5c40a70c0d4f8025de4b8644603d992daaf06739a4c0adfe39052acf1cc15230

Analysis

user interaction
yes
max time kernel
42s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eSound Music Installer.exe
Size 1.4MB
Sample260814-2w92kstyfx
SHA256 5c40a70c0d4f8025de4b8644603d992daaf06739a4c0adfe39052acf1cc15230
MD5 9b60e87d30cba8d067daac94133b13a8
SHA1 8576e41255c1025093827acd71991a769320d9c4
SHA512 d8e5f64b7e802d4d93185f3f8e9162529152546eb1eb18a8893532b23acbc5bb739bc9c6b8f5377eae8c9f0fa8afb8b2d40b9e7dc9c6930af7c673316e41e087
SSDEEP 24576:cLdns1GG+2DR7BWYpCYo44AsW4z3ZBWapK:8s137V3DsWAjh
TLSH
T18C656C8027FC1539F7B70B79BD7A18214B36BC39A952E6AE0549152C08F2B56CDE2337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
152	3836	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	eSound Music Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	eSound Music Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
5616	eSound Music Installer.exe
5856	eSound Music Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312218788319428"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{B913E31F-C7DC-4A43-8958-28124076DF2D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	eSound Music Installer.exe
Token: SeDebugPrivilege	5856	eSound Music Installer.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2936	4888	eSound Music Installer.exe	94
PID 2936 wrote to memory of 1476	2936	msedge.exe	95
PID 2936 wrote to memory of 4008	2936	msedge.exe	96
PID 2936 wrote to memory of 3836	2936	msedge.exe	97
PID 2936 wrote to memory of 4008	2936	msedge.exe	96
PID 2936 wrote to memory of 4008	2936	msedge.exe	96
PID 2936 wrote to memory of 2476	2936	msedge.exe	99
PID 2936 wrote to memory of 2476	2936	msedge.exe	99
PID 2936 wrote to memory of 3880	2936	msedge.exe	100
PID 2936 wrote to memory of 1280	2936	msedge.exe	101
PID 2936 wrote to memory of 3880	2936	msedge.exe	100
PID 2936 wrote to memory of 3880	2936	msedge.exe	100
PID 2936 wrote to memory of 1280	2936	msedge.exe	101
PID 2936 wrote to memory of 1280	2936	msedge.exe	101
PID 2936 wrote to memory of 2716	2936	msedge.exe	102
PID 2936 wrote to memory of 2716	2936	msedge.exe	102
PID 2936 wrote to memory of 2716	2936	msedge.exe	102
PID 2936 wrote to memory of 2668	2936	msedge.exe	103
PID 2936 wrote to memory of 2668	2936	msedge.exe	103
PID 2936 wrote to memory of 2668	2936	msedge.exe	103
PID 2936 wrote to memory of 4544	2936	msedge.exe	106
PID 2936 wrote to memory of 4544	2936	msedge.exe	106
PID 2936 wrote to memory of 5104	2936	msedge.exe	108
PID 2936 wrote to memory of 5104	2936	msedge.exe	108
PID 2936 wrote to memory of 1056	2936	msedge.exe	109
PID 2936 wrote to memory of 212	2936	msedge.exe	110
PID 2936 wrote to memory of 1056	2936	msedge.exe	109
PID 2936 wrote to memory of 212	2936	msedge.exe	110
PID 2936 wrote to memory of 4188	2936	msedge.exe	111
PID 2936 wrote to memory of 4188	2936	msedge.exe	111
PID 2936 wrote to memory of 4188	2936	msedge.exe	111
PID 2936 wrote to memory of 4284	2936	msedge.exe	113
PID 2936 wrote to memory of 4272	2936	msedge.exe	114
PID 2936 wrote to memory of 4272	2936	msedge.exe	114
PID 2936 wrote to memory of 3928	2936	msedge.exe	115
PID 2936 wrote to memory of 3928	2936	msedge.exe	115
PID 2936 wrote to memory of 2840	2936	msedge.exe	116
PID 2936 wrote to memory of 3920	2936	msedge.exe	117
PID 2936 wrote to memory of 2840	2936	msedge.exe	116
PID 2936 wrote to memory of 3920	2936	msedge.exe	117
PID 2936 wrote to memory of 3920	2936	msedge.exe	117
PID 2936 wrote to memory of 364	2936	msedge.exe	118
PID 2936 wrote to memory of 4896	2936	msedge.exe	119
PID 2936 wrote to memory of 4896	2936	msedge.exe	119
PID 2936 wrote to memory of 3132	2936	msedge.exe	120
PID 2936 wrote to memory of 3132	2936	msedge.exe	120
PID 2936 wrote to memory of 5440	2936	msedge.exe	121
PID 2936 wrote to memory of 5440	2936	msedge.exe	121
PID 2936 wrote to memory of 5616	2936	msedge.exe	122
PID 2936 wrote to memory of 5856	2936	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\eSound Music Installer.exe
"C:\Users\Admin\AppData\Local\Temp\eSound Music Installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NLPD7H682QC?ocid=&referrer=psi
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x368,0x7fffc66ec188,0x7fffc66ec194,0x7fffc66ec1a0
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,11007032212713431321,15773662635239652303,262144 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13782709879076780673,4165218585940718491,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,1709726902347903176,14039724316698273375,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16987941473611776963,17181587525386680515,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6569598020858962838,7206047055615589134,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1028943785993967071,12855326033809846385,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6531410872314853733,8228036414463136339,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2469210607926290621,2847340029668490955,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6492480257320473984,8867262507436613780,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3758617804750260728,9872402388471135972,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,14100286718845547166,5395981428859607887,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5732,i,13665920440153861826,7276480222880373587,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11164990806723474606,1105271024347173247,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11164990806723474606,1105271024347173247,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,12078184918296815974,10101711879467280640,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,1328598825272416122,3393097953875181141,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4703352727465633435,17893341173030275779,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6328,i,12332890165168535837,11981129984540580541,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,14755308246288272245,15989686842121791192,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,1203307539166264635,5439360035446643446,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,2537188378516544132,12873524719320865285,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3706224465709552214,13631754194387642834,524288 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:5440
- - C:\Users\Admin\Downloads\eSound Music Installer.exe
    "C:\Users\Admin\Downloads\eSound Music Installer.exe"
    3⤵
    - Executes dropped EXE
    PID:5616
- - C:\Users\Admin\Downloads\eSound Music Installer.exe
    "C:\Users\Admin\Downloads\eSound Music Installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NLPD7H682QC?ocid=&referrer=psi
      4⤵
      PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7236,i,7164622760974708235,8732749508498274746,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4832,i,16928365413513213674,8729616111743856434,2097152 --field-trial-handle=2252,i,5658783956222604474,2288434724812325534,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
Size 312B
SHA256 0a0e815b1ee8ebf2d169972ba852ec5776144acbd850660e634c1f92ed86fec2
MD5 fb10624261ee7173d7028f9250d2a5ef
SHA1 3a2e0ac59576b82b8cb5166d05e07e7ead3b8e11
SHA512 62db7d2cabb50fccef7f56d344e1215d80cfc874bb6a50399603d58181d19a5ec11a87bfc37df861b2272cde9ebe9c7e344afaf0f8c0aa155ffa48af9e73a32f
TLSH
T15CE0CD9A36D269812476E8C1EFF58E75B411615291C35C09281616E748B77AFB513015
MD5 SHA1 SHA512 TLSH

