3f03375bb73d44e8efa86fbcae758997f534458b317cb92489195e8dc7686d62

Analysis

user interaction
yes
max time kernel
37s
max time network
50s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sync_1.0.1_x64-setup.exe
Size 33.6MB
Sample260831-e2a34sdk3w
SHA256 3f03375bb73d44e8efa86fbcae758997f534458b317cb92489195e8dc7686d62
MD5 9d996d7b510ce0044b9112e8268b5e65
SHA1 ff38181fb034e3b3dc3c3241f8666a19107b3ced
SHA512 f9fb2b7c8e0a639349119f19d5ed657c8d5b30fb1ceee4770a64ac8dfc70a4a87563d3ccd84684c8bf26c6166ac4b85e77c65fa6e41f3b2c9c96fc576dadae7c
SSDEEP 393216:hKvl1lbg7NqpmUpBSM52oDJnbTrujTRVSYLdGi7ki16vIZgDPkW0OzgmPmsvADTR:hKv7lCULSq2oD1XEcNvn/cmPvah6xk
TLSH
T1F27733147CC123E6E9CB5FB9F02C2506CF08121FA4DABABFD2600913B5A1E9575ADBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3276	sync.exe

Loads dropped DLL 6 IoCs

pid	Process
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sync.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
94	discord.com
95	discord.com
98	discord.com
108	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\sync\sync.exe	sync_1.0.1_x64-setup.exe
File created	C:\Program Files\sync\resources\Sync.dll	sync_1.0.1_x64-setup.exe
File opened for modification	C:\Program Files\sync\resources\Sync.dll	sync_1.0.1_x64-setup.exe
File created	C:\Program Files\sync\uninstall.exe	sync_1.0.1_x64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sync_1.0.1_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326247319509627"	msedgewebview2.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell	sync.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell\open	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell\open\command\ = "C:\\Program Files\\sync\\sync.exe \"%1\""	sync.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\ = "URL:Sync Launcher"	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\URL Protocol	sync.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\DefaultIcon	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell/open/command\ = "\"C:\\Program Files\\sync\\sync.exe\" \"%1\""	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\ = "URL:com.elixirfn.prod"	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\DefaultIcon\ = "C:\\Program Files\\sync\\sync.exe,0"	sync.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\DefaultIcon\ = "\"C:\\Program Files\\sync\\sync.exe\",0"	sync.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell/open/command	sync.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\com.epicgames.fortnite\shell\open\command	sync.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	sync_1.0.1_x64-setup.exe
4072	sync_1.0.1_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1924	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3276	sync.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3276	4072	sync_1.0.1_x64-setup.exe	92
PID 3276 wrote to memory of 1924	3276	sync.exe	93
PID 1924 wrote to memory of 3668	1924	msedgewebview2.exe	94
PID 1924 wrote to memory of 1884	1924	msedgewebview2.exe	96
PID 1924 wrote to memory of 1884	1924	msedgewebview2.exe	96
PID 1924 wrote to memory of 1884	1924	msedgewebview2.exe	96
PID 1924 wrote to memory of 1728	1924	msedgewebview2.exe	97
PID 1924 wrote to memory of 3296	1924	msedgewebview2.exe	98
PID 1924 wrote to memory of 3296	1924	msedgewebview2.exe	98
PID 1924 wrote to memory of 3484	1924	msedgewebview2.exe	99
PID 1924 wrote to memory of 3484	1924	msedgewebview2.exe	99
PID 1924 wrote to memory of 3484	1924	msedgewebview2.exe	99
PID 3276 wrote to memory of 716	3276	sync.exe	103
PID 716 wrote to memory of 640	716	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\sync_1.0.1_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\sync_1.0.1_x64-setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\sync\sync.exe
  "C:\Program Files\sync\sync.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=sync.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3276.2724.14777739568907870521
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9ee2fb078,0x7ff9ee2fb084,0x7ff9ee2fb090
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView" --webview-exe-name=sync.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1896,i,14732790036698024863,10091021609526997570,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView" --webview-exe-name=sync.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1908,i,14732790036698024863,10091021609526997570,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView" --webview-exe-name=sync.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,14732790036698024863,10091021609526997570,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView" --webview-exe-name=sync.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3492,i,14732790036698024863,10091021609526997570,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://syncfn.xyz/sync/discord?launcher=true
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff9ec35c188,0x7ff9ec35c194,0x7ff9ec35c1a0
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,14609380901202132015,12030104249504881144,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      System Time Discovery
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,17994695013244294198,5417266929525649932,262144 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,12584287075144338324,10913764024009505643,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,11118911656712819807,7228672986202681977,2097152 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3380,i,14985304490957772203,6263701593726547314,2097152 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,15997344072845635627,5574767721867970154,2097152 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,4918275510409638685,1119863219797521837,2097152 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:2
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,18291860144941106717,7437482129581927204,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,2124941506988836760,13600475925927318011,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1971030356300450205,10884734587227946753,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8388160131727335375,692332458154990251,524288 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4608,i,9088824775258551527,11419126879407929239,2097152 --field-trial-handle=2312,i,9291452167236146871,8679555982955108783,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
      4⤵
      PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sync.exe

