hxxp://google[.]com

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample240816-cc2tesyemg

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{5C16A3AF-4F5E-4478-8C18-BA08B9C28B62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1508	msedge.exe
1508	msedge.exe
2664	identity_helper.exe
2664	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
6048	msedge.exe
6048	msedge.exe
6424	sdiagnhost.exe
6424	sdiagnhost.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
5236	svchost.exe
5236	svchost.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6424	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
3740	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3096	1508	msedge.exe	84
PID 1508 wrote to memory of 3096	1508	msedge.exe	84
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 4580	1508	msedge.exe	85
PID 1508 wrote to memory of 1044	1508	msedge.exe	86
PID 1508 wrote to memory of 1044	1508	msedge.exe	86
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87
PID 1508 wrote to memory of 316	1508	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10477868292617241184,15313346372998197451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3fd1fc1bh9479h4e49h9b85hec59f17ca569
1⤵
PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x98,0x12c,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5751230929635194599,3303169578104779278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5751230929635194599,3303169578104779278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:6484

C:\Windows\System32\msdt.exe
"C:\Windows\System32\msdt.exe" -skip TRUE -id NetworkDiagnosticsNetworkAdapter -ep NetworkDiagnosticsPNI
1⤵
- Suspicious use of FindShellTrayWindow
PID:3740

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6424
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter AdapterGuid={BF346868-BD05-42FA-A56D-8134B2C1A7F5}
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6608
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter AdapterGuid={BF346868-BD05-42FA-A56D-8134B2C1A7F5}
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
PID:6320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\1612347604\2024081601.000\NetworkDiagnostics.debugreport.xml
Size 68KB
SHA256 1d5446198ea0d9347951010188001a39872e48e93ad4b7d2938bdd27b70830d0
MD5 e34ba4ea1bccd5a9f16c263a8bf8ccd5
SHA1 40aae438a0e7be8e84892973a0137b28e0190121
SHA512 cbc9a62dabb3397eb97895952b4c6addbef41910e5c11a39b0c42abd8e7c93b464efa98dc8a7a95eea374a2817169e9b27ea701c5f59faec638e6bf030d592b6
SSDEEP 384:s42oyJ5wWCsHD/RV/RB/RxGOA/zOA/wOA/5OA/H/R+LdA/bLdA/oLdA/xLdA/lCs:sV1NjPQDPhcq3Is4
MD5 SHA1 SHA512 SSDEEP