Submit Download

892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
Size 952B
SHA256 d5c5d1e6ff6ac443e80ef70ad585743241c57fc0470d1af8bf0a819722308dd6
MD5 bbcd0854f48a1321940a0c20b8c1ced7
SHA1 1bff71db3bba8cafa7ac955f5b22937d6b1d6eea
SHA512 dc17a29581335d25b22f2801d4791865a2e7182c19586a367b351e379777bef92d9cc8096037114be39b27e8a0cc1efa8a576534496cd6725fec2d257ff8d11e
TLSH
T174112109483862C1EE76B166F6E8CC233CB48683369999475005D6CE025B7C4EF14E8D
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
Size 404B
SHA256 1cbde102381915c58a511eda6a96bc19ebf037948a289b8c8d7da1ef7b83a847
MD5 a7dc9a1a15c9b4b5faeb6a8c0d45933e
SHA1 82745c4eb4d0fe0fb8100792b68bb2060e3aa6ff
SHA512 4565a0b472f12a94295ae29aefb67a447b7c76f98efa6c02d452a8412d01ce2158217b557d980123d092b1ffa5af20509bea110dfac40c085b052df08d415d9c
TLSH
T1BFE026A03BFA409CE1B0B57DC7DECBBA992EE02108C4C3B11B94050EAE077026D33D62
MD5 SHA1 SHA512 TLSH

Submit Download

892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
Size 438B
SHA256 1a07fdf01198a37dfce0229da6122a73cefce3e1e22a8e2afb04c5996da08c26
MD5 7a37b224973915e9ac2f58b44d8cec3e
SHA1 d1759ba3b73ea6ff4f0ea7c46acba039956a028e
SHA512 19d551e22b32a3b1b1e671b190cef319baaebedd54b9dcb3afd8671c1841b4310658620059478ba169c0b8687cb8cdf9b38fcbeedd31ed0aee35f45f4538e822
TLSH
T17DF0681C02FF4559F332C9B903CDA9AC693EA0230488EBF416E4026ABA19C001E23723
MD5 SHA1 SHA512 TLSH

Submit Download

eSound Music Installer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eSound Music Installer.exe.log
Size 3KB
SHA256 5bf935b89458aee76e71ec679a6832d0228978d98be38cc1de8cef48e371c07a
MD5 bb603451ac2186db08301dd5e8970181
SHA1 db0b6174f2a5a125e7598614de60886bc67a4ac9
SHA512 a91b0b7c67b0f33bebb86171cef0a59011877ed042a8a3305157c63669f2c5ef22022be7661298af0a66fe7edc3be69051edeb17e2c0873b6ec17034aa465eb9
TLSH
T166810E2131B160D98E622F661C6D6AC853FB830D7F944F58B9A5215EED3600BEF231F2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\000003.log
Size 35KB
SHA256 bdc0f082c963a373448b4f3b02dd86f885d601a1f899bf1acb72a75dd7173ea3
MD5 beb09f168427cfe771c4aa872a040bc2
SHA1 4af871b64ae5c3281a32988abc965de840bd12b3
SHA512 5bd54dfbe95ea2948b465ff89c891f555992ab9e38f0997955ca33c1371489c38a9ba9ccb8d4fd5f44f9bf7d3c6eab07e95b6f0df1cf6b800048d4aeb918084c
SSDEEP 768:HuCtukfTRWfJWSr5q3/f47jrvjtRtyJMgBwgD4erP1qlTk0e09Gt9iUfGCiI:HukfTRWfJWSr5q3/f47fvhRtyJMgBwgF
TLSH
T1ACF2166935F94B2AF2B78D7D90641B91AA367A02BC80CF0D50E1621D447BD82ED72F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\LOG
Size 359B
SHA256 bfa8ced21d9d248853cb7e9db497907d66bd45a3a3b13ab7a84afcc8a8adcec6
MD5 5d696933258014c6985b22546d44de6e
SHA1 f76743f1f2fcc17bf13b053267c65aa385e38b2d
SHA512 7c43255ac5fba3e956fda2b9d5da44c70fddbcb5f3921ebafe956140c4de62b186a1cedda682f138c5338c3536a38ed5ca6ff7b958ccb4ad0f1695ecca21b95b
TLSH
T128E06828C0C8C22B620460EB1520FF09A1A7260F97CCFE8A4F80D804B0460C8F0AF1A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c11cc5f9c971b253e9a181cf8f100ba178be8a474224ba144fbcbca8a9e4a5df
MD5 8e34542bb92071bda2acc3c889db5325
SHA1 c390be67c0bd359f03e78618f2f787b087eeea73
SHA512 93de42984e69fb538cee2af6bb30ccc87489aa7ad74cfad5520358d3b436ddb601d9aa444b1161af84f7fc1cece80b9527011be06599960f3b9d726114c2f4fa
SSDEEP 192:sxZQRhyM/jK1Ml8Mmx/fgsw8QIdpwcHW6+WNt06/fqrWK/+HtJ2QIg4J:sxZQbux/fgsw8xxHbn/ia0Kc
TLSH
T16652D816AA345977CCDBD209F955BF53D6F54472E2900E84ADFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b9dff7b1643e6643a6598f3568e0fd6cafda58f3deca687b41046bc621fd7a0a
MD5 5326a4dabb6d9865c6c80ca7bbf60e84
SHA1 63c2a2feb28743a766cdb4437c9e69dd6c629f61
SHA512 bbc97d8014e4234708e24b2c2d606f59cc00ad23bcdff81a64146ad909e924993c9ce2e2ab450fbf04b6b37013e408602ef5d3dae3fcdc04eea2a7471a20f7b1
SSDEEP 768:sbUZYGMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdNCeLlPZ4RTroVU0p:sbUZYGMWvg0Pou1ja8NCeLZmRgFp
TLSH
T1CBE20B3F284CCB7E4F844E5DEC2AAF967ED801CB9A584D5447EA884C02C76EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\b9110111-3a0a-4a07-a0ba-0c5155cfd56b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 8d51d8cb6daf77e4151d334c419bbfbee1016a528ff0c86b6dd9b1bbbd47c912
