbdw3kKthX9ltI9Kh+AW+152MvSCaiXc8Kzir:Rbsbm3x9I9opx2pYctzir
TLSH
T15D13CF32A869DD738DF682C4728B3B537FB4126386820F54C9D95B4D068768E370BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfaae7df-d8c8-4777-aebc-7ae2c66465a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cfaae7df-d8c8-4777-aebc-7ae2c66465a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 06cffada20d1caf05c406ff27f8322efcd150bb4fc0649a5bc09e907f64a80ff
MD5 c528f8f3cc1071aefb1eb40cfe845e32
SHA1 3cc6340d3f3f0e36fa758d0eb17c58951ba1d0c9
SHA512 2e55e9d33c68be0337728543c362cce4030a87ad1dba8e9624eda9ee32f97aed084faab99dbe0b573dd19152ec92b42504b9a6c34fe65cca68457189a676eca1
TLSH
T11F214633F3CC8215D88A403650CEAC1036B6D7DB409E8E5BAB85D649B43F699CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

DELTA CRACK.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DELTA CRACK.vbs
Size 6KB
SHA256 74a7ff97058c744d38dba9394f3f3d321ada0bdaf8f5a2abad364b0239a43fde
MD5 ac7d6854d99ebfcacc11c0e54b52348a
SHA1 2bfc525ee9abb8a532f6e0699c6df7a0d3a9466e
SHA512 a246ae19c8b27a26dfe9bc386ca8938c518701e721beb15e131d6da2eb7c038dcf5b7d138a7445831fa0968ce9c9be23186e21d9fc5bade7665e24c029274553
SSDEEP 192:kuXmpzKcupsM9Ym0IjwN97g1IjgSFTcgtg1zqd:kuXeVuh0IMNRg1IrDg1ze
TLSH
T177E17411EA1F28C20A51B3D1801734DCEA1642B7778FA2D6398ECC4BF6AD344726ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_miqjybit.vte.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_miqjybit.vte.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mc_launch_log.bat

Path C:\Users\Admin\AppData\Local\Temp\mc_launch_log.bat
Size 950B
SHA256 71b81686b83156cba31f14b46b438a7835aca5c4878cb71333c66844d7d1078d
MD5 96815415f23c865d4722da6b07a7b9f8
SHA1 1f9bfd140c09e31b3e220aa0825b3b3a819fe630
SHA512 3a34d1ecfe4d4c82121a246fc04b453aac7c2749a4f571c7f8aa893b52b77878d8af929439dc777c9586cd8f9d6cbc3c6558f1c04b384adc3e086e7f0a17f9e5
TLSH
T14111ED033512B4C398EA7430CE3870E675F145BBCE4CBAD03B42C2588B4DA82B76E864
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2380_1041684083\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-22-0x000001739BA30000-0x000001739BA52000-memory.dmp

Download

memory/2500-34-0x00000139A2560000-0x00000139A257C000-memory.dmp

Download

memory/2500-29-0x00000139A1F00000-0x00000139A1F1E000-memory.dmp

Download

memory/2500-30-0x00000139A1F20000-0x00000139A1FD2000-memory.dmp

Download

memory/2500-31-0x00000139A20E0000-0x00000139A20EA000-memory.dmp

Download

memory/2500-32-0x00000139A2110000-0x00000139A212E000-memory.dmp

Download

memory/2500-33-0x00000139A20F0000-0x00000139A20FA000-memory.dmp

Download

memory/2500-37-0x00000139A2140000-0x00000139A214A000-memory.dmp

Download

memory/2500-35-0x00000139A2100000-0x00000139A2108000-memory.dmp

Download

memory/2500-36-0x00000139A2130000-0x00000139A2136000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads