017eb9fa30e20361564f2ea8a6db8a7d275e8798f7de64b62f99af0d9ee97981

Resubmissions

23/10/2026, 13:56

261023-q82eesb12y3

23/10/2026, 13:26

261023-qpy5yssw7p3

23/10/2026, 13:17

261023-qjsqzsysb18

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tcp-tor.exe
Size 627KB
Sample261023-qjsqzsysb1
SHA256 017eb9fa30e20361564f2ea8a6db8a7d275e8798f7de64b62f99af0d9ee97981
MD5 f799955fa94c7bc351cb13d47ebad839
SHA1 e889d2e8943b39e4c86a74eec7c0b6ac74915dc9
SHA512 f3e0747b082e591ad55f255105e3c4f1f0211e2e2bd46e08acf69d6298f80d4f247f4fc841727adce597fcb0fde5afee0535b74058cf2b1e8729d0c2a2c5542e
SSDEEP 6144:eZIakwj73ORchAJSBuOAItKDfAd2oEJhwefq3abLYeyNEWGNSK/B99fSdj6Ahx5D:TawSBuOASUJ3fqKP5y8pBOxV/muJLVz
TLSH
T14ED49D58F6A401EDE27AC274CE579613F7B2B849137499EF03D089721F272A24B3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
68	5036	Process not Found

Uses Wuauclt to proxy-execute a DLL 1 TTPs 1 IoCs

Wuauclt is the Windows Update Auto Update Client. It can load update deployment providers to run a malicious DLL under a trusted Windows process.

defense_evasion

System Binary Proxy Execution

T1218

pid	Process
5296	wuauclt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2588	msedge.exe
6036	msedge.exe
3976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3148	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2304	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	taskmgr.exe
Token: SeSystemProfilePrivilege	3148	taskmgr.exe
Token: SeCreateGlobalPrivilege	3148	taskmgr.exe
Token: SeBackupPrivilege	4712	vssvc.exe
Token: SeRestorePrivilege	4712	vssvc.exe
Token: SeAuditPrivilege	4712	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe
3148	taskmgr.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2304	4040	msedge.exe	106
PID 2304 wrote to memory of 3216	2304	msedge.exe	107
PID 2304 wrote to memory of 2588	2304	msedge.exe	108
PID 2304 wrote to memory of 4032	2304	msedge.exe	109
PID 2304 wrote to memory of 4032	2304	msedge.exe	109
PID 2304 wrote to memory of 4032	2304	msedge.exe	109
PID 2304 wrote to memory of 5052	2304	msedge.exe	110
PID 2304 wrote to memory of 5052	2304	msedge.exe	110
PID 2304 wrote to memory of 4928	2304	msedge.exe	111
PID 2304 wrote to memory of 4928	2304	msedge.exe	111
PID 2304 wrote to memory of 4928	2304	msedge.exe	111
PID 5800 wrote to memory of 5832	5800	msedge.exe	114
PID 5800 wrote to memory of 6048	5800	msedge.exe	116
PID 5800 wrote to memory of 6036	5800	msedge.exe	115
PID 5800 wrote to memory of 6048	5800	msedge.exe	116
PID 5800 wrote to memory of 6048	5800	msedge.exe	116
PID 5800 wrote to memory of 6124	5800	msedge.exe	117
PID 5800 wrote to memory of 6124	5800	msedge.exe	117
PID 5644 wrote to memory of 5724	5644	msedge.exe	121
PID 5644 wrote to memory of 3976	5644	msedge.exe	122
PID 5644 wrote to memory of 4792	5644	msedge.exe	124
PID 5644 wrote to memory of 4792	5644	msedge.exe	124
PID 5644 wrote to memory of 2588	5644	msedge.exe	123
PID 5644 wrote to memory of 2588	5644	msedge.exe	123
PID 5644 wrote to memory of 2588	5644	msedge.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\tcp-tor.exe
"C:\Users\Admin\AppData\Local\Temp\tcp-tor.exe"
1⤵
PID:4424

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1c6d3050hfbe4h4a20h9fd2hcd7e05ae8c6f
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1c6d3050hfbe4h4a20h9fd2hcd7e05ae8c6f --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffd9284c188,0x7ffd9284c194,0x7ffd9284c1a0
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,4187618670359675598,10307521709706942747,524288 --field-trial-handle=2240,i,8575791673180525983,18421454525962589140,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,14715048181009806753,2606048831979135411,262144 --field-trial-handle=2240,i,8575791673180525983,18421454525962589140,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,10530397149314288994,9024164678569444580,524288 --field-trial-handle=2240,i,8575791673180525983,18421454525962589140,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3092,i,8984238768320475252,11771485538413431965,2097152 --field-trial-handle=2240,i,8575791673180525983,18421454525962589140,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:2
    3⤵
    PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault00b63c5dh2d3fh426fha42chf5765fe0aae1
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x228,0x254,0x7ffd9284c188,0x7ffd9284c194,0x7ffd9284c1a0
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3933404478216830731,11866185118249725789,524288 --field-trial-handle=2252,i,2331475957120147350,172081095765687256,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,482920614607265366,17302939634893740502,262144 --field-trial-handle=2252,i,2331475957120147350,172081095765687256,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,6898462248611037819,498244493267822137,524288 --field-trial-handle=2252,i,2331475957120147350,172081095765687256,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault41796172h3199h414eh8ae6h46d9f343e05e
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2f8,0x7ffd9284c188,0x7ffd9284c194,0x7ffd9284c1a0
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4756872515641587206,12858846292686346326,524288 --field-trial-handle=2324,i,13536308814984376148,10830296347771250294,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7110783851108678335,3245779169591554211,262144 --field-trial-handle=2324,i,13536308814984376148,10830296347771250294,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,7016472016802667936,5498601684858361093,524288 --field-trial-handle=2324,i,13536308814984376148,10830296347771250294,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:8
  2⤵
  PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5164

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId e689da50-52bc-4a87-b1fe-b0e9805efa7f /RunHandlerComServer
1⤵
- Uses Wuauclt to proxy-execute a DLL
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01f57ba1-617a-43a5-8258-72f7009cc734.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\01f57ba1-617a-43a5-8258-72f7009cc734.tmp
Size 8KB
SHA256 002d4377c318be491ef4da10dd1bc2985974271b331bd23cf2c9b2f69f73286a
MD5 5f3d77330422618ea4f2b59580530e97
SHA1 d90bc7fced2b01d471343074ea233fe76d87dcff
SHA512 a283d17b6b7ae64f292b089206dfd606c048ec7e38f57c198939b233c4c1452109296a7fa03a5a2b6554f5eb396fcd76c5579ad97f9218fba770d4922c5b296b
SSDEEP 192:CONQ6IE7QmiUyWXTLuIGmYMgjzoFG8MXXxeUQ27HQhqXCuU6:CONQ6Dt3LuIGmYMoULMXXnH1U6
TLSH
T14D121A35AC78FC6B1EE3B408F4873A63AEA51177D9896F44E6E85B1C00D7348170E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71011633-f360-4727-892e-923e8c5ee90c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71011633-f360-4727-892e-923e8c5ee90c.tmp
Size 9KB
SHA256 72e4f3c99081e58e163efff405a411a70accd7c40bab62fba254b7e8d0d0c074
MD5 f0c612fb9f7eafb151e407e8c37fc372
SHA1 0440c402899bb599ee687b5e911b02f709fe007f
SHA512 8335719e65b4f0e112722e8c7c28355c60986a18b64eafde21b38e75dadf62ef2b5ffdd00d5d15ed1bcf4dc77a0587367e7987295fe22ab483c15b3c1214d5a1
SSDEEP 192:zKsNU6IE1sQmiUyk6TLzIGmYMgjzoFG8MXXxeUQH7TQqrzLUO:zKsNU6D18yLzIGmYMoULMXXoTdLUO
TLSH
T19212F9359C787C6F9FA3AD15F44B3A279FA5122B95892F54EAD81F1C00C7258130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2772080e294cb38321fa75d995acf66964d106631ddd9d0f19e8ff1bcb29d1c
MD5 ac9e00cf388fb6da9cde404a426d84fd
SHA1 0282b002f9965b3dd5907b6587dedadd040b6093
SHA512 1861686ece02a63454a53af586300b3bdb05fe72ccf4ae6a0c4b668b1b0f918e60f4c2e673e2ede8aaa670076a81698a516e9eb396014d1a259c4e0cdfc708b1
TLSH
T1D7D02BF8DFD8C120F033383400388283308C664820061120A873114C0C441C34265868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

01a7b938-4c2b-4697-a5fe-fc0ebe8e55a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01a7b938-4c2b-4697-a5fe-fc0ebe8e55a6.tmp
Size 7KB
SHA256 f8db1ba1db89947953b66de483a4b4a61a1f6d0199b22111010c265c3e4106f7
MD5 0b68ea8a366a27a94324d03e399da68f
SHA1 0359552a4abe5f8c6fc7f6ef35305632e4ee54cc
SHA512 a4b8ec4a78f82f54d45221b436d287d74575450b880aa22340c7e9be21142100d7e6c18b035d71355bb5f26072fb320b9e5e0fe57d696ce4aeef762eccb53289
SSDEEP 96:sa2jh0iEDWab6xPscSnb9mVjrGdHW+i046W6hfuH9EOx+WVoMfm+uecpYQj8W66a:sxiuZsKhMrpMHW6+WNGYGsWxhgF
TLSH
T1E2F1C852AF28693B4CC7E11DFA657B53E2F5103165D51A4CEAFCCA5C08DB6CD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d3b691a-4967-41a5-8f3b-18764e80a9f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d3b691a-4967-41a5-8f3b-18764e80a9f0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29e151f8-5854-40fc-9e39-f21cb3cb3101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\29e151f8-5854-40fc-9e39-f21cb3cb3101.tmp
Size 7KB
SHA256 c37a8c8eb7667cd2ae164b0463327b941b4cf7dcb838e2ad6dddd9691a80f151
MD5 c475acf1c944b11fcad44fe7fef5065d
SHA1 fe57e19729419da653c44c92ea94ec685025fd33
SHA512 af1bcd6a6a710fda8ac5bd835c558546217d7586da47b31222298b4e9e4745a9a6f1f396a159349b876c19ff66cf281b4f3054d3afc4c0399192d07f02e5e7af
SSDEEP 96:sa2jh0iEDWab6xPscSnbDmVjrGdHW+i046W6hfuH9EOx+WVoMfm+uecpYQj8W66u:sxiuZs8hMrpMHW6+WNGYGsYxhgF
TLSH
T1AAF1A756AE24693F4CC7D11DFA657B53D2F9102265D51A48EAFCCA6C08DB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c67ad8a7b4fff8b6592827a27f8590eddee6c59a2404c2bf967b9a95d8a52611
MD5 e56e4bfeba324f8998779b78d915ca89
SHA1 b09bcc9e8eac50fc3ac051a390b5259575ac56d4
SHA512 b319969c7527ebc4051e956f6d0faf3487c200a6ba759e2a47cf97a909e2929681310d13dbb33033709d496ce83e436ebb8d770cb07b11ebe4b4093c73a55adc
TLSH
T1D861808C9B1DC3F1F7F9837E80E923473A72C58194834D420A9BD078889A3E7923B010
MD5 SHA1 SHA512 TLSH

Submit Download

250ba455-4626-47eb-ac29-5caf5e6d639f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\250ba455-4626-47eb-ac29-5caf5e6d639f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 4bc4437a66ab84f3ca1ecc5e7512f31b40ccfbcc70d68099ae9c400f44e90949
MD5 15d8034479d60a0171e06318eca5cdb3
SHA1 4d7c53404ca7ba6614234dff9ea57fa2ce754632
SHA512 0bec6972134cd1c23411d998126dc39c75370ff717d989acbb9cf30f1a96be1f46271a57ddd2ff1dea635bfc5d3506228fc6a6b1b197d5f4296b725ab66e9f50
TLSH
T117E0D89678C7C12D5A9D3482112C7708D38034AAD6837E0B2705C8CD7607205F346686
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 06ca2917ea67d4b3077daeb65af8faea1d9b998ab0df14eb4fb4696502695172
MD5 14a6d3a6ffe7b15c8f1560f9dd947ea9
SHA1 2304e2d59788f2d232315f75f7387f4baf0b7e90
SHA512 4bd8687408c97afd15381bce0c5fec6e291308d2d96c591546706b4221935bde5d9d69582c7c3243bc6399205a592e4673ea5d8e6875b371f56cead732cd8455
TLSH
T1F3E02094F8CFC11D7A9D3CCF012C7B0893D03496D6827E4B1704CDC87646011B343546
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 496bab0c5aa4441bf6def50e42d8386f53aab420bf163ff95d9b070c82f1e302
MD5 eb1021e2db0485a5f9602814257ec090
SHA1 69aebc37964bdcdad6b7f5d3e2f848a2a0f7244a
SHA512 ed35292f754e35adb8ce4ae40a9fb9a2b6f6309dfa439cc7b20575a3b1437b70dfda11df1dd23d62b907d36e1618667f549e56c36babbb7ae21345e1ed262471
TLSH
T1C3E0866824CAD22AAB9868A3426D730897D236DAF7C57D4A670EC848610E745A3A7680
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 8ef9f0cf3484a899df3a211ccbd026a61b132f4d8e66fbba7c32dfcf71fbc9e7
MD5 508f7d45ea96c93eb0a3d1bd414d93af
SHA1 cdc4dab6db94f40f4138912c6681049c26ca6d20
SHA512 8f76d3f84bd3bec68c5895fa4cd6cf9aaab4b80e64358e023daa2a62421938b446f7f0a91003b9a0cc1ae7bd4295447eb0ca3399a323408105e24f7e7a656d93
TLSH
T196E026E464CEC12DAA98F8D7867C770CE7D035DEE2883D46170CEC486202649A3CF681
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 e4f4ae964e6c06f2f5933518585c1ba3dbd61a334330e273c53e7911bc143f65
MD5 e661e056d6298269ecccca5177880c98
SHA1 f8e1a16eb3db4bd01342dad9518ef4d919b6dc4e
SHA512 d9fc8409a2e2ba08eb7b65d264e2d8688b0260b85741043ac6d2fcc0795f74f76d46f96710c076c6a28daf0d378f9341dcdc507a2e4e6ed954b38a827856cba0
TLSH
T1E7E0DF64A4CEC2AE6B88A08B032C7708E7A0345FE7853E861B28DD4DB009004A3836C2
MD5 SHA1 SHA512 TLSH

Submit Download

0d9a10c0-e7db-4662-b159-eb29cf86c671.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d9a10c0-e7db-4662-b159-eb29cf86c671.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

64371075-0abf-4a54-976c-b7da388d0230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64371075-0abf-4a54-976c-b7da388d0230.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 b60708c0f9004e64747cd3b92ccd3500da8df13c125b628545422a9eb065c0af
MD5 881f6d0a5cbfb933dba7554b1ee4ea1d
SHA1 1082c741c95462cb102319c721f154d4db278863
SHA512 5b727d4de7489e1bd66fcfac92dcc6bed6123093c55b75c6574497597ca1d9f4030f1b9652fe59794336a32d81b2e8e51aa6f4b6db4440dfa7ef627355da779e
TLSH
T197E0261126CAE23E639A2043022DB30CA3E4756FD2C43D0B3F09CA4C7546704F2E3580
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 95a8569120b920f44c1f7b1fe8e396924be5380d8c90926d7b3e915449c087dc
MD5 ed662c037414d4ad0068dae9f5c7a42b
SHA1 84bd0437cd039d3afcbe8ed6c6b75c1f21d0baf5
SHA512 092c0434288036cc28da4a2ab8a131fe8731b3f37bcdfbfa80dedfbcfa95e487c6a7033a0ea9cfafc14dd9103d467d57ae1433645826732340809fb9676f56c4
TLSH
T1EAE0DF2065CAC1BD72D96497062CB70CE3A4B46FD2C8BD462F29CE4C6146504B39B582
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4ba793ed7778588e0589678aad506ccaa640f296b37470f3259ea7c5694ab2a6
MD5 b466b2e69eacc3f02df8b51494411786
SHA1 e81d12a86b817e5daba83aa55969b1d99c0a4959
SHA512 97ff597f33c4aed63c2be45743e4a2fbfc80928a30c8b997fa411bb61951a6921d646f5bf66e4a059c63ec662b4c73fc809764011b8e7836805944a53bb2e38f
TLSH
T10EE0D82035CBC62E73CD6487832CF70CA3A37556F6D57D152F0CD54C620A1407347540
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6cde60a8a25015c9507d0d8e7c8a014c4d17485a9673c5cb7d2dc0f876245577
MD5 058c2c6b5d096b72dbd6f8d0d9e63c26
SHA1 a731143317954c43d4633867ea8ab32086eb0376
SHA512 c54590f6e8b714da6e3aef5a7061d1a91397e5cef344136f5e11012a2fa7d614d4cc6e88fba80a9d53642ad97244870b90a0a217e4abf1f1d440c3fcf38cbfcb
TLSH
T144E0D82035CAC22A67CD2087121DF708D3A6745BD6C67D2D3B0EE589A20A2807353260
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 3ad4c4623d7e6e8b193567ca4af6197cbe3d6bd4189dfd91caedc892943403d6
MD5 309348ae2d23389f7a58e10e8c119364
SHA1 5c807c23c9a37d0c86642a5e361fc310b5584201
SHA512 086632dcee32401a83b3619f3bcc7e86adc9b99e5514437cc0233e7a3b3866a70137aff7e638d81c75aafbba691a64245fd0443bf49b8d13d3bf99ddd8a791a6
TLSH
T1E3E0267465CBC67D66CC64C3837CBB0CA3F1795AA3C1BE0A5B0CC44CA101100B3AB980
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 47509b3aa99b58a29663235bdbee9e9f34e76f6ab9e25d8f895b501b96dc9389
MD5 f2300ce816890c6b3cc3a9684ebe136e
SHA1 924e48c53f63c66e47f32fb43b76b7ff4cb49c18
SHA512 e990ffe931ef3a288ac6587c7e145aa2843567ddd838a8890292322bf8d8b4e7db8aa1814c14783ffd2e29d1bee09112218e4c43f12b7151c449b6909dec69c8
TLSH
T13EE086B265CAC63955C9608702ADBB0C97F0686A97C63E4FAB0DC44CB145385F3A7580
MD5 SHA1 SHA512 TLSH

Submit Download

b3b91b67-5b7e-455b-bcee-04fb69f6bbe3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3b91b67-5b7e-455b-bcee-04fb69f6bbe3.tmp
Size 26KB
SHA256 4998b50635e9b82111e3f095f79253fb41fbdccfe8ea50f27e2ffadb85c90386
MD5 c045d45f137446aa89eae417bd9c4bd7
SHA1 4274b2c0ad34e985139a42fbbd85dbe5f34ddf31
SHA512 5d72b2edda338b78c435cc6ad7c72760eb7f77d99e87ec2fc3cb3f3f3ef17f51b15f6fc37e50e26ad4157670425e9d9fe69e31ca482e1ec68d8bac7d58fff01a
SSDEEP 768:QAWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACyN3ro4wfeTmRg:QAWPcLKWvKeEeu1jaClLiFNk4wWTmRg
TLSH
T11FC2FB3B644CCB7E5FC01E9DDC5A6FA76E9802C79A644D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cae94bdc-d095-43db-b3b8-7cd0c2f90473.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cae94bdc-d095-43db-b3b8-7cd0c2f90473.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 052d16baa16235003ebc586b2cb7173fc1274a083a528db55ce0f738378c645d
MD5 8754a9269843b615fda3e7817c13dee7
SHA1 ad4e73332d50c355f5fe0257a84d719f67f2008d
SHA512 121ae3fac9a3db4db4a7f716e2ce7021d3d70c95c666072f0db6806016158b1dfbf277ca179cd19c702590cb9fb13cc8c74f13417a6174c33438332cad837efc
TLSH
T130E08651B9DAD23FA99820C7017D734CA7913A7FEA857D4E2F0DCC4CA145344B7A7281
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 35e3875310df611dc19ef4b9fed5c7ba06aa03f95c8143133f2ee8f24efdb428
MD5 5ab264f7dbaa09664f57677206b040ae
SHA1 563a5ca9da03e7e4f493eb234a4e2c2875a0a531
SHA512 98bba1567e3199c4b09c3a887e23956fd0558c7074f4d576eb0545754d1b9b00b19a6e7531a2db25b69b0c2f593972eaad90fed0126b6c35339ac9ea0423c835
TLSH
T10AE0205074C5C11E7A9A7087011C7B08B380245FEAC03E092F0DD48C6305141F34F541
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 610B
SHA256 e7117c97f0dd22ee39b778a65bf9428c153e328bdf6ed67210273b27cc7f0e78
MD5 4147bb07e9c36d2d2d543e3361c87931
SHA1 5ba505c29b14978c803cf64d36aa46d15117673f
SHA512 ddd2396f4016f5905ed9742a4e636d255c0c7cceea01789fc88c9c41c7059ee8302396529ce2848765b2f56181a71b329906c7713e071d5054d75304a33ebd3f
TLSH
T1C5F01216F314C049D00E967E5026AB252369D8168AB8ED0F493974211E766541E9B7E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 644B
SHA256 1fb1f5fd2811531fc3f3c64c63f43eb189490bd02a5fd08eef676563f4c2b211
MD5 c767663cc39e17b61ff8f4c2ceb73d05
SHA1 418a24dece6c453986a4a89d72e4be617160ac98
SHA512 44b7876a22228a17114de16ccfbbcb3650a26e493109c9df4b6b0833e82aeebdb36b11567ecc015d822cdb0eb51dc3d4c9acc23b4b6d7648223c2cffb157caab
TLSH
T148F01216F314C149E00E977E9027AB352369E9168AFCED0F893974311E7AB541E9BBE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 914bc2249ca8fbdc489b94b5715cb111bbe7758703848ed504e3e8c7cccd7f57
MD5 6dbf791305eb0a7adcd8d1dcd60efd50
SHA1 9dd69a1c34ae170a2c431bbc88734a70650b5821
SHA512 5182be5e259391252a35f44238cb62c7d3594c789709974427aa3f4bd337e20048a5dc7f45aaa585c7cbe5d066a2558b2fd3c915f917d220a021a0c8843ea4c2
TLSH
T1CCE0205074C5C11F66967087016CBB48B391385FEAC03F052F0DDD8C5305182F34F541
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 8b8469292d9d8b214000c09df35b507ffd706b0136c01b8610ff241001534df2
MD5 79d5c81131dbaf009df67c020ef4732e
SHA1 53959f20bc05d102445a52f564b1d6dbb65bd318
SHA512 68a295da3eb0b4320f8a4b24f35a3c065db2624499dc19902e2c557343b822f6602469562f73a5950fdd728de5068553b13be81486fac7b8f7b9525a7212dae0
TLSH
T1A1E02610B9CAC23F9A992087016DB74CA39539AFEA803E0E2F0DCD4CE145342B3BB191
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 dc35ba97a0c490acf229261b8b2aed8bcfe77af1eeea39a3d60b6f88ea72b474
MD5 79b606953ac72152d2ea2d1abe457bc1
SHA1 88ba04aa282dbe1b5bb15ce5376778c2b1687f67
SHA512 c4cc9bea835764c0bea6d7520e46d24bda4770de0937bd364bfe9e8b56acd649a5489b973d55de9a9a527d84958d7da9df27225360bf5454d3ee5d89c352fb2d
SSDEEP 192:zKsNU6IE1sQmiUyk6TLzIGmYMgjzoFG8MXXxeUQH7T9qrzLUO:zKsNU6D18yLzIGmYMoULMXXoTELUO
TLSH
T1B312FA35AC787C6F9FB3AD15F44B3A279FA5122B95892F54EAE81F1C00C725C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