MD5 c7c4e8a78c62db569e5f7d55f30de325
SHA1 f3a3340220d105d8254b035f79bbda037c632306
SHA512 06d49ff6cbbc9528a262e5590f817637c77ab96953ccea9f25951ea2ce7e48cf97f343de61f9efac286d9484567339072e96295be955502dd910c18ec393e070
TLSH
T134E0684B21729112E7E118DE2AA0F69CD83F3E436E40CF6D808470420CBBE5A91A2F57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 556B
SHA256 36366e91a7e8649425c9b4f1ab8296b9aa3a302798c570d76f78e4dde303c1ee
MD5 7fbb941a0df62a4cc59077fa818d9aff
SHA1 72aa9c662b1ce3ec7501be95ec62eaf02bd912e2
SHA512 0fd5661c85037060b283aacfe4ffa0742459390ce51fa720702913178d1e835f412f28572c6e36be3b36c94c695c755cbbbeff5c4c6cfea87dc93298c6be6f47
TLSH
T102F0815351B28521F7B00DDD29B4E258D43F3A079A51D95C8040614208FFE859193F97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 634B
SHA256 5acbfea8f1c438b1bbcf63d09774f6a77c5fe4d340881499f6855e124b99ba58
MD5 4fcb562135f82a257ae3cedd8171415b
SHA1 885a3549355ba609d926c802ed5c73ede7bd8fb6
SHA512 249e8620d40c6bb41ffa0234ff35ca957c5a8739582819013e97049c6357e69060e1b89dbbb3c2b0663bc7e248c5cf1f38371112c15693a57b3623e6ece80ce0
TLSH
T124F0DD4702B25521F7B01CDE2AB0F158D83F3A078540D91D8040718108FBF8982A3F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 488B
SHA256 2cefda23c3337ac9bbb7e36994e74d75fc9c4cabc5dff6101b9a9aacd9c48600
MD5 7f3e0a82c7ffdc2389affcfd8250afb7
SHA1 589463ead41b2cf0dde13c2d0b4e4e50deae8696
SHA512 bf9bddbf14a1703af823be2a83c2caec9db715989792e9a90474fcfbb3f23414ea4ad21a32edd05a1a78d10828ef610fc30ca9913b8e1ef71bea9df8e3942bee
TLSH
T1D2F02E9752729521FBB008DD2AB0F659D83F3A079950CE5D8080714208FFE969662F56
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b5ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe58b5ce.TMP
Size 195B
SHA256 64a45ffcb0c5aedf123b8b1c08eb1e1748474bedbc508917d40fb193df79fb11
MD5 7c6366a85abd8cfe0d351e06f73ce51d
SHA1 9bfba04b699cb9fc4e3cc06e4d9c99cd0fdfacb3
SHA512 aa155d11756d77894f762aa478ca5c415c87955ae8f05859a77a60b0f44b7d46c8fb4491a3bd8729cd2abbde376dccad1a890bfcac262165e653f6a96e89e45a
TLSH
T1B8D0228640315412CBA006E25E71E2C8D82F2F4318C4CCA98088B0800CBA2464092A22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d6e069b76f4655d02d95f94aaefa2aa3c548e9dfa1b43fe98b1896fbbb9f72a8
MD5 2149a143952d57b720066962c0609598
SHA1 aada0d73f3ebf632878539dc6f99e5e771d61fa2
SHA512 c297f73cc73985577012c484d34f587585d845866b449582ec77aad846b5a73a830925a7b78e94260c96ab300e56d1453b0afbf070974e02aa8971f6ab2bf9d3