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\1612347604\2024081601.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0a49f79e2edc870f36b63602afba7fc5123fac6d3ff3860e62be21c9472fedb5
MD5 1d9babb9a2dccb41f32f6c6cdbc699e4
SHA1 8733c8f68ff9663f19ebf71e7c9a7b670d0bec27
SHA512 378c67805314ebe6aed14f2bb226e26be8577e305a38179592fad1523a51afc2b73149f59b8e934f3a429eb061d4680d6299644e4c82bdbd0f381df91152dc64
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9dbd423bcbd897c813012bf55c6b2b7db09ddd94980e8c1a05ad4f8a503a8b0f
MD5 521f87d5db350410e85aa207ea9254e2
SHA1 521d621159934f9eee4462bd7cdc82bbecff2270
SHA512 29402ee4eafe841b5d0c9d3121ba9991af91f028debcde60ce606f153d1b7d856060862c53bd16da20cff31c8054b8f0337e0134e2a00645a97667ce201b3b68
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 79736f1d0cbe3eeb247b885408bde19e5e3f96188247eff49df4e242a31e65ce
MD5 e898432746110e2a3081614a5b1bf913
SHA1 41037bf55e6166476ac1db50ee0be4fb93b0d9ab
SHA512 1062e0b10ed5bb2e6ffe3a05295dd5e20a001d18e0da8801a1c1e97fb4a9e8a6ce7bdada28a14970caa1ce8e0a122f706a11ef91b548fe6a01dd3d65060034c9
SSDEEP 96:nek8sQ/mp1Qtebwp7aWMoiTR5mdequcZ1NuM1Cq2vtfUWQyV+VD7AiEwb:nekiuatKoaWMTYucZ3uMoqSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7dc66393586981356efd30a7551e8de4b7019358a751f7e42e35bc1d040486d7
MD5 bc46f839f0516a1356dee026f55d95b2
SHA1 b7c2c86d7154f7fba18aabc0e08acca5399808d2
SHA512 584e10147df0e2dc5f1d48ca02206fcd36abe5c7c254bb423541d56b0e3335f4ca5ae7d1c4e1d2189e067e17c8c63a76e2de89c93e0b1797f58b872dea5a1869
SSDEEP 96:nekRop1QlEbwpvWMoiVmdeH2FtfUWQyV+VDCziEwb:nekR4alcGWMXCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa1806a1fd3e1bbb5332b07dc07bcf85b73310572093a46b7e419f9aa3c2e0a5
MD5 d6535855b8fd160abd4c1dc5af7611e8
SHA1 aff67ed0a0f82eecfabbce1021d1ac6bc1623b95
SHA512 af835e705e9fdd215318edb032389f4ca6667bbe9e77dbba9e0d0944e3717795e749a689a851317a0462f7665752a3677c65341e15fd50407dbbd287176d429b
SSDEEP 96:nekRFp1QlsbwpvWMoiVmdequcZ1Cq2JtfUWQyV+VD7AiEwb:nekRHalEGWMaucZoqsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 11ae6fcad6ec2dbe89f0f436f3a33b9a9385c0a1d820952e3e7072e4b0a75f2f
MD5 0ffbcd7f7020df15f2bcd4469d3332f2
SHA1 6955a3ce4122ef63d6d76c731fd84bd9dac8746d
SHA512 acd3df3944ee94320b1dfce9c2f220750719ffcf4002f3103ed555c5136609c9d6fc35550ca4bf495f48209a1eee6dedee83ec1d07922dc3d0aea7e533c57192
SSDEEP 96:nekRXp1QtpbwpEHWMoiVmdequcZ1NuM1Cq2vtfUWQyV+VD7AiEwb:nekRZatZvHWMaucZ3uMoqSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 271523daa551658e3a39fb5392646c73b2a5ec1fe3923f26af15f5547dfb604a
MD5 7a3fa53234bb235513a3114682fadf5f
SHA1 c2e7bf317c12314282108b27be836d3e6c317566
SHA512 e4406c73928bc9dcf1feddd7b78be219d83fa66d4ba53a46cc848902b2d7869ff1d072d281330fc91c0dee160efc8883efa11c83f428594aaa426b36c95b9b93
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583d33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d33.TMP
Size 1KB
SHA256 f889480023a79cc9bde1238fe023b9cc8b9df1d93c53f8ce454f065ed6ed7151
MD5 e00d497032f009be9f601d9780b65f1b
SHA1 52bc38d1dc120df09a1191852c144aedf296031a
SHA512 c9b86356b6570313ee8fef35a3ec51ad7cf1e80820963c84dc2445e4028515e4b6e2525932c49f2de96f973852c73d1ba30d36172504ce55b3bf0f6823ad6909
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5707b3381eb10875142911287ef3c8b6b9097c9cc128425f14ee9cc9362f9612
MD5 90908dbdfbcfd6638f3f87dbe323de05
SHA1 a848bfbcb8d7d2e5c2a05054737b95aadaf4c9ed
SHA512 5eace8cc8fc50e127eb77776355029444b3c64b17b0a9523d8d53e6e014b46cc41bca8e73645660a85d81b46927b4afd643c69fe5eabcebf01f1dd4b65526613
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRtJLM2RUkz64ru8z8ZJ9w7:89iIxuERzA83h09RZxY/nM4Pz8Fw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 92b29a57c6316985ec88c6d4a711f92daa05892913a34e9ddca210fd59a08fec
MD5 70d696bd1acfa82772bb89e31eabf939
SHA1 e3427213dfe4ea8aeea5bdd7c5d86b05b753e1c2
SHA512 8b31b1a8ca6bff69fb1c079c0f218da4f45568bbc530e6d8dfae932bab8a239c633f6ebbae645f2926be13aef6b25fc05c6b098fedc81d96ada60965d72b96b3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRWJLM2RUEzrvru8z8ZJywi:A9iIxuERzA83h09RZxYAnVvPz86wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fdbb5302fccbbc6014357dd4d17a40a899b0f17d01b43ee44cf6ba2aa542abf2
MD5 c2e9da11edb10ebff720e7a6391793e4
SHA1 02303628afa7f284d579eb196214d6f5de0599c3
SHA512 951f6de2dd3d2a169fdb698b8f9d534fe07886b80bfa51cfeaa715075a3e28d92902d7994938f3f4fb91e906bd4a8acf4f0b9a044776ce8616616adc7ee6ced4
SSDEEP 192:poCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRtJLM2RUkz64ru8z8ZJ9w7:V9iIxuERzA83h09RZxY/nM4Pz8Fw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 271265bee595ed6a4995dc2b097ae3fbd37c13d8b79f3060aa08ba7e6efbda36
MD5 4b2af4f354243a8e7ad38024ee3204d2
SHA1 3bc5a1faeb82b8f2a62bec7451a0a11ebcd4aa16
SHA512 ae33f8aede0a80ed0e6824f5834fb4b63aa41eb8739be988d0e960807bd1b480c01136bbf020e858c7e31e8e25b68d33fa74114f01e763cc3679aabbd5450f1b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRWJLM2RUkz64ru8z8ZJ9w7:A9iIxuERzA83h09RZxYAnM4Pz8Fw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1dee8a7b9814f664261382930b8a5c796a6943e9eafc68cfa023664aa43c6069
MD5 c71b003edb962bd1b6a274166334bde9
SHA1 3903893c574e6a58a9dd8221d46399a1e0cc18fd
SHA512 d7f7e44dace4cbd250dc1b63b9c2dbe6c989b8804e9074a18194d144392c5671b4dd34ec42ba6b1b7d6b72cf8a7ef14101cb35cccdab0b84e987147ef437a904
SSDEEP 192:ooCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRWJLe2RU6d6Bru8z8ZJ9w7:Q9iIxuERzA83h09RZxYAhwBPz8Fw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 23e12eaa423384bbd81099df1f0484967db461ef5a162e81c9d78c1994b2f4cb
MD5 ed634673c2cc6f4d717df8098a04926d
SHA1 0e9fa445e3e2ae206f578233a1e2206d15f4c2ef
SHA512 6027345c21fa926ca506f20b498cdbba02eb8d89e1a0ddc286ad34e964b2ddc88ee6539f28a93499f749e1997cdc2b80a8032c6c74c6a510d747e6c19d0792d4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRWJLM2RUcSO6xru8z8ZJ9Y:A9iIxuERzA83h09RZxYAnP0xPz8Fw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 35d82940feb6a1819d30b261f4569a28d7515d7aa464135f48fbc701b6156590
MD5 847b5821d9a1a2a0c331f4a19580f1fd
SHA1 ac7ab4a86171a1d1561079e46c6d678b1d04a39b
SHA512 95027a701b4d763d7050f98de13bbf36b49cd6baab08ab85f3213fd68f78714c0ff873b2a71e6fdd2d9e5115499b6c44f949fd01e4b1eb5e8c922a39bcc62b5b
SSDEEP 384:09iIxuERzA83h09RZxY/nFhbpo4Pz8Fw7:fIxuERzA83h09RZxadpo4PwFw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_kaiflhyz.h4u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kaiflhyz.h4u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\NetworkDiagnosticsTroubleshoot.ps1
Size 25KB
SHA256 e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
MD5 d0cfc204ca3968b891f7ce0dccfb2eda
SHA1 56dad1716554d8dc573d0ea391f808e7857b2206
SHA512 4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
SSDEEP 384:UlSoNnCiXTShob5bbVbgWT6rZTvxlBNexTKmh+xdxBUNQGJ:GSo3h8Jq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartDPSService.ps1

Path C:\Windows\TEMP\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\StartDPSService.ps1
Size 567B
SHA256 d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
MD5 a660422059d953c6d681b53a6977100e
SHA1 0c95dd05514d062354c0eecc9ae8d437123305bb
SHA512 26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
MD5 SHA1 SHA512

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\UtilityFunctions.ps1
Size 53KB
SHA256 3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
MD5 c912faa190464ce7dec867464c35a8dc
SHA1 d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA512 5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
SSDEEP 768:AaDgc60FE2UMeV6HQEqEVBWMBaRNdKdNh5BIW6Mk7svkxtFJuAQQW:j0a4bKcW6MkcSuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
MD5 SHA1 SHA512

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\en-US\LocalizationData.psd1
Size 5KB
SHA256 0637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2
MD5 380768979618b7097b0476179ec494ed
SHA1 af2a03a17c546e4eeb896b230e4f2a52720545ab
SHA512 b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302
SSDEEP 96:iLsmw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:iLsZklGeKxGfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\DiagPackage.dll
Size 478KB
SHA256 5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
MD5 580dc3658fa3fe42c41c99c52a9ce6b0
SHA1 3c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA512 68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
SSDEEP 6144:0ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:0ZFLUe6vJ/wLIvavyfEvJ/wLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_4b20e2c2-d58f-47d8-9a0f-f05ae311c857\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
MD5 44c4385447d4fa46b407fc47c8a467d0
SHA1 41e4e0e83b74943f5c41648f263b832419c05256
SHA512 191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
SSDEEP 96:+mbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3+S:+mx1xyexdXeoR4gsgKvHWlTWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5236-863-0x0000018A327B0000-0x0000018A327C0000-memory.dmp

Download

memory/5236-860-0x0000018A32780000-0x0000018A32790000-memory.dmp

Download

memory/5236-867-0x0000018A32F30000-0x0000018A32F31000-memory.dmp

Download

memory/6424-827-0x00000204DAC70000-0x00000204DAC92000-memory.dmp

Download