4b83a2b6275340b94334cef3564725d551d1436005d1f4554931cec67b3b6678

Resubmissions

07/11/2026, 15:00

261107-sdapbsy1by

07/11/2026, 14:55

261107-sagcpsfb937

Analysis

user interaction
yes
max time kernel
72s
max time network
69s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 28.8MB
Sample261107-sagcpsfb93
SHA256 4b83a2b6275340b94334cef3564725d551d1436005d1f4554931cec67b3b6678
MD5 09bc518fc2da83272ac4572bd1116238
SHA1 70c03b8c6f50dd6d490e69e0e1ea920051cb25ef
SHA512 e050f43e408157628cada1565366a0b943556e4b014a95db7f6e05f31a6c2eb18a949a414ece3292a33ff16c449e4fda382b406748e14176e962ef609825f318
SSDEEP 786432:6kRb9fFFnUL5novB8+4ZV2td0JZUW69ApL15UdBot+y0Y7:6opWovBsV2wZQ9AP5UTot+yf
TLSH
T1966733148C65C4F6CA17097614E7C7BFB93E9D0C31BD504FB6DB3A2A6D2231AAC44B89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5988	adb.exe
6036	adb.exe
5168	adb.exe
3860	fastboot.exe

Loads dropped DLL 9 IoCs

pid	Process
5988	adb.exe
5988	adb.exe
6036	adb.exe
6036	adb.exe
5168	adb.exe
5168	adb.exe
3860	fastboot.exe
3860	fastboot.exe
3860	fastboot.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fastboot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5940	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{BB2CDC9E-AE4C-4808-818E-82C4222B0485}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5940	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	taskmgr.exe
Token: SeSystemProfilePrivilege	4536	taskmgr.exe
Token: SeCreateGlobalPrivilege	4536	taskmgr.exe
Token: 33	4536	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4536	taskmgr.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4712	1732	setup.exe	89
PID 4712 wrote to memory of 4228	4712	msedge.exe	90
PID 4712 wrote to memory of 2992	4712	msedge.exe	92
PID 4712 wrote to memory of 3568	4712	msedge.exe	93
PID 4712 wrote to memory of 3568	4712	msedge.exe	93
PID 4712 wrote to memory of 3568	4712	msedge.exe	93
PID 4712 wrote to memory of 4952	4712	msedge.exe	94
PID 4712 wrote to memory of 4952	4712	msedge.exe	94
PID 4712 wrote to memory of 2104	4712	msedge.exe	95
PID 4712 wrote to memory of 1332	4712	msedge.exe	96
PID 4712 wrote to memory of 2104	4712	msedge.exe	95
PID 4712 wrote to memory of 2104	4712	msedge.exe	95
PID 4712 wrote to memory of 1332	4712	msedge.exe	96
PID 4712 wrote to memory of 1332	4712	msedge.exe	96
PID 4712 wrote to memory of 4288	4712	msedge.exe	97
PID 4712 wrote to memory of 4288	4712	msedge.exe	97
PID 4712 wrote to memory of 4288	4712	msedge.exe	97
PID 4712 wrote to memory of 4284	4712	msedge.exe	98
PID 4712 wrote to memory of 4284	4712	msedge.exe	98
PID 4712 wrote to memory of 4284	4712	msedge.exe	98
PID 4712 wrote to memory of 464	4712	msedge.exe	101
PID 4712 wrote to memory of 464	4712	msedge.exe	101
PID 4712 wrote to memory of 1804	4712	msedge.exe	104
PID 4712 wrote to memory of 1804	4712	msedge.exe	104
PID 4712 wrote to memory of 1804	4712	msedge.exe	104
PID 4712 wrote to memory of 2108	4712	msedge.exe	109
PID 4712 wrote to memory of 2776	4712	msedge.exe	110
PID 4712 wrote to memory of 4688	4712	msedge.exe	111
PID 4712 wrote to memory of 4632	4712	msedge.exe	112
PID 4712 wrote to memory of 1564	4712	msedge.exe	113
PID 4712 wrote to memory of 2776	4712	msedge.exe	110
PID 4712 wrote to memory of 2776	4712	msedge.exe	110
PID 4712 wrote to memory of 4688	4712	msedge.exe	111
PID 4712 wrote to memory of 4672	4712	msedge.exe	114
PID 4712 wrote to memory of 4632	4712	msedge.exe	112
PID 4712 wrote to memory of 1564	4712	msedge.exe	113
PID 4712 wrote to memory of 4672	4712	msedge.exe	114
PID 4712 wrote to memory of 2884	4712	msedge.exe	115
PID 4712 wrote to memory of 5116	4712	msedge.exe	116
PID 4712 wrote to memory of 2884	4712	msedge.exe	115
PID 4712 wrote to memory of 5116	4712	msedge.exe	116
PID 4712 wrote to memory of 5524	4712	msedge.exe	117
PID 4712 wrote to memory of 5524	4712	msedge.exe	117
PID 4712 wrote to memory of 5140	4712	msedge.exe	119
PID 4712 wrote to memory of 5140	4712	msedge.exe	119
PID 4712 wrote to memory of 5140	4712	msedge.exe	119
PID 5816 wrote to memory of 5928	5816	cmd.exe	124
PID 5816 wrote to memory of 5940	5816	cmd.exe	125
PID 5816 wrote to memory of 5988	5816	cmd.exe	126
PID 5988 wrote to memory of 6036	5988	adb.exe	127
PID 5816 wrote to memory of 5168	5816	cmd.exe	130
PID 5816 wrote to memory of 5260	5816	cmd.exe	131
PID 5816 wrote to memory of 3860	5816	cmd.exe	132
PID 5816 wrote to memory of 5324	5816	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://androidp1.ru/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fffe949c188,0x7fffe949c194,0x7fffe949c1a0
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12466891519758338494,6842821715482394378,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16579171944460824508,8747742101136347967,262144 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,952077847343039154,2710335706236644445,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8216063267939730418,3852198917685422898,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14294260441403603081,14899372228825061142,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,13854813983288343842,4737895069004341421,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4072,i,4468300901876939376,7810300352261013207,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:2
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,12789104918658309412,7750270843219703496,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5256,i,12283102415025138716,7216213921287876760,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,2324339304997704489,12590267100004090305,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,2324339304997704489,12590267100004090305,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5008,i,3898722414925918910,6513066545785017320,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,10432254162351108402,15112331921264385339,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10872492878785066770,10718989666717486220,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,1720984490649724504,15760573287495320972,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16406968454846038162,1874107257051177016,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,123840102027822451,14666314764615879486,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,10223913147935784329,2511990644023782296,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12798460183807678960,9065106421575354160,524288 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6440,i,17437198649508926242,10638293704592588954,2097152 --field-trial-handle=2516,i,10294946188195844644,12125307282405432637,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
    3⤵
    PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\adb_run\bin\adb_run.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\system32\chcp.com
  chcp 866
  2⤵
  PID:5928
- C:\Windows\System32\PING.EXE
  ping -n 2 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5940
- C:\adb_run\bin\adb.exe
  adb start-server
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\adb_run\bin\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 612
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6036
- C:\adb_run\bin\adb.exe
  adb devices
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5168
- C:\Windows\System32\findstr.exe
  FINDSTR /V "of" adb_devices.txt
  2⤵
  PID:5260
- C:\adb_run\bin\fastboot.exe
  fastboot devices
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\System32\findstr.exe
  FINDSTR /V "of" fastboot_devices.txt
  2⤵
  PID:5324

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15b6ee58-c538-4ab8-b3d9-38647cc72e96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15b6ee58-c538-4ab8-b3d9-38647cc72e96.tmp
Size 8KB
SHA256 1a9c9864903083673d9fff03bd2866a0e9e8367b6a7df508c632cc385f9a1027
MD5 329fc97f9977176bea82085fc2dcdacd
SHA1 e9b6c9405d95314d577e1f0b876821f929059ee1
SHA512 a94f36febaede4a027152e7b18ee403a9dc74958fd119a3b8fc7dcf08d6f4530e24ca4d556cc044e852ae43b50e3bebe9d17a30a149dd8fe7b4a306fde7bdba3
SSDEEP 192:vON66ILecQmiUyhhvW04Wys/1lC7s57a/SU6:vON66yFEvW04Wys3COeSU6
TLSH
T1E902FA35AC7D787B8EF3AE45B4473B17AEE4112BA9952F84DAD81A1C00DB68C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b27dcc8-bb22-4a91-b90b-cdb678702b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b27dcc8-bb22-4a91-b90b-cdb678702b90.tmp
Size 8KB
SHA256 8fee46ebbd74387199cf8ebb69d7eaeb5c64b05fe5648a55a9be62fe9ea5d924
MD5 2c5c8c0fd2c4657af0cd52f7ebbbbaac
SHA1 43de765a592dd74710bf7d89ef6f6fdebe313b2c
SHA512 d6e58ac5ba73bd0a3a857250ac51e8bc070fa66afc63205a35cd23ad3cb8f42fbee95afcc20e00a75b7e35bf1ba00d3661d76a5062b8fc7a36ac1bbc0e05776e
SSDEEP 192:mONL6ILexQmiUyYhqW04Wys/1lC7lGw6+2fJNI8qh2U6:mONL6yWpqW04Wys3CpGd+2Y2U6
TLSH
T197122A31A87DBC374EE3E145B4873B179EA4216BA9856F44D5D84A1C00DB78C270F626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66289273-c7f6-42c9-bfc5-fd5e2284f242.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66289273-c7f6-42c9-bfc5-fd5e2284f242.tmp
Size 18KB
SHA256 b94bfcb685926a8455020de2c952aa3e270259304a5c58ca3f4aaa7b2b91b439
MD5 b6fe465bcec167073e941a84837a18e6
SHA1 ad3c44e4e7627c98a500cf0562367795de0bafb0
SHA512 7b076a4f510b64bf434af89eaf694919944d376d7d0a55e836af895dc3cc102c1c29d1877c491170dff8cbc8b04ff8af6d6aa1e83d809fb04d5083c890a99245
SSDEEP 384:nPQkUSv0sNqkrTJwo36QOP04Wys3CpGd+2u2H7vBEnngIIlx:R0StMWxCpAlu2H75EgLn
TLSH
T15C826C71A87A6C370AF3A205F14B3B53DEB4A16BD9C41F44E5D89B1C00C768C374BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ae3cdb4-92ff-42d6-9654-e88643950dc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ae3cdb4-92ff-42d6-9654-e88643950dc7.tmp
Size 22KB
SHA256 09d1abc7815cf16d742c3035a7b903d1c9047510f5703c7d9b45df8927096093
MD5 a2634d88a93415538c5269ced6830074
SHA1 9e32561c2da6c93a3b928f4260e53c1da6d70441
SHA512 ae955e3d26632d22d720605a184fa98da4f6e48998d126d822239d2d6abdc94b7b127b8812e899ce3156ba121d358d372151b53d3e1805e877fe8e8b2c843346
SSDEEP 384:ncQkUSvnsNqkrTJwo36BOP04Wys3CpGd+2uyce/pcvK4XMPoH7vBEnngIIlx:cnSuMWxCpAluy/gK4XMQH75EgLn
TLSH
T1DFA2497C9C792C3F09EFBB08A10E3A279EA4923BD0F41A58D7885B1CC0B7548F346616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

385c37fe-0f33-4155-9a14-31519dbc1fb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\385c37fe-0f33-4155-9a14-31519dbc1fb5.tmp
Size 105KB
SHA256 53485fcfaed759b3ae05094c9f1150d6e1c50d1a0e9bb27d696de6d6429b7818
MD5 a7d2cdb3119dfd7ea29822c54c6f0ece
SHA1 5b850ca662487e25232f620f16facbc61444c635
SHA512 aca78959fe95451863b05890fcbdb6ec48b6a9aef876ca4090e16c304335e69a8463c92279dc8c0d579a8aa17f77bb22b1c391863085832d28715efd806898d0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f349e7fa3f2d116df801eec298d7a36538858fa5536541a4e5a5e829551dfc24
MD5 bf24fed1a983cdec1a8fa7b5f52a20e2
SHA1 3a4be58385305e0c2ae36df109c56ea3fa8bb1b4
SHA512 4eb7ff8b9f16fc5befe6b12026cc83a3d85ed02629b3310a685b3e978bb6d51961d5446c9452931fd600891fd21b51203a1b4e6d1227e7674837b3629a5ce9eb
TLSH
T11CD02BC9D5843840C8233438117B4319314CDC40C803110658D8925188C2D830510860
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 793527cf075279f9c06b727aee62d70ea19bd6b5ad7439caec07bc18b4d35a36
MD5 9208456925785ea73b305f9e1813d1ab
SHA1 c2c9ba50cdd71cd0220812b1213d2ae0cdb608d6
SHA512 27759fd67fe8d40ae6ed58464cc270e57b2062af273342e4f9940eae10d9fe55aabdf88976d94aed560a0f7d227a2abb3a70d383bc3edcf8e8a1de18b17c26ae
TLSH
T10ED02BC9D5443440C4233438117B4319314CDC40C803100558D8925188C1D430510860
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 068cec9305efc10b578747be1b251cbc7b4e0ac38cb97bb2baa60d786b5b94d5
MD5 94fc76cf363794cea1718459ca7ebfea
SHA1 a6b94f9e5954077e0d42a1d75989448229c51a2a
SHA512 1c67e56376ff2f515b4e12171d3873aa5f7701b68a6417235286670800189383d8a7b6f63b197b61fc760810a78791c10d42c6169cf53848bfbd2ff8b5eeb4a2
TLSH
T176D08096B9163DDCC57F317515B996445514DD53C51001051A0E9D14DAD44431C51DD8
MD5 SHA1 SHA512 TLSH

Submit Download

0f03c40f-d21e-4f10-92aa-8850aa8a62a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f03c40f-d21e-4f10-92aa-8850aa8a62a4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e30b987-e7e4-4f69-a45a-925700be055d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e30b987-e7e4-4f69-a45a-925700be055d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6f2032be-f52a-4f39-bc83-e7125b79fad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f2032be-f52a-4f39-bc83-e7125b79fad5.tmp
Size 10KB
SHA256 b1b218c030c360691c7af642b44982591bb89ea2e6cf4a7a9bdf5f469b21c82c
MD5 b5e3cf847bef56e8204b23da747c39d3
SHA1 6714b268472d214eecf9473668788b4808ecc16b
SHA512 0074989e4934b23ab1f810416773933ce967090aa83708faad386323245f7a145313dd53617f515f702403ebdd7e1cd5124f6b7b60a79f86e67a9abcaeabc677
SSDEEP 192:sxZARmsv/fGsnNTU1/IdpBZH/96+WN7/N/Y/kNg7Ig4J:sxZAxv/fGsn1GwDHeB/Yc
TLSH
T14B22E9226E34B97B9CC7E219BB257B53D6F55032A1D41E48E6FC8A1C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79fcefd4-e04e-43d2-9f69-1e7a6cc34fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79fcefd4-e04e-43d2-9f69-1e7a6cc34fe2.tmp
Size 11KB
SHA256 bff1f728eaa34af77e71af02a46b8f48ac3e762076d869b69d1bff07f00d8f72
MD5 b379ef3c98149676117e7d1a92f0e1cf
SHA1 2312d5a8db9eca9e76631a22dda1248937e4d729
SHA512 c33e48abc78051749ef3d1bd4d6de36def348588ac859e37b5f64840039bba2083b7662bc3a7251ec962e8683fe8d9a4801447be2bc641e82fe4c488463814c8
SSDEEP 192:sxZAR5Zv/fGs2WpVhNTU1/IdpBZH/96+WN7/N/Y/S51xIgyJ:sxZAxv/fGs2Wvh1GwDHeB/nO
TLSH
T14F32C7226E34A97B9CC6D219BB657F53D6F95032A1D41E44E6FC8A1C01E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ae596a2-8121-48df-8dab-3218a0c269b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ae596a2-8121-48df-8dab-3218a0c269b6.tmp
Size 32KB
SHA256 476ec527b788fc8a216cf14ab6cb6579caa73e124848793cddacadee4d7d02be
MD5 ff6c862a0b1f72f912847c51a41664bb
SHA1 889269fbc8cdbe64d49cf591d3448ec381f6daf8
SHA512 5748807b596c4d72bfb06e040b0fe2cd91cd0b8e1a1c8b8a3f2d103207660ce1428acbb65b1a09bb55181bd22c20675cde110953f89dbd484d935b17d22c0e30
SSDEEP 768:z3mtKBk7pLuLj4IWvEgCc8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/KV3Llztc7wroI:z3mtKBoEj4IWvEgCcu1jaKKV3L9O7bI
TLSH
T10BE2EA7B780CCB7E4FC00A9DDD2A7F9F6DA8028B6698894087F9945C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 22b55d39d8f0d7cf5d8690c385eb4c4f45527b8d6c94b310b9aeac45da52c234
MD5 0261ed761b93d2c0fe37efcd58b8595c
SHA1 081b4e5092a3e389311e489e3c25390a369ac6a5
SHA512 dccb2b56f586e6ca61be64208b928eabb8d52f7b4fe4d41a4c98ca3d95e85c1345206c6125c628a1f84da2f8f4cb10541d8be2563292c0aafac2a570847901d4
TLSH
T16151FC455B604D80C7F8D5BCB1DCD08B363151C96D833D5FE1A8D4BBAB82F2A413A478
MD5 SHA1 SHA512 TLSH

Submit Download

4d977bc8-9c2b-48ce-870a-8826bdc1b1a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4d977bc8-9c2b-48ce-870a-8826bdc1b1a8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0558e936-d91d-4978-8ddd-447e536a5264.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0558e936-d91d-4978-8ddd-447e536a5264.tmp
Size 1KB
SHA256 de2e62f8e06292ea741392da030449ac71ae4d312b7ae26cbc81a4b59a56bfab
MD5 2c1bddce32b0011515802bd657fbd6c9
SHA1 6c29b6e374333b19decf94318db14fc307e3c25f
SHA512 dc6d5fbc72ce075c43942cf6c3746b649045dafe829fa95e75c9da2efb0a7c2c3519390aeb022194b14d43af9cc9f054327b42917c39e72633b6e6d8c99937f2
TLSH
T10E41DEF3C6E8866E891156F0AB287E2BCE1D0A54932C3D5AC8E4EF1B93F2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

19053c02-d61b-4999-b767-fd45b61f95d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\19053c02-d61b-4999-b767-fd45b61f95d9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba3e61f66e68c95cd5af8cb548e0758938a16e5fddaee5f5422a30f2a17a019b
MD5 38050ab3dec18179c66982dd5bbd678d
SHA1 b0148a32e638642054d330d9fc95e1c21ffc2612
SHA512 32dcab31712e5c8d3de7296000a6becbc955d31593b497fda04cf0c93974592a98339a74321e45b730b815df37a55e3f20be57f191ee27a16ac036b4d161bdea
SSDEEP 48:K+zivjZtRkhtYPIY7kKXBPxkrD0y4ZD5yJbsvLJlBs5VC3IazsK/5HBsb780CZbh:KUsYKxy6iowKh+WyuoKHK8GEKv6L
TLSH
T1C0A1525531FA0600387E2C089475876E5A8272B73039E76F7FBC85A28E66E041FFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9c9b7bc7-83ba-49a9-ad99-121ced2d20de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9c9b7bc7-83ba-49a9-ad99-121ced2d20de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac5e2a9f4d6bc8a7ce9ae20ffa63812ccedb57ac0ca33aec2e41045c45e7aae8
MD5 919468cb702e294084056c26cd0d738d
SHA1 c9bcd5a6ac38ec880c4097ee778e2e32be2f3ad1
SHA512 812a9053b23191fa754e22c833668e802235e4aa5884b83f7196370168cfea554123ba1f815a4debf79dd66a0cf15ffc478ff78798527a774dae5e7bee9c4334
TLSH
T1D3413758AAE9115CB3B76F16ABF665AE447BBC372F06C45D00110E4F0663A40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 8.0MB
SHA256 bbf9a9ba639ea0d2bfd93034acce8bd3edf0e9ece7704f232dc2b38b4f517dc3
MD5 8d4caa01341051771f49248368a5faa8
SHA1 b696525872ad07f1099e52512782d6cf6c20f162
SHA512 2cd2b4911d0c71b21d000b8312abd12575c9766ae54e9a01d3f81eed379f8f6c4ad2df0ecd1829a1ef1520e43913c2fece69c83c3e8c95c87d1f293da660a387
SSDEEP 196608:Osyb98NQTorjfntf8+CtZV27JdRtH9WtCNILvjV7CtZW:Os+94sov/tf8+CtZV27JdRyJZL
TLSH
T13C8633D8CC9984EDCB0B953DA4DA9D3F4D321918327C2A8FE63A9F361F04B45E05C696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0003.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp
Size 4.6MB
SHA256 3c5f6e0d49858ac08ed3542656208f99b267b65282a9fb1106f17172d8ac8898
MD5 3af28059d6d4961ce01dd536133f23f2
SHA1 766a128c0a8c11be396929271be491053cf54893
SHA512 e05628e5b8931807e67308b11e2ac7292ca8123f0beae197e14217750f0da47dfb08fd5c0c2235e9fb8657d52bf3bfc757605b30dc513580722ad0f52146b1a4
SSDEEP 98304:yoPeWa0bF9vWR3cWcXH1gWObOx9Enx4MkITpEk+GPsYk:BPez0HONcfCbG9EnustEk0Yk
TLSH
T1D6263328AC2320F3E64E1AB006F157BD9F5D4F25A71ACA26788F91C7D8332DB1D45E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\16.tmp
Size 780B
SHA256 ec340814e058661035e997f771b8675f010e0d7dbdf008589883d7a57819a8c6
MD5 8f2a4325fcc9e80218fbe0c969ca787d
SHA1 9773b7e0328c50ac3480980fcdfa44ec257feb55
SHA512 47f6f234f379e03903548f389a772c38508e25bdef85fe14e9f5a8e1c8daaf6502bb128a1ad7b637d725e2c7347050a99fef06e16074162e2a671244f2819521
TLSH
T18101F584DC282A8F150A09AD4B6B524507CE805EDCF6D491619F9683192FA5E23A3857
MD5 SHA1 SHA512 TLSH

Submit Download

5.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\5.tmp
Size 159KB
SHA256 c9dfcce375493796fce5d600d6a2885e7907af26891b8bf016fb28a0e3ac215b
MD5 0387bcbbd0ca42af9616bd264e3e47a5
SHA1 8107b6c7caa1af7a0170aa68f1ab2bc65197e388
SHA512 f6410bcebfe4af9025792fa85c44b92d8ffc29f8651b1bda4819122d5a5461c546fa1757ef5bec833651a7b17aa8c7a1c2dba3ed3a40be4e4168946a11cb7d92
SSDEEP 3072:0BGdUViRH0YRYxzEfabsiPeq6IjEKqjo/GwKK+OCO:WGy+RYciPTdV/
TLSH
T1E1F3DB726690D53B9CA89ECDE46FEA6883526B40787CF249BF14B3651FE33E5C863401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

028c975c-f0c6-489d-a09e-fea20c9cde68.tmp

Path C:\Users\Admin\AppData\Local\Temp\028c975c-f0c6-489d-a09e-fea20c9cde68.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2d5c82d5-c1b9-4272-9cb2-765bafb7844c.tmp

Path C:\Users\Admin\AppData\Local\Temp\2d5c82d5-c1b9-4272-9cb2-765bafb7844c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

652ab80b-3ec0-4e2a-80fb-02b14475384a.tmp

Path C:\Users\Admin\AppData\Local\Temp\652ab80b-3ec0-4e2a-80fb-02b14475384a.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4712_976915147\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4712_994074357\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adb Run.lnk

Path C:\Users\Admin\Desktop\Adb Run.lnk
Size 1KB
SHA256 fe974e346def5a0da6cb553975468120a0ee62e6c9e5128ac9296dbc9dd87ebf
MD5 3f3929942fbe4acd64d7701bdc980a05
SHA1 905a95d592bf6d2ef2fd4d48e57ad9df7ffa65a3
SHA512 6a96f9c97c92439b2aefa633393df4e6f408046d044e7875ee9346b32098d88ef029dedddf5a7262495a874c2686cbbb7b6d1ec24f355ce42b0f276ead0def83
TLSH
T1CA31492212D90F42F7F3833A44E1259596733DD6FE72E608A041D2C9443C34C9D05E79
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\adb_run\Uninstall.exe
Size 110KB
SHA256 3a58daef692dda2061bb85c58ce84c2f4f281ef5921b29f22d03f498f5cb82e2
MD5 671540a555fecaf55e5bebb9831aceca
SHA1 407f2d4272d58e5b8f325e6b14af465edbf4b9cc
SHA512 2b00a22fa4a34b6529e9696420f7251cd1b4ae12b430d701f673baea344137798f53ffd2284612abaf4130a5d5dc345f3d0559dcba58893f7af77649d07993be
SSDEEP 1536:xO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45oDFn24Zk:+zgjO/Zd1RePDmZ8tf05iW4u12ek
TLSH
T14FB36B42B581C57AC42135F94C46D33AB63DBE442A6924A3F2BC3D09DE39347DE4729E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinApi.dll

Path C:\adb_run\bin\AdbWinApi.dll
Size 95KB
SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
MD5 ed5a809dc0024d83cbab4fb9933d598d
SHA1 0bc5a82327f8641d9287101e4cc7041af20bad57
SHA512 1fdb74ee5912fbdd2c0cba501e998349fecfbef5f4f743c7978c38996aa7e1f38e8ac750f2dc8f84b8094de3dd6fa3f983a29f290b3fa2cdbdaed691748baf17
SSDEEP 1536:Jwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCP:JwqD3L8Tezq0et+ui1y
TLSH
T17BA3592138A1C172C8D261B90AECF76193AEF4B10B3599C7379803DEDD653D25B7528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinUsbApi.dll

Path C:\adb_run\bin\AdbWinUsbApi.dll
Size 61KB
SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
MD5 0e24119daf1909e398fa1850b6112077
SHA1 293eedadb3172e756a421790d551e407457e0a8c
SHA512 9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
SSDEEP 1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p
TLSH
T1C8534B227991C072C89661B909FDE651A27FBA601BB184C7779C03EBED303D1AB79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb.exe

Path C:\adb_run\bin\adb.exe
Size 1.5MB
SHA256 a3887975396c74b6d4bdb49d2030881165e09b4ed89b0c7bbaf4b821d44d4643
MD5 dec7e5e645aded51f9d7f02d60e9ed41
SHA1 5add4f1e70e54211f66bcb0983666cc81fb161a7
SHA512 d612e6f78ce9f7991809db8ca2ec185c45d7cf6da4a85a5ff62191ec5f3a0796fbb5ca4c0c3b4ae01409c678bccfa2b38ba5578f2ae5bbc6c7e92eb86faa4a37
SSDEEP 24576:IDTqd1ggU0a2eoKk/8Ek3YjVH1YlvIEbe6eOUactdf8tUQF38xbkZhAlpbyHZj:IKbvNYejEeaedf8tUQF33ZhEgH9
TLSH
T158655B59FB4384F2EE2719B0418BF7BF5B309A128431CDAAE25CDD44FAB3D52141D62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb.lnk

Path C:\adb_run\bin\adb.lnk
Size 813B
SHA256 25d402113476d256c301779312673ee142f7df6fa03dfd46e6740807e23d6c0c
MD5 b3a59581a14e6804365aba6505a4aed1
SHA1 e40a0795d6cf382a21edfa3557cfd9e3ff8c4664
SHA512 250c77759d4277a46e8a0bdaadd3d590483f31d8a00f6b580b69dc81ced839f270a3b6550a63b863ef41b6dbe12e2900cd4629c67233d24dadde224819591f8a
TLSH
T12501623727802C7BC16302F1847B62D287269F8172DAA62450D8220C0CB412DB5BED9B
MD5 SHA1 SHA512 TLSH

Submit Download

adb_devices.txt

Path C:\adb_run\bin\adb_devices.txt
Size 28B
SHA256 bbfcc7239a6f1be3544814ebdc6bcc9b66bf5b1f0b03baa3340808f19265a630
MD5 7779b1a7ddea5e4c09d9354c2d534e05
SHA1 8d1960397c5ed3ee85f6364da20918ef71e7a374
SHA512 f4721e1e90dc856625ece9b73a86469cc55a28722e17cf7021174dd758b8824d8d86a8dd3077e59d98b86faefaccc046c27a51b6f738e2bda2ec1c637dc57a2d
MD5 SHA1 SHA512

Submit Download

adb_run.bat

Path C:\adb_run\bin\adb_run.bat
Size 73KB
SHA256 89d6b792f4df7f4915d38fa9e41a8680b7b2f07aafa225f33582e2f1f095151a
MD5 5ca98be0fbc070de23d9ec0919799fd4
SHA1 5ece62ababff513de3d60bf71e22bcdd34cd5554
SHA512 003234b8091f106e0ca1b19c689d082d2103e5d6d2cbc526bdcade3a828af2f2f01a3cfd7cf1bf03fb38b369c6effa989b63f636a82c6d3efe66d5dea020498c
SSDEEP 1536:+NXaliF0oWXe5sfhCi9lZ+0n3ZLmvHB15r7Vd4ec8SKz4XBpy:FthGB15r7Vd0I
TLSH
T15473B729B6524150A0F8FD779933D02DE961E103DFA63927356FE5F8BF083E83261899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastboot.exe

Path C:\adb_run\bin\fastboot.exe
Size 793KB
SHA256 8e2be00d58d7c5792c3c57033184b61406d73ca2effa5c65f1706488b9cc6cdd
MD5 cc023bc3427cbdfe115a7f32084b8272
SHA1 8001041baab24f223c12e82e831c136d1bcd55a6
SHA512 988eed99d2e30afbe4b3b9428ef7cd4b63d152fc992667d14eda277f1c918fc7b11f7ad91482903fee8f0db8fdaa013a51d5db710967e1253adad784c3e47141
SSDEEP 12288:zvTh+DSjIPxE5tL7nSBCB8suybLHUtwSDCEngiYrxhfpTBFBkJmR:zrED4IPxE5tfSBCB8sPUtooYrJTXBkO
TLSH
T188054B66E74394F1DD2306F1058BF7BBA621DA0580308D6FF68CCE98FBB2D62245D265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\adb_run\bin\libwinpthread-1.dll
Size 138KB
SHA256 83d6e9cb6151c9ecdb330ed9ccda7cab7f27e5f1585d494954526a17ff69d02e
MD5 27b901bb44c6e3417baeee03c9cdc4bf
SHA1 2f5722cb450b98159ed7caa3565ccac1e06cbe0e
SHA512 392f6f68e0f4ce6d46b269c21a5c02ecec694e4beccc539e2bcb707c7f5b21699e98ade45f0b4467f0922ebc4d996c2efe0c3ef893bba00782ef280e4f249ba0
SSDEEP 3072:2p+MAuGh9AoiIimcY6IA0rsuF8zOufrd4Jw:2pchr1imcYr/suF8zxrd4Jw
TLSH
T146D31A95B3659CFBE912173E05D7D397213DF38406438F17AE34AC3AEB2BA44A98414E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1732-125-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1732-0-0x000000000042B000-0x000000000042C000-memory.dmp

Download

memory/3860-736-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/3860-737-0x0000000064B40000-0x0000000064B65000-memory.dmp

Download

memory/4536-718-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-709-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-717-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-716-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-715-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-714-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-720-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-710-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-708-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/4536-719-0x000001B4DA6F0000-0x000001B4DA6F1000-memory.dmp

Download

memory/5168-726-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/5988-721-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/6036-738-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/6036-740-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/6036-741-0x0000000000400000-0x000000000059A000-memory.dmp

Download