a030270b-8d39-4302-9605-beefd46bf8bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a030270b-8d39-4302-9605-beefd46bf8bb.tmp
Size 9KB
SHA256 8450c8af44380b154e8d66ede7441596b6ca06a0949553e22d3bfbcc5d490078
MD5 757b065d723efb199f977153fc65c9f0
SHA1 a8d0a4ce28902d9d4f73f8e538af1e31dc75001e
SHA512 569a3bc5b77acd4d6e039820dcf15286a034b714b9073c6089b355ed46a3f87788cb233272e0147d781f24cae537da033b18b37acb231f8848fd6c49510de025
SSDEEP 192:zKsNh6IE1sQmiUyN6TLzIGmYMgjzoFG8MXXxeUQ27i+qXCuUO:zKsNh6D18LLzIGmYMoULMXXni1UO
TLSH
T105122A36AC78FC2F5EA3A418F08B3A639EA5117799896F44EADC5B1C00D7348170E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9ecc03c-99ff-4d69-8aee-03aee6a1b042.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9ecc03c-99ff-4d69-8aee-03aee6a1b042.tmp
Size 8KB
SHA256 909e6f12fab802a697e7b4adf4d701df786b6facc2ba0534c795d714ea280e77
MD5 381c21b8951bf5417cf1586aae6cc692
SHA1 7eeaa12ae7103f86b2fb34f946680497fd3b3ff0
SHA512 786b1e23866e4676aff179ffe4f161db2f12406acd68e4c756bc03d7ad7bdc764085ea4fd732f732fa325a48dfc0c31ca029aa3a03a4371e5cf7ed73cff09e15
SSDEEP 192:aONg6IE7QmiUyyXTPuIGmYMgjzoFGtC7sQ7kU6:aONg6DtHPuIGmYMoUVsZU6
TLSH
T166020B35AC78BC6B9FB3AD49F4472B236FA5112BE5952F84EAE81B1C00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0aef9f0-eab0-4409-a00d-070590ad5e7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0aef9f0-eab0-4409-a00d-070590ad5e7f.tmp
Size 9KB
SHA256 25a716ca92eb98ad4fcb5de9b292bd7f7bb2e069bce8febde1ae8b1b14db2c1f
MD5 9d06ae1dabd3e98e19eb85ef0a2807b3
SHA1 db5d28202f9e5491bb220b393f2e4e6addbb5f3d
SHA512 d11c14e73a1e536475e469b0f47683360ede9b8700b351eaa30d828a1f6272983ee362dcaf85034b9f0eaaf8730d76e7ecd372462ae1901578bf0eedf79246f8
SSDEEP 192:zKsNh6IE1sQmiUyO6TLzIGmYMgjzoFG8MXXxeUQ27i+qXCuUO:zKsNh6D18kLzIGmYMoULMXXni1UO
TLSH
T149122936AC78FC6F5EA3A418F08B3A639EA5117799896F44EADC5B1C00D7348170A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4817742-84f2-474e-9387-382d7a4c08b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4817742-84f2-474e-9387-382d7a4c08b6.tmp
Size 9KB
SHA256 901d1c180a17ed058d0b6b7213c07b899e8dea694d48fd5460164ef8a73e5202
MD5 8ea836615d714e9e1ad208a799f874f3
SHA1 1a78ee5757acbc90fd4dc94af8ec8bdbe3d61621
SHA512 1aa1e8b3cd9c0d8b11559b1e734fa8d1abcefb5a8349ccf7c57f412f27cbed1c81d67293893954e16c75b760294ea49b5038dcd948ee9f0014347cada35ab9e4
SSDEEP 192:zKsNx6IE1sQmiUyj6TLzIGmYMgjzoFG8MXXxeUQ07EAqrTUO:zKsNx6D189LzIGmYMoULMXXhENUO
TLSH
T148120A369C787C6F9FA3AD15F48B3A279FA5112B95892F44EAE81F1C00C7248134A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 662B
SHA256 9d61fc7a3fee97b5ef3de268a417243f702613c1ab027f2e8be3e6ecc5781bba
MD5 aa0faf1105b97db170091f7048db6919
SHA1 633447f158391fc5df9647d2a917ee1c8f8e7fb7
SHA512 2ef324ced24187aae62e0f1ca7115f9a9bca442def46deb6795f981de86e9f351a6349826672db57864199c798aade7545e1d46eda35b98ccdc31cadca126484
TLSH
T14F01822B802C492DF5F8D50E7225BD63F182B1035DD39C6731CD8140EF3B99CBA598A9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3148-29-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-28-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-17-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-25-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-18-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-24-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-19-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-26-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-23-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/3148-27-0x00000235556B0000-0x00000235556B1000-memory.dmp

Download

memory/4424-1-0x0000015E63540000-0x0000015E63541000-memory.dmp

Download