Path C:\Program Files\sync\sync.exe
Size 36.0MB
SHA256 3573fb0449f1a35b93db5d957210df5ef2f72eb2177555ef19c790d61f74172e
MD5 b124fb62638c8400becbfeb61cb41db2
SHA1 4746507aa84999cae554f272743417c8a028b698
SHA512 b54f58606194fb6decd736406439a78e2777887c2bd4c98cf799f2997a5b5b3fdf24e176e320a0349b2725b70557c6ff4cd66d9253dda956623dc88f02b1f736
SSDEEP 393216:f40qfQwnmnJv57V7ce+Oiigddc6I35nRrabdd/oJF+At6Kj4FDqLgjc:f5/wmJvD7lQiC85nBgjoJFZ6K0+g
TLSH
T12887E0117F8A9A6EC15BC474824787726A7170CB0B35AAFF448496783F6AAF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sync\sync.lnk
Size 899B
SHA256 555fe5d2bf015a546c02468bdcea96eda760f56b393e61f42b35f57e8619a537
MD5 00800b77bb27bee56e83289d47aa1c00
SHA1 b9d4541b6a42e69770146e1e8b9996be141bdf2f
SHA512 403555ad3776cae7a60b8b18a1ce348ee56671a5c0136b265c861aefe8001a48944c16c863281a62f802f1b1c265682e1cec4989f1ea08966b682623caee5a6f
TLSH
T1AC116D14136B6B59F2A65775A5210B305B37BC00EEA6472A40ED428149ED440E7BEE77
MD5 SHA1 SHA512 TLSH

Submit Download

sync.lnk~RFe586a4e.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sync\sync.lnk~RFe586a4e.TMP
Size 822B
SHA256 caa33427ecc9f498413f55ead71b74a9e281e73a6ef34fe31248a51c6cb55898
MD5 8e6688b5a6343a21e395557564da2b80
SHA1 3cbf3d255cbdeabc0d88fe6033821493f262f13b
SHA512 a421632e48b394dd79f8a81aeb0b993c0d54bc6f33a66859f914c5b695d9f492a34cac3693df181f365da471c8475195c3320af0b9a5d50ed5700d5d02e0c21f
TLSH
T1B3017014036B6F59E2F69775A5210B205B3BBC00EEA7472A40ED4281449D404E6AAE76
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b93d7236b93726f94f28e47e8619850e7cda55422291172ef6096d026a98ef97
MD5 2fd47962b7d6c466620d339b115c27c1
SHA1 cd437cb6a57a80bd9ee35be91691e7739383b177
SHA512 bbc062be33d2233b4009ce19eefadfc6bb3c6223479a5c3d91fe0a330933564c4dc7aa06fb245ba0e7ab1557982b4ba124a3c269d7c9382a6740497447cceb1b
SSDEEP 192:YONR6LCWtDQmiUyNPILSuOCzd82+jsEU6nU6:YONR6mg1YImuO8r+NUIU6
TLSH
T12002E936A82C6C779EF26E45B5873B276FA41037E5902F54DEE82F0C01DB64C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed82da4f327586ea883a05d957c981c29e5de842ca430eefcbdeb1d565630206
MD5 622b1edd3c632cec4a7a0b846e6a29ad
SHA1 3a067baa46941cd9060c6c824393cf96ee13aad1
SHA512 b7884aa254a451bbbf884b5082ee566f3ce3a6399583a24498516c30f5f6190d02c8e23d1d130cc910cea1f0b5bb779b44538d0409225315287320ced4ed0e41
SSDEEP 192:jONy6LCWtYQmiUyYPFLSuOCzd82+SY9M8PwoOmI/Nq2iUU6:jONy6mg4LFmuO8r+SY9XYoOhuUU6
TLSH
T15D120A76A829AC675EF67945F4C73A67AFA42033DC403F54DAD81F0C05DB78C234A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db89da630f63306f003847b9db92497616bd0601f8bc156955c3f49c7d480366
MD5 a030e8e401ef38d9292c5085a4083a95
SHA1 03de5cec18e7e9cf39171b96fce569f4f925bd70
SHA512 5828834cc495f06090ac1a50fb0655a39e878aea76ff38ad540530ff16ada9d6c624f940a0b5b4f53c409ca8e7c3279cecfb5f9cf657ac71792be0b4a9de3949
TLSH
T152414B59BAF90148B3B76F5A9BF6A86D487FBC772E16C49D10010E4E0662A41CCB1B33
MD5 SHA1 SHA512 TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\StartMenu.dll
Size 7KB
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu368E.tmp\nsis_tauri_utils.dll
Size 1.1MB
SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
MD5 1e38f56aba852b737f2866c48b823165
SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
TLSH
T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3f212fee035a0da22e18eba3d144f39fe6891eb84b025b0d2104ce71e1b42986
MD5 82d88f536ebd090e9020d3222b3f5b5b
SHA1 4213493cfac799c5e44fa9bece89f9b24fffbcc7
SHA512 aac94ba12eab025e1f0e3a453e566685f8138e378747cd49c83451fba1ce8607a521448e73928742e4f13802ea72bd9942523b0c8a1b2322d05cc3c105d5e080
TLSH
T111D01222B6014174C0302033494372090800E72B410A50006439995D1B040501A13451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a84d4f44dafa1af3f35b295580adb363bbda226a71dcce16957fe46b9da36e1d
MD5 78835f3f94540737a4e969cf485025b4
SHA1 a0121e7a11ae2866eca927f07ee0a4e31bfd8854
SHA512 1a112cce47eff7f8fd98ba89e460fb660eb5032294ca214456c5c2d6bbc8e29284ac4962ee96064ba99aa51f78b24bdfec7348c218b25e23bbb14b125092bff9
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Local State
Size 1KB
SHA256 09c0a8866f1ce743663afec8224404ae0475a66c7ff1fd89da1d187b6eb9ec9e
MD5 751a0916c131da9582dec6d9789420fa
SHA1 edab5e760149680f376b996ed814dcde2d08e1c1
SHA512 2aec06da8df04ef973f172be57c0e8eac3dcead566960694e1459f4f9bcc650cb1d2ec20650f96c1dd62b67bb3db7e3fa3b8735b6ed9b6973f1cb042ecb20541
TLSH
T1FA3167F1E4546B3368C2A689F7867F9B1E61601591208F84A6DE0F1C03DB79C553BD27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Local State
Size 2KB
SHA256 47160c4e8bd09d3c963b312e04494a019c918b4c30c2e897b997438075257097
MD5 dfbcfaa5127c8cb42f2cd49fcec054db
SHA1 94de97ea29771c7cc462d9540a39e2faf12795d0
SHA512 7760076b2ee5aa885089218bb73626bded0dc57408a2a09b6a6d3192b34fc118205c209ec3ebb43efe68fc46979aa89aadffc997371585f674dfd04f37f85791
TLSH
T1FA51A872AC18AB3349D39A45FA4A3F279B75A15596611F909EDE0F0C02DF25C2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Local State
Size 3KB
SHA256 f214ca5daade7bfca4f29ff42d164bf3883c71aeb665081028cb3f8ca82578c1
MD5 b3d1426023579f2bfcb94c81600dc11b
SHA1 e1d7a5f66d57f9e65a8d0e4151518c7495d1e7a2
SHA512 b864ad223d6a218084585c367b2e68915fdeebb0e3ce8b2920f07b7a50d421d6771f29b81b4223dabc5d243cb27f5b6a6556e16d3ceaa8adc70573777e9b5327
TLSH
T1AF71B676A868EA370DE3DA45F9862F17B7A16127D5943F94DAED0F0C02DB3982312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Local State
Size 16KB
SHA256 1e4c1f711224dfd8e8c68b1e0774fbd545eff7c7cc25e7187e5e93252252d9bd
MD5 4510d12fd18514bf1597ca13020c9cdd
SHA1 cca0b086f53b894a266b40c1aea2dbb380024459
SHA512 43a5573a9b483575dc3b4d74aace7fdd1d0868aa517358ec41fcb2a8e94d530af88040d1cd5e610138fc0a3904d97c65361d2ccdeb0cd8bb08d1c2cd6c2c13af
SSDEEP 384:zp+aQikB+z/xvxjg/qhEwNbStVbMgN2m/xuEk:w/UxvxjgC+Rt99o
TLSH
T1AD728E2A986D7E2395F3E509BA5D1B4BDBB994B290C16AB84EFD5F0C07CB3941312D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589e2f.TMP

Path C:\Users\Admin\AppData\Local\com.syncfn.prod\EBWebView\Local State~RFe589e2f.TMP
Size 1KB
SHA256 7b0341e09b4b3cb6e0905fdbc7c5f9a6337f2fe39e205a5d87553b44762b8ce5
MD5 ef2fc58da46541111de32c0a1770cc82
SHA1 cec5cc8a7e6498bd6c4817dc5664a27b0a4a9834
SHA512 851cd1ddb87fc233d73d4857251470638e378ebb12f1eb9973a578757c5b8db41f1b308753dd386a8818b5c1f301fe1795b9d25b693029471df46e3e74bb4494
TLSH
T1002168F2D458BB3368819955F392BF9B1E91601552208F08A6DE0F1C03DB6985537C33
MD5 SHA1 SHA512 TLSH

Submit Download

sync.lnk

Path C:\Users\Public\Desktop\sync.lnk
Size 881B
SHA256 339a9273588e3b9e20f5e308aeb0c3e41f6a774f9a7091834faad482bb4492ef
MD5 b134fba60288d993e35bd4425305fb25
SHA1 f6bf905d7622cc23d2a8f01dcf0e3e4d00b1ef01
SHA512 d75ced70098c6964931d6c4ba0627e2ad0f42dbd8bf2f48394f3ca9f15475c7a22326b2b905eb244b1d77efb6b004545295e8dd59a71992183bf3dcbfb3da8dc
TLSH
T130119C10135F5B5DF1F65776B5210B209F36BC01AE5A472A80FD828548ED444EBAEB73
MD5 SHA1 SHA512 TLSH

Submit Download

sync.lnk~RFe587de5.TMP

Path C:\Users\Public\Desktop\sync.lnk~RFe587de5.TMP
Size 804B
SHA256 50447f584d63841bc3e3792b2e6e682282c3170aa5d9c5ec5ae60dc41c9a0fb8
MD5 185589254e8b28799331f36e2315b605
SHA1 9df4ea8d16bdd3e8a23e53146d677d3a9d66bf60
SHA512 d7dbd966add84171f3dfa3e2d58e4e128423ae10b7ebb8a1ccad5f2f6a0e59358fd4a116621ec7f4c17896c0b3c62cd1f02a5adb0a6cae3d1bdd82ca5893dbe2
TLSH
T17F019E10035B5B5DE1F69776B5310B109F36BC019F5A472A80FD824688EA444E6AEB73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1884-98-0x00007FFA0C1B0000-0x00007FFA0C1B1000-memory.dmp

Download

memory/1884-305-0x000001F1C8200000-0x000001F1C8314000-memory.dmp

Download

memory/3296-160-0x00007FFA0BD00000-0x00007FFA0BD01000-memory.dmp

Download

memory/3296-161-0x00007FFA0C1B0000-0x00007FFA0C1B1000-memory.dmp

Download

memory/3484-162-0x00007FFA0C1B0000-0x00007FFA0C1B1000-memory.dmp

Download