9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893

Analysis

user interaction
yes
max time kernel
52s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unconfirmed 515131.msi
Size 6.6MB
Sample260809-xwpcnaca66
SHA256 9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893
MD5 046c2491e0c3a14aa78c5c66102447e7
SHA1 86f5dfe93183c33044ff1aff4bdb5962d38ec1a3
SHA512 bc6bc7982c3a782d9bf36ae44a33426cbddb3aa54be86207847c89b9e7c078005a22c95eca0a97f99862cfcfd97d4b8d9b6ec131cc4ba56fa4be1d20a1259f67
SSDEEP 196608:At2hzUaRxVIylRM6SeeYwCwciQYE6MCeORIlx4:hlUUTjSPfXObae4Ilx4
TLSH
T1C666335B7EC5C222CC256C3B047BCB648628BC109B69589372A0B36DDDF16D05FA6DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1548	ahc_launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
520	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ahc_launcher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	discord.com
88	discord.com
90	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\ahctesting\ahc_launcher.exe	msiexec.exe
File created	C:\Program Files\ahctesting\Uninstall ahctesting.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58ad52.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ad52.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE3C.tmp	msiexec.exe
File created	C:\Windows\Installer\{48402D93-FC77-404D-8141-F2C0764DD5D2}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{48402D93-FC77-404D-8141-F2C0764DD5D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\{48402D93-FC77-404D-8141-F2C0764DD5D2}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58ad54.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5208	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307763895026339"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\ProductName = "ahctesting"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\096976871033933519530E45A2F6C26E\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\shell	ahc_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\shell\open\command\ = "\"C:\\Program Files\\ahctesting\\ahc_launcher.exe\" \"%1\""	ahc_launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\ProductIcon = "C:\\Windows\\Installer\\{48402D93-FC77-404D-8141-F2C0764DD5D2}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Language = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher	ahc_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\DefaultIcon	ahc_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\shell\open	ahc_launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C001242E-8918-4811-84D9-42D391EDE87A}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\PackageName = "Unconfirmed 515131.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\URL Protocol	ahc_launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\PackageCode = "DD31D13771455FA4BAC9F5D3C641386C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Version = "16842753"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\DefaultIcon\ = "C:\\Program Files\\ahctesting\\ahc_launcher.exe,0"	ahc_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\shell\open\command	ahc_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C42987A4-3AC8-4A88-A0E5-0EC274E869DF}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\096976871033933519530E45A2F6C26E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\fortnitelauncher\ = "URL:launcher.ahc.testingserver protocol"	ahc_launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	msiexec.exe
1456	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4440	msedgewebview2.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	1456	msiexec.exe
Token: SeCreateTokenPrivilege	3080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3080	msiexec.exe
Token: SeLockMemoryPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeMachineAccountPrivilege	3080	msiexec.exe
Token: SeTcbPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	3080	msiexec.exe
Token: SeTakeOwnershipPrivilege	3080	msiexec.exe
Token: SeLoadDriverPrivilege	3080	msiexec.exe
Token: SeSystemProfilePrivilege	3080	msiexec.exe
Token: SeSystemtimePrivilege	3080	msiexec.exe
Token: SeProfSingleProcessPrivilege	3080	msiexec.exe
Token: SeIncBasePriorityPrivilege	3080	msiexec.exe
Token: SeCreatePagefilePrivilege	3080	msiexec.exe
Token: SeCreatePermanentPrivilege	3080	msiexec.exe
Token: SeBackupPrivilege	3080	msiexec.exe
Token: SeRestorePrivilege	3080	msiexec.exe
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeDebugPrivilege	3080	msiexec.exe
Token: SeAuditPrivilege	3080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3080	msiexec.exe
Token: SeChangeNotifyPrivilege	3080	msiexec.exe
Token: SeRemoteShutdownPrivilege	3080	msiexec.exe
Token: SeUndockPrivilege	3080	msiexec.exe
Token: SeSyncAgentPrivilege	3080	msiexec.exe
Token: SeEnableDelegationPrivilege	3080	msiexec.exe
Token: SeManageVolumePrivilege	3080	msiexec.exe
Token: SeImpersonatePrivilege	3080	msiexec.exe
Token: SeCreateGlobalPrivilege	3080	msiexec.exe
Token: SeCreateTokenPrivilege	3080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3080	msiexec.exe
Token: SeLockMemoryPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeMachineAccountPrivilege	3080	msiexec.exe
Token: SeTcbPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	3080	msiexec.exe
Token: SeTakeOwnershipPrivilege	3080	msiexec.exe
Token: SeLoadDriverPrivilege	3080	msiexec.exe
Token: SeSystemProfilePrivilege	3080	msiexec.exe
Token: SeSystemtimePrivilege	3080	msiexec.exe
Token: SeProfSingleProcessPrivilege	3080	msiexec.exe
Token: SeIncBasePriorityPrivilege	3080	msiexec.exe
Token: SeCreatePagefilePrivilege	3080	msiexec.exe
Token: SeCreatePermanentPrivilege	3080	msiexec.exe
Token: SeBackupPrivilege	3080	msiexec.exe
Token: SeRestorePrivilege	3080	msiexec.exe
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeDebugPrivilege	3080	msiexec.exe
Token: SeAuditPrivilege	3080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3080	msiexec.exe
Token: SeChangeNotifyPrivilege	3080	msiexec.exe
Token: SeRemoteShutdownPrivilege	3080	msiexec.exe
Token: SeUndockPrivilege	3080	msiexec.exe
Token: SeSyncAgentPrivilege	3080	msiexec.exe
Token: SeEnableDelegationPrivilege	3080	msiexec.exe
Token: SeManageVolumePrivilege	3080	msiexec.exe
Token: SeImpersonatePrivilege	3080	msiexec.exe
Token: SeCreateGlobalPrivilege	3080	msiexec.exe
Token: SeCreateTokenPrivilege	3080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3080	msiexec.exe
Token: SeLockMemoryPrivilege	3080	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3080	msiexec.exe
3080	msiexec.exe
1548	ahc_launcher.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 520	1456	msiexec.exe	90
PID 1456 wrote to memory of 4868	1456	msiexec.exe	101
PID 3080 wrote to memory of 1548	3080	msiexec.exe	105
PID 1548 wrote to memory of 4440	1548	ahc_launcher.exe	107
PID 4440 wrote to memory of 2408	4440	msedgewebview2.exe	108
PID 4440 wrote to memory of 2204	4440	msedgewebview2.exe	109
PID 4440 wrote to memory of 2204	4440	msedgewebview2.exe	109
PID 4440 wrote to memory of 2204	4440	msedgewebview2.exe	109
PID 4440 wrote to memory of 1936	4440	msedgewebview2.exe	110
PID 4440 wrote to memory of 3396	4440	msedgewebview2.exe	111
PID 4440 wrote to memory of 3396	4440	msedgewebview2.exe	111
PID 4440 wrote to memory of 3980	4440	msedgewebview2.exe	112
PID 4440 wrote to memory of 3980	4440	msedgewebview2.exe	112
PID 4440 wrote to memory of 3980	4440	msedgewebview2.exe	112
PID 1548 wrote to memory of 4512	1548	ahc_launcher.exe	116
PID 4512 wrote to memory of 2744	4512	msedge.exe	117
PID 2744 wrote to memory of 5040	2744	msedge.exe	118
PID 2744 wrote to memory of 5208	2744	msedge.exe	119
PID 2744 wrote to memory of 5236	2744	msedge.exe	120
PID 2744 wrote to memory of 5236	2744	msedge.exe	120
PID 2744 wrote to memory of 5236	2744	msedge.exe	120
PID 2744 wrote to memory of 5252	2744	msedge.exe	121
PID 2744 wrote to memory of 5252	2744	msedge.exe	121
PID 2744 wrote to memory of 5416	2744	msedge.exe	123
PID 2744 wrote to memory of 5416	2744	msedge.exe	123
PID 2744 wrote to memory of 5416	2744	msedge.exe	123
PID 2744 wrote to memory of 5464	2744	msedge.exe	124
PID 2744 wrote to memory of 5464	2744	msedge.exe	124
PID 2744 wrote to memory of 5464	2744	msedge.exe	124
PID 2744 wrote to memory of 5576	2744	msedge.exe	125
PID 2744 wrote to memory of 5576	2744	msedge.exe	125
PID 2744 wrote to memory of 5576	2744	msedge.exe	125
PID 2744 wrote to memory of 5584	2744	msedge.exe	126
PID 2744 wrote to memory of 5584	2744	msedge.exe	126
PID 2744 wrote to memory of 5584	2744	msedge.exe	126
PID 2744 wrote to memory of 5824	2744	msedge.exe	128
PID 2744 wrote to memory of 5824	2744	msedge.exe	128
PID 2744 wrote to memory of 5956	2744	msedge.exe	130
PID 2744 wrote to memory of 5956	2744	msedge.exe	130
PID 2744 wrote to memory of 6008	2744	msedge.exe	131
PID 2744 wrote to memory of 6008	2744	msedge.exe	131
PID 2744 wrote to memory of 6008	2744	msedge.exe	131
PID 2744 wrote to memory of 5432	2744	msedge.exe	133
PID 2744 wrote to memory of 5432	2744	msedge.exe	133
PID 2744 wrote to memory of 5440	2744	msedge.exe	134
PID 2744 wrote to memory of 5440	2744	msedge.exe	134
PID 2744 wrote to memory of 6420	2744	msedge.exe	135
PID 2744 wrote to memory of 6428	2744	msedge.exe	136
PID 2744 wrote to memory of 6428	2744	msedge.exe	136
PID 2744 wrote to memory of 6460	2744	msedge.exe	138
PID 2744 wrote to memory of 6884	2744	msedge.exe	139
PID 2744 wrote to memory of 6884	2744	msedge.exe	139
PID 2744 wrote to memory of 6948	2744	msedge.exe	140
PID 2744 wrote to memory of 6948	2744	msedge.exe	140
PID 2744 wrote to memory of 7084	2744	msedge.exe	141
PID 2744 wrote to memory of 7084	2744	msedge.exe	141
PID 2744 wrote to memory of 7092	2744	msedge.exe	142
PID 2744 wrote to memory of 7092	2744	msedge.exe	142
PID 2744 wrote to memory of 6320	2744	msedge.exe	143
PID 2744 wrote to memory of 6320	2744	msedge.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 515131.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files\ahctesting\ahc_launcher.exe
  "C:\Program Files\ahctesting\ahc_launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1548.4944.10789073399287129691
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffce9db078,0x7fffce9db084,0x7fffce9db090
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,4488429251720066306,6569041243733907422,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,4488429251720066306,6569041243733907422,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,4488429251720066306,6569041243733907422,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:8
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,4488429251720066306,6569041243733907422,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://2.56.244.252:3000/?client_id=dbfd9890025c47dcae651494080c30ad
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://2.56.244.252:3000/?client_id=dbfd9890025c47dcae651494080c30ad
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2bc,0x7fffc96ec188,0x7fffc96ec194,0x7fffc96ec1a0
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11597090453784758862,1678504814550283754,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,11041938881995830615,7763366877864134381,262144 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,6517021901708375603,3501531086584904900,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11421238996544683401,4938339920073222049,2097152 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9084802195626009094,15855230307211701791,2097152 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,1379676984663057884,5188397415702353831,2097152 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11273356450646177264,1110999753808627274,2097152 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
        5⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14798525746353829899,11114201011985657817,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
        5⤵
        
        PID:5824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1632,i,16908355613917070058,3342140988953697239,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
        5⤵
        
        PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5404,i,13956860925599494066,14147285043027969637,2097152 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,12475341351086788453,7941803629616304963,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,4291777216814967534,6454449068015299839,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4759618919162087276,16380068627391167232,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:6420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,1401797846588445048,8337409747221039374,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
        5⤵
        
        PID:6428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,1601172737262583518,15554649649231763020,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8
        5⤵
        
        PID:6440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,1601172737262583518,15554649649231763020,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8
        5⤵
        
        PID:6460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6165219631059854089,12542336960790820161,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
        5⤵
        
        PID:6884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,11942817688453389679,17327394070303349500,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
        5⤵
        
        PID:6948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,14361962866156156524,12404091906267808356,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
        5⤵
        
        PID:7084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,6768485758242540682,1565543749833921782,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
        5⤵
        
        PID:7092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,9518547286074084465,10474374942937253802,524288 --field-trial-handle=2244,i,16944461802445454174,2550577782695471012,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
        5⤵
        
        PID:6320

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD5BB1AC4FB2F68CBE6DC4C9C4FE4EE8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:520
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ad53.rbs

Path C:\Config.Msi\e58ad53.rbs
Size 9KB
SHA256 cf474135fe4aebbf5c2261bf1c87df4e3680aaf20371cdb6494c4104dcaefb14
MD5 d9d747e55e10f847c7fdd96c71323183
SHA1 45a5238bcd21c314de74ccbf3888638afb5f2241
SHA512 bb45b08d767b2f3dc462c71772abc180022fe7a8b7514f5debb6e9a9a9868c37be4685c8c9f055b7c2bf209a3d72d8b5355bbe46fdf5d4fcc372b681e715f4b2
SSDEEP 192:ezZ71Tx4+eVemKJK1OcXG4cXaCKAKd2hTKZYTKgqTKfKWTKti6K+KlKhKOKRKpH+:ezZBTx4+elKJKkchcKCKAK8dKZiKgUKf
TLSH
T102221142A60081E3FCA32B71CB2B271437A2D6D8922C53EF4ADDF4745E077880FB559A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahc_launcher.exe

Path C:\Program Files\ahctesting\ahc_launcher.exe
Size 19.1MB
SHA256 16b5db1d4e5b93c4c4ef66e6f26e51d25ef785be471bde8ff155207b7da0ee67
MD5 40352c05bb3da1f865c69706bc950c67
SHA1 dc165801844b6e0327c507dd8fad151abe470e76
SHA512 e03c7fff254822f228f9e17eee12cf981e50af866471d38fc68427517bed0d14e8e5bf0e836eb2f8275da5d01a5e916fb82fce45907aa3640143fe2c9f8db93d
SSDEEP 196608:bX/mH2CihWf+2F92LLiTo40iiuPxLSp/X:CH20V9M44uPxLSZ
TLSH
T16317F720BA5B996CD09BC4B083478A765A7134CB0B35B9FF44D496382F6DBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahctesting.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ahctesting\ahctesting.lnk
Size 2KB
SHA256 b4c0d9fc501880d015b2e85dc4d62d1ca3f74602c6f31d46eba14fba38556cf6
MD5 30f23dba7bdd8e436676969b0e613684
SHA1 aaab88850788f7bc0e5490f12ba206dd77e34d9e
SHA512 c0455fbe25ecdb2dc45cec5c436651d576157485b06c325218fce86b237a5eebd871ed41b00af9383ba2dc77df911590338f858ec0c03cc92eb03aa9c06809d9
TLSH
T18341E10057EA061BF3B28B71267216129E31FD16F6258F2F828981C905B5D00EE6CF7E
MD5 SHA1 SHA512 TLSH

Submit Download

ahctesting.lnk~RFe58af75.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ahctesting\ahctesting.lnk~RFe58af75.TMP
Size 1KB
SHA256 1d627034b167436291b4ef53b2ac6272181048d4a5a4115244a2dcae85326bb8
MD5 34b7d08d1a0d8cdcbd9475ed2ed7ca18
SHA1 6f0805a30884ab7c3508d95f2831f203d43d6192
SHA512 80aac02ed9f5b34b40a52a3c2d7dcd413dbd8f1befd2d287f040d26f6aaa23e200aa7d4772f40b4ae30f7bb454a6f42e0e9602cb3dfc269ff1233f4bdc987ead
TLSH
T11041D20057EA065BF3B28B75267217119E31FD06F7258F2F828991C905B5D00EE69F7E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

4cf01a03-c026-4266-a784-2c475fa12ee5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cf01a03-c026-4266-a784-2c475fa12ee5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 3a96f3114f72a6bdf97b2d545ba31bc80f5546ec2ef2a8ce0c3a1005244dbef0
MD5 204340188c1a2649040661bb9d9d32c2
SHA1 57381994f382a7dec355c28b3fc21ba856635baf
SHA512 6b1fb15e1b19fd73df5ad72361542eb3ce813809d3ced2cc1e690d23262099dd24735b67d021073f168065ddbcb3ccff69f7556314c8bf4442070f5bcd9b6cb8
SSDEEP 96:mkfblJgLuP5OPdBW86UI/HAly3vk7xZrbDVFvOZFB0esPIgoD3khceJ:mclr+dA85qzM7PHOTJMIgoD0hL
TLSH
T19BF13106859012CBD7A2EDFCEFF2256AB831CCB545274E2D93028D7B630279B86D432C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5916e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5916e9.TMP
Size 2KB
SHA256 e53b83e69d0ba49a17e27b16606271797846e86099d9da81d360aa81c9509d37
MD5 b826042185b75aabedc58d2ee6e1ee55
SHA1 3c971e0923231c3a93f31205d8696b0f8eaf60d1
SHA512 1b341057745dc574ac45209b18e2e1e289d3e0b8099301f0f780834aa102658a1eda78a6adde78ba89aa1a5a7f7314da835bd73fe4dc82330f6054783e042fb5
TLSH
T1D6513F180652649EE731D231C4E01B13BE36C5F9897B8E390290D9BF97277E79B6905C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95fc8cdb61f3642b66065ea7daafef8128389df54fa7653fe97ecb6b1f16f3bc
MD5 8de13905fb95d408d2e80bc3bd41f612
SHA1 b6480807ff952933228ed9d5c01af417667705c9
SHA512 4de53e5f3d8bb7e71e7bc4e6db955b640dfb993920b07a384fb1976c47c43fd3e1d90e1c01b4ee5a3780105adb6626f32d2bd438e49f5340614cc1dfd0199174
TLSH
T1B7519DF7C3E8866DC90156F0AA147E1BCE2D0954432C3D6AC5E4AF5B93E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e2dd6f30eb0dc3e66b2c22b44712eba928d5158519c9d8a8e4b4a81a8ec4e96
MD5 e5b2ea097b14e8dbc0cbc6292e3c5c56
SHA1 c06080a09fb8bd7f26a2a847b9f3065c2ec15245
SHA512 356546f79aa4f02cb8608ced847012d2027fc74f942d25172b45fb28db61ec3062b9826a630265488daa9b232f4ee56f362a2cac8a3457e4966acf9b1ce48749
SSDEEP 192:sxZLRRyM/jK1Ml8Mis/f/sfaktJfGeIdpEmHW6+WNz+d/YwSjZFIg4J:sxZLXqs/f/sfakgzHbk/gc
TLSH
T18252F602AA34997BCCDBD209BA55BB53D6F50572E5800E449AFCDA0C04E6BEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9bbaf56f7ea0590481c9127e31ae82e1f6e15bd43d8431a4cb535d87bee98c77
MD5 049f36d72a52d1441faea3095d728a69
SHA1 fce57e781c8f214dfb8ccd584d56b0859274dc08
SHA512 7be462448f3e290bb28ecf8d82917bdac96f45fd6eeae44a07632111b4168b45f3c304f867b6020eaeae02ed84bde6f811b2617fe04932e7a6f2439060c93d59
SSDEEP 192:sxZLRRyM/jK1Ml8qjs/f/smvWpVfktJfGeIdpEmHW6+WNOk+d/YIG193IgyJ:sxZLX3s/f/smvWvfkgzHbi/gO
TLSH
T1A5620702AA34997BCCEBD209FA55BF53D6F90422D5900E449AFCDA1C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a84bf42f08d1b77683600810f8e8009165698f9d7fc0656f37aa882ec3ed5fa8
MD5 3d1251a148ac9b5a8736b57520ddfcd3
SHA1 ff0f3f3e5432b30c811e4289ce3d19bb2e148f5b
SHA512 4572dc7735f82dd06cf54ba9877337b59831b2f8eea9aa08eb5c300629281d923c498ceba2f2fd6a84772c734cb8f7a69713fc27a91782ca4922c5f88605ef21
SSDEEP 768:Vy4jeIM7pLuLfmmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1SNPLlrZ+d2rou:Vy4jeIwEfmmWvmKxEu1jawSNPLZQdNu
TLSH
T12BF20C3B680CCF7E4F844E9CED2ABE8B6DE8018B5A98895447FA444C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\90203ce4-91a0-47c4-a852-d1ae12931590\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 fbec6b287bf3e1240a809bcc7a9b2725902e938ecd597fb725fb484fb8277fee
MD5 27dfc5025acf2a8efca0c291e825a487
SHA1 9234a71e36628b5c71b5352a1b7e10a51b6c8dc3
SHA512 bbb6b5de65c95d5bb15b27cf55f486a91548bd6515624b050fd15ef570315e14386b1f38df1440828857cad7fc200e88f69d7532857617208a133d4b9f3f32b6
TLSH
T19CD0A7B7D0210441EBBF4FE15771119E97B93C9858965488980339AD9878F43A111F93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 c5ad9561de0c68c5068479c2029f1f3633bfb65c84509e847a16e134e32da4ef
MD5 0fa51269b2ab761392f9bcafa8d4e9a9
SHA1 754646d6f3eaf1280545972d57242e0035e46713
SHA512 74855b3826e578559c415894f1a0ec5f40f159e6bf770fc0dbe8332b27d8f654b0e61c1b8dd6c5c6221a7fe5fea1ec464d71b3c845ea9f8f81075cf22b1c369a
TLSH
T185D097B7D0100040EABF8FE00272106A97A8388814964088940208A8D848F03A002F93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58f836.TMP
Size 138B
SHA256 44aa2a69e5c35d269a2a3199ae53b2cc4ba5a8fc619c7a912fb5303cdc2ba04b
MD5 0760bc840666485a39627af9e378fa4c
SHA1 b12650282335f143e89c9f9bf7b1ed679747d17a
SHA512 c0dabbeabf274aec592476113e0b00d0f6790d93f657d6af996d6b35a45685ba5b061fb93462ac35a71b469edc0a24d86da6bd9e94202fecd434bde09c7baa2f
TLSH
T184C02BF7E00005058B2B02D00372228C67093CEC89C784CCA143306C9070F133101FE2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e6f47b339e6500f9e991f4c864609080d74808cfcad098e999374019078c646d
MD5 c42481401cfd8ad8771d262269e2eded
SHA1 2e889122eae5d94141d348422a84a313a3b01a48
SHA512 7889a79960771ff43b632878ba76dad3367ddfeae4a05c5379424b25d417a88f92965b13d5394bb52daa96f90b42d75f11e1144ce1d4ee2b0e8435eb10ef28d1
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCz:Wvdxjfs
TLSH
T144C1F15A30BF02163DBD2509A2A4D72B4F4176A37015E42B7BA940B24EA7E350CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ff3d6947e0005c9f095c725d50b94f14007ea358f8c012ee7adc7730beb9a92
MD5 59c46f09cd55d34f0eb19ad78a65c98b
SHA1 c7df6ea9be63e5156e4625adf894c741e9d125b2
SHA512 15690db1b39d394a227f1b120e19ea7748a07f1c6aae4519ab7ef147e39bc27e55b7d43262a15fe590b3b3602c8498141f44e09a42361779c44f29025ad00645
SSDEEP 192:EONg6hZ0QmiUylVpc/+jVqO1Qz5wOZ2T9U6:EONg6oEpu+MOeK22BU6
TLSH
T12D02D83568686C778EF2AE45F48737235FE4217BE9957F84D6E85B1D00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e878ca65f9a19b2db18bc291d51c9d37899317c5804a7457c2034e4af986eb7d
MD5 a5a59f3b8bb3fd0745a2208b3a3bf0a4
SHA1 98cd605261e0a4449bd83ecf2ed61ee2210a34fd
SHA512 27dd8dbe1946d2e97a1499be3b6612bebc9719c189db01a50732f2a7213c186f4d83d291eb1e3351456b9411d58452898b1d9d8550280f57b10bfa6646f16bf3
SSDEEP 192:uujLsNCsQabh+LZErSQmiU1Gmt4H/+jVqO1QtB+2b65cFT3rqI6U8:n/sNCs/bh7Crif+MOetB+2BFsU8
TLSH
T1C43218326868AC364DF2A281F44733139FE4512BDAC97F84E5EC6B1C04DB6AC230EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 34e0b7e353c252f51e069959eb6f8634c2fa231bd3e107728a9810b10531973b
MD5 94f653c5a6fc7d5933fb6c15b61f4bdb
SHA1 641994753091742c219968d9978af77fdc4e99be
SHA512 c4a77701115b5cf7334dc8456b382c8908a26ed3d077c7207c086f51b093b4a2ef213eb4a0a5f6ee6bf6514e408fb0b09bd34a74d9d43ba5d21f2d43f497d1f0
SSDEEP 384:nbsNCs/bh7CQif+MOetB+2BFYr7StEXpOjQXKxKegtMWU8:bgqhOqBlbqSnjQeKegSWU8
TLSH
T1BE82F870D8A95CF744E1E9C4A503F6236EB8113BC9899E4CD6F97A39308F5BD2316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f0dbfd577c94a7760d796d95014ad00503536a9ef77c0398f778390687e7a403
MD5 3fa867cba99499b4c094ca33020e00d2
SHA1 e92a418845e8574eed309bf6cf009b0cb7be9049
SHA512 f96a0b76b4cc4c1648820a44303cfa7c1468120a5c184a819786d461fec47f9d2e59bf1f0eeae5c3df515d470c56c258da8fc64ee4346b7248746701c472f912
SSDEEP 192:/ONz6hZIQmiUyRV+c/+jVqO1QtB+2bB5cOq3rqI6U6:/ONz6sO+u+MOetB+2w9sU6
TLSH
T15A12E9366868AC675DE2A655F48732134EE5522BEEC5BFC0E5DC2F1C04DB6AC230AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 de3a9ac1ccca1e81f135ef908397e4fb276517d074722cef90e8da20a2ec53de
MD5 1d68845a648b561b47ada0407eb64b58
SHA1 156910f8be54459d6304acfc0448dd778df73443
SHA512 206ffb1807d920d77ad75e39dcd40d3109a727ac0c0558e1cee87444ddaf40575bc9ab59d95ce7938c7bfdaaaf2831cc60cd5dcce42a40c11e9f0481a0a50d02
TLSH
T11B410B98AAEE1108B3732F5AAFF7A86D447E7D763E06D05E10110D4F0627A00C971733
MD5 SHA1 SHA512 TLSH

Submit Download

70c2d045-3cf7-4775-8ec7-de37b814cde6.tmp

Path C:\Users\Admin\AppData\Local\Temp\70c2d045-3cf7-4775-8ec7-de37b814cde6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

980a4ccd-4de3-49e7-bf1d-70d149bbf714.tmp

Path C:\Users\Admin\AppData\Local\Temp\980a4ccd-4de3-49e7-bf1d-70d149bbf714.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI653D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI653D.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_473575060\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

621ac61c-f7b3-4e21-93a3-e9180b6a6e32.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_531907338\621ac61c-f7b3-4e21-93a3-e9180b6a6e32.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8b0b700a9bb32f962ae7fb737b1ed61d797c5f676e073c481eb8623134e5f0ba
MD5 93c3acccb2e002c6e86c164b3f777203
SHA1 d247abc0704c24c85e4c0cec5da95169278a708b
SHA512 a278ca54fd31876786a38d74cbe93ee9b1a16960fed153077a057a1bbcbb1a3b1b9bd3c48cbd33d9c7bfacda14eb0dbf5f63dc60bc1a676fca815936988b9e44
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7caa97857a547c4cee284a1a845a4def1430fc3f55f31e676665ee25aff1070a
MD5 ea9fe0615d899bd6031e2efb77c72dba
SHA1 601bcb74f8367ca782d221fdbb0b8e63b9821028
SHA512 0a5c86ea8dac586d73639d552845756f0e357a1430e26ba7b8384e1509d9e2d9a897dc2dfd427d5d9edada757c9861c207fd44a9f3aa22632acacae96b1eb1d9
TLSH
T1FBD0121272120638C01020330403A28C0540D11B404E5000D42CA67D5B150600912452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2c92f54c607533626a66fcb2302e5431a5ef641662fd998403523f9813654610
MD5 27cab83ea266df5bdb2f15115d7ce26c
SHA1 4483ddf799674ac4cbd1456d1915afa9a399da7d
SHA512 4ba9990a4d46a03efc1888d0e31ac04d7b83c07ba7424fc7f33baf41f98062853dde69c6f371e0043e4bf98a72cea86b39f7a3227c22f710a96a75ac0760294e
TLSH
T146A00210014148CBE15013785DC642C0B2B2AC1052033A59C1D5066489B1B40C711854
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5f11643f65ac437ae6b2f38e603ef118c804a648fe29f6720c0c45ac789c9131
MD5 8d9ba6d1d78f837217c0747c49287f98
SHA1 d3f027b17fd5c34f9575154f7652b036a113e06a
SHA512 083fd5b4aa2338c96b3bcaf72518b7662978bea45a379fc5b97873629346e81b4019132a22b253b583dd8989b6feaa40334dc60c30c1614bae3dbab76e6f4494
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 71142af897fb8542d423a61c3d412b0cd1fb13450853da5f00b6377d74b4abb5
MD5 b52a1ebd38b4705e82a2cc2b4b8331e6
SHA1 add15a4d1827d750fee18990ead6181e9df566b3
SHA512 0d44024edf8fdb5dea82d698a7ede4375780467e40cfc605bf4d661b887f5846d61e1a90bdb294b536cd83ea6d468c112a0594a3b3df378a57cc994430b0b8a0
SSDEEP 3:LstlNllkll/lZd51:LsX3lEtZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 1KB
SHA256 216a10beccbc5d662e90f069ea50852fa9e8bf64b2d051e5e2dc66edc3ac582d
MD5 049f15ad4f7019634309175b4cc6210f
SHA1 9b0fe26cb1c0ef78d861c4cbcd4e98a5ff996d56
SHA512 78ad8182d5e5637e30f70188b560b273e0dec9ddab7ae64d0da58862e8a6c2c384bc1766e514617c6860623f47dc2dae1668a7a25281bdb65eaa868cff073a01
TLSH
T19E318572E0542B7B28D2B985B945AF2B6D30601EC3604D58B2DE571C03E769C863EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 2KB
SHA256 323589b57fbef1593c7ae9b3cd6dc6101048de7b04016d0d93635dbda6e685ad
MD5 09919adde58f0140c65c38c712ba088a
SHA1 8355dc6891cfe4552933e93b2ab1362a68c8b004
SHA512 2183f2c41a6d44d1ee652aa9b920169f76d6b9d2df7dc9bb501932847feb49ac4131de8161ecf8c2eed98f8f904cf395c888be307d50db7ed2dba8f558f0cb65
TLSH
T1EF51C532A8086B3B49E3A944BD493F23D935605ED7612F64AAED1B1C02DB69C131AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 3KB
SHA256 729169d7d701f14b163f7708cd34766444d2ef4d1a749617d67376d8245ac908
MD5 c09dd40f05b498ce36e62b382783eb9e
SHA1 e288f4a1178661fe6fb36f35ab90b22fda288d04
SHA512 79e4d21c2afc6b923412636106a8de17a7223d7d2856a549274b9b23caa25cb0ce650f18405d53d6e0f59fc0cd4d73c054073cc9597dda0de7023132bd445a2a
TLSH
T157719732A464AA3B4DF3A944BC852F17B665512BD5903FA8D9ED1F0C02D73981356C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 16KB
SHA256 3f73a3ba53496b4f55acfc0c443a26ed4ad2323df27f079507c84dffd46ba3c2
MD5 498192d2cf5ab492c9e168ac861bf832
SHA1 76c597530ddf205e021d0fb2bdafa613f5bccf6f
SHA512 25ccb1c895e2e4e1e340762963ea52c02f5f73649d6deccf41b9baf5eb5067c83dec69c6ba0fefaff1d53051ee316eec526270726526b8f7c2ac4d2b75f81063
SSDEEP 192:zjxuDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kVNbn4SooDUh4F:ze+aQikB+z/xvxjg/qhEpNb5I5s5d9zn
TLSH
T11072AD2B65683E3755F3F5047A1C0B4BDBB494A6D0C16EB88AEE6F0D06D73D80346D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58cbc7.TMP

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State~RFe58cbc7.TMP
Size 1KB
SHA256 d1244a81016e83e685721f44cfc74123c8686ba8d8c9df2a843ec36b54d7e595
MD5 4b90502908b833f71c7b88fcf6c0e8c1
SHA1 0a029ce708cddb16ca9a4a911b8dc642555e7f63
SHA512 0d178c63aecbf859bc70513c2da9e3ec9eaa165a07ec92cfb36b3ee0cf6acf7ea9510c4a3288a6248bbebc277171c3765dbbd105a2afe2c51f4bef5af3d61756
TLSH
T1A4216572D0543A7B29926884B941AF5B2D20601E83204D2CF2DE121803D799C867FC73
MD5 SHA1 SHA512 TLSH

Submit Download

e58ad52.msi

Path C:\Windows\Installer\e58ad52.msi
Size 6.6MB
SHA256 9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893
MD5 046c2491e0c3a14aa78c5c66102447e7
SHA1 86f5dfe93183c33044ff1aff4bdb5962d38ec1a3
SHA512 bc6bc7982c3a782d9bf36ae44a33426cbddb3aa54be86207847c89b9e7c078005a22c95eca0a97f99862cfcfd97d4b8d9b6ec131cc4ba56fa4be1d20a1259f67
SSDEEP 196608:At2hzUaRxVIylRM6SeeYwCwciQYE6MCeORIlx4:hlUUTjSPfXObae4Ilx4
TLSH
T1C666335B7EC5C222CC256C3B047BCB648628BC109B69589372A0B36DDDF16D05FA6DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 bb193b176834a87c65265744c8132d15f3a8edbf5add71e4e1238a4b26bc302a
MD5 936141e41870c27f325b30c9f3a1b174
SHA1 e07202c6a586aa9b34842a66364afeaa0ba4fe08
SHA512 dd7f2764a13d384d11bc0e4e14b490bb12602833afa71e7ccaa9db873098529750f0b6d5dc8554e4cf0414c485e5d6d29f19a321974aa80dd377a3c928abec4a
SSDEEP 24576:Wu8m+1zJdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:8
TLSH
T12547D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ac31a596-030b-4ccf-8861-22c2c0f556ca}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ac31a596-030b-4ccf-8861-22c2c0f556ca}_OnDiskSnapshotProp
Size 6KB
SHA256 ad0081298516a299c3b3e7c15e4e593269cbe347d92a24cf620201855cc5af40
MD5 e4ab33f08e09f8f23dd6d2c2390a2ae9
SHA1 243b00f7f251c5c394a8f5654aba7d4bc463bce4
SHA512 46777ac36f4c8d2911443cd6c31721e7b6ffa62a7fd18ab67482ab773efe9b471b91e82df8ce82b36d012aac1acc26171bbf00b33711b77418c2ca3ee9d6dcc1
SSDEEP 96:FlShdoPyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:fymPIb++ZVm
TLSH
T185D178185AE54711E2B3AB3128F14557A877B911EF33CB8E0298278E2670914F875F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-331-0x0000016C3BE60000-0x0000016C3BF8A000-memory.dmp

Download

memory/2204-68-0x00007FFFED100000-0x00007FFFED101000-memory.dmp

Download

memory/3396-80-0x00007FFFECA60000-0x00007FFFECA61000-memory.dmp

Download

memory/3396-79-0x00007FFFEDA10000-0x00007FFFEDA11000-memory.dmp

Download

memory/3980-180-0x00007FFFED100000-0x00007FFFED101000-memory.dmp

Download

memory/4440-316-0x000001A4E1BD0000-0x000001A4E1C5B000-memory.dmp

Download