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEgDc:EurfyVlj
TLSH
T1E0E1E10276BB02033C7D2918A399C7664F85F5A37818A42B7FA840B25E67E345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 66cdce6d93e4a9cf8a5fdb0d1dfc8bde3609731d654cc3d4856038fa9218351f
MD5 b2fc6bacf840aea4453b45d53a594bf8
SHA1 aa51e4b92d2104a5925e75ac4fb35350d38dbc5f
SHA512 3bdd4268b4fb2143937a7a97315daa34dec2fdf2b76c4f46814451caeda4ad966bfaeaddb09dbbda67278519634c29b6b1a9491fc8c17b680b03d71109788c88
SSDEEP 192:tON161cWQmiUysOsERGX5Obd+j1jzory0aouX6EejJdqRV9U6:tON161ARGX5od+d8y0VuXRaK9U6
TLSH
T17812F835A468EC27ADE3B55AB48B36939FE421B7DD446F80D6E80B1C00D769C271AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1bab669501edeea6a3cd3850836e2dc7d2cc8e6b8abf6f8fb76dffa322769905
MD5 831029c795a77aa81493ae3080955dbb
SHA1 d4fe0d653dda13337c6628da3a91da27769d1a55
SHA512 2065d7554b921936b19f9e8ce6b07f7428b1fab55541ffbb01d8c6722a66b493d2aa95e137ca4b5d03e73d80373888ebe8748d71b3cf980715fc8fad5c6f7783
SSDEEP 384:n3ZcIosN8QhrLvsDzX5od+d8y0VuXRdK9OOPrXLpe8C/ayG:/oErgHO7+RdK9Oi9PNyG
TLSH
T189927C30A478AC676DE6F646B58A37539FF850B3E6C01F84E1E89B0C04C659C172BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 002c57db261379834289f10c8027176eda6ddf165841774e80ceac84228146d6
MD5 6e8f52abf73016f264995e696c9e7089
SHA1 d755c405d1dffc4906eb23a07f25335409b254f5
SHA512 eac3163d7a45baa5671e22abfe757bb013c3a9561ea7b9860d79e3fb7455e7e72410add723c5d7095d48642463ff54b5b259d9317aa8c487fea0c74c632b6202
SSDEEP 384:nOZcIosN88hrLvsDzX5od+d8y0VuXRdK9OOPrXLpe8C/ayG:soorgHO7+RdK9Oi9PNyG
TLSH
T103927D30A478AC676DE6F646B59637539FF850B3E6C41F84E1E89B0C00C669D172BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78702feddf45cb485405003d128114b2bc143e8a1ed1a120e8fd20b97fa86a08
MD5 bbb222970439fd8051f87d5ac6229855
SHA1 76e61f3b01cf6725000a9d5cb1fda4edfa6e189b
SHA512 74b46146ada8adbd4ed70063db3fa086b3eaea91ab1aca9cd739c34c307b3f91d049b5f0190aad55f9b7951c5e3dcebedbea1febfbc94ca3651a4ce4c6f42062
SSDEEP 192:yONR61VWQmiUys9sEgGX5Obd+j1jzory0aoX/aT31IU6:yONR6WTgGX5od+d8y0VC5IU6
TLSH
T1AC02E835A9686CBB8EE2BE4AB48737135FD51067EA942F80D6FC1B1C009769C2316837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d4e99368e0a1e8751d1392741f3737026c2b74a01583f6024e172e2f4f0dcc3c
MD5 7c430e183446593d6d082f8e06fc8be0
SHA1 d3db0a4e78b28959ca59508e92ff3a761948bdf6
SHA512 a26285666bbf26a8ec565d3b9609f63d8d0552810045f0441b83641200d0c9147290979dcb60c97becef5d83fb64de978a7c93f856e85b7d092be2ff61fedc28
TLSH
T1EA412958A6FD1148B3B76E5AABF6A86E483A7D732F06D46D10110D4F0662F40CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download

1859a4e7-6d4c-4fca-b7ab-9353d618839b.tmp

Path C:\Users\Admin\AppData\Local\Temp\1859a4e7-6d4c-4fca-b7ab-9353d618839b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp315C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp315C.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

cc74f418-2a5d-4d4d-95cd-1c951a2df13f.tmp

Path C:\Users\Admin\AppData\Local\Temp\cc74f418-2a5d-4d4d-95cd-1c951a2df13f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

be4beca0-7b52-44bc-b479-8db0bee0f84c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2936_2051866928\be4beca0-7b52-44bc-b479-8db0bee0f84c.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2936_784944831\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eSound Music Installer.exe

Path C:\Users\Admin\Downloads\eSound Music Installer.exe
Size 1.4MB
SHA256 50c8315c0fe9968d1b8ff10e3956ebfbd5bf83804d4c8100cbe2d02dec47b6d7
MD5 8f302658a877f97ed9b31124fb7c6575
SHA1 4abae0ab53439967984108e73cd0d26f88cfccf1
SHA512 8dd59f36cadd2f6efb65fdd5244e701363b9352082cda2e3584baf04f52a6d3844fbfb2fa0353da85a7c7de4a12b028e8e80ec4ec876d62cece45804085669da
SSDEEP 24576:cLdns1GG+2DR7BWYpCYo44AsW4z3ZBWapK:8s137V3DsWAjh
TLSH
T1F5656C8027FC1539F7B70B79BD7A18214B36BC39A952E6AE0549152C08F2B56CDE2337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4888-20-0x000001D2EF440000-0x000001D2EF968000-memory.dmp

Download

memory/4888-16-0x000001D2EE330000-0x000001D2EE342000-memory.dmp

Download

memory/4888-22-0x000001D2EF140000-0x000001D2EF148000-memory.dmp

Download

memory/4888-33-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-19-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-29-0x000001D2F28A0000-0x000001D2F2A26000-memory.dmp

Download

memory/4888-18-0x000001D2EE3D0000-0x000001D2EE3F6000-memory.dmp

Download

memory/4888-17-0x000001D2EE390000-0x000001D2EE3CC000-memory.dmp

Download

memory/4888-39-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-23-0x000001D2EF130000-0x000001D2EF138000-memory.dmp

Download

memory/4888-24-0x000001D2EF260000-0x000001D2EF298000-memory.dmp

Download

memory/4888-21-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-0-0x000001D2EB8B0000-0x000001D2EBA14000-memory.dmp

Download

memory/4888-37-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-36-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-25-0x000001D2EF170000-0x000001D2EF17E000-memory.dmp

Download

memory/4888-3-0x000001D2EDF20000-0x000001D2EDF2A000-memory.dmp

Download

memory/4888-34-0x000001D2EDDC0000-0x000001D2EDEDF000-memory.dmp

Download

memory/4888-35-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

memory/4888-2-0x000001D2EEA00000-0x000001D2EEABA000-memory.dmp

Download

memory/4888-1-0x000001D2EE000000-0x000001D2EE010000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads