xorium_stealer | 19347dcc84a97457827768b7b0fc0cd8ff1a1997c8b62b21a7f899ee2d72ac38

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Updates/GFM-PO-2026-21379.js
Size 81KB
Sample260605-ph549ae18t
SHA256 19347dcc84a97457827768b7b0fc0cd8ff1a1997c8b62b21a7f899ee2d72ac38
MD5 6058e31ca94a480883988029c41834f4
SHA1 e613a718e5fb99fcf6e6ec1b9372c8a9e6deb3c7
SHA512 5ddc710e91e682f4b492d1c4743c862952df8b2c70de77842e7c3fcedf73931623f695c9067ce5478d29dbc2d6ddc77ab3b6a283dd04cdfcc77ac25fb39388d4
SSDEEP 384:ol98fyDjUCZxX850AsFBWaxLUA5bTfaXEg1n+NXo4XnHBXfXNip1MO83RwQ98i5g:m98fyD7XEoHE1eF3yWFeX3ACWDO2F+
TLSH
T178831ED0E106E584B56F2BDBC5C134C9D18339ED360FCE4A4534B57A22B95AC2FA889F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xorium_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/grere856-lgtm/super-happiness/raw/refs/heads/main/svchost32.exe

Signatures

Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
stealer xorium_stealer

Detects XoriumStealer payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001e00000002b427-551.dat	family_xorium_stealer
behavioral4/memory/3932-559-0x000002A2E7D00000-0x000002A2E7DFE000-memory.dmp	family_xorium_stealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4800	powershell.exe	90

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3080	wscript.exe
25	3080	wscript.exe
48	3080	wscript.exe
51	3888	powershell.exe
53	3888	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3888	powershell.exe
2956	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost32.exe	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3932	svchost32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
48	raw.githubusercontent.com
53	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1656	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2700	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251359379047904"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{02D92016-5A94-45BF-A606-BFCE700E4F25}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2956	powershell.exe
2956	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3932	svchost32.exe
3932	svchost32.exe
3932	svchost32.exe
3932	svchost32.exe
3932	svchost32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	3932	svchost32.exe
Token: SeDebugPrivilege	3932	svchost32.exe
Token: SeDebugPrivilege	3932	svchost32.exe
Token: SeDebugPrivilege	3932	svchost32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2956	3080	wscript.exe	80
PID 3080 wrote to memory of 4492	3080	wscript.exe	82
PID 4492 wrote to memory of 3176	4492	msedge.exe	83
PID 4492 wrote to memory of 2700	4492	msedge.exe	84
PID 4492 wrote to memory of 3684	4492	msedge.exe	85
PID 4492 wrote to memory of 3684	4492	msedge.exe	85
PID 4492 wrote to memory of 3684	4492	msedge.exe	85
PID 4492 wrote to memory of 3268	4492	msedge.exe	86
PID 4492 wrote to memory of 3268	4492	msedge.exe	86
PID 4492 wrote to memory of 2712	4492	msedge.exe	88
PID 4492 wrote to memory of 2712	4492	msedge.exe	88
PID 4492 wrote to memory of 2712	4492	msedge.exe	88
PID 4492 wrote to memory of 944	4492	msedge.exe	89
PID 4492 wrote to memory of 944	4492	msedge.exe	89
PID 4492 wrote to memory of 944	4492	msedge.exe	89
PID 4492 wrote to memory of 5112	4492	msedge.exe	91
PID 4492 wrote to memory of 5112	4492	msedge.exe	91
PID 4492 wrote to memory of 5112	4492	msedge.exe	91
PID 4492 wrote to memory of 1376	4492	msedge.exe	92
PID 4492 wrote to memory of 4316	4492	msedge.exe	93
PID 4492 wrote to memory of 1376	4492	msedge.exe	92
PID 4492 wrote to memory of 1376	4492	msedge.exe	92
PID 4492 wrote to memory of 4856	4492	msedge.exe	94
PID 4492 wrote to memory of 4316	4492	msedge.exe	93
PID 4492 wrote to memory of 4316	4492	msedge.exe	93
PID 4492 wrote to memory of 4856	4492	msedge.exe	94
PID 4492 wrote to memory of 4856	4492	msedge.exe	94
PID 4492 wrote to memory of 1856	4492	msedge.exe	95
PID 4492 wrote to memory of 1856	4492	msedge.exe	95
PID 4492 wrote to memory of 1856	4492	msedge.exe	95
PID 4492 wrote to memory of 2012	4492	msedge.exe	96
PID 4492 wrote to memory of 2012	4492	msedge.exe	96
PID 4492 wrote to memory of 3352	4492	msedge.exe	97
PID 4492 wrote to memory of 3352	4492	msedge.exe	97
PID 4492 wrote to memory of 3352	4492	msedge.exe	97
PID 4492 wrote to memory of 588	4492	msedge.exe	98
PID 4492 wrote to memory of 588	4492	msedge.exe	98
PID 4492 wrote to memory of 1604	4492	msedge.exe	100
PID 4492 wrote to memory of 4088	4492	msedge.exe	101
PID 4492 wrote to memory of 1604	4492	msedge.exe	100
PID 4492 wrote to memory of 4088	4492	msedge.exe	101
PID 4492 wrote to memory of 1508	4492	msedge.exe	102
PID 4492 wrote to memory of 4568	4492	msedge.exe	104
PID 1508 wrote to memory of 3140	1508	msedge.exe	105
PID 4492 wrote to memory of 3044	4492	msedge.exe	106
PID 4492 wrote to memory of 3044	4492	msedge.exe	106
PID 4492 wrote to memory of 2600	4492	msedge.exe	107
PID 4492 wrote to memory of 2600	4492	msedge.exe	107
PID 4492 wrote to memory of 1260	4492	msedge.exe	108
PID 4492 wrote to memory of 2200	4492	msedge.exe	109
PID 4492 wrote to memory of 1260	4492	msedge.exe	108
PID 4492 wrote to memory of 2200	4492	msedge.exe	109
PID 4492 wrote to memory of 4660	4492	msedge.exe	110
PID 4492 wrote to memory of 4660	4492	msedge.exe	110
PID 3888 wrote to memory of 2296	3888	powershell.exe	113
PID 2296 wrote to memory of 2872	2296	csc.exe	114
PID 3888 wrote to memory of 3932	3888	powershell.exe	115
PID 3932 wrote to memory of 1624	3932	svchost32.exe	116
PID 3932 wrote to memory of 1656	3932	svchost32.exe	118

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost32.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Updates\GFM-PO-2026-21379.js
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$h=[System.Security.Cryptography.SHA1]::Create().ComputeHash([System.Text.Encoding]::Unicode.GetBytes('''c:\users\admin\appdata\local\temp\updates\gfm-po-2026-21379.js''' ));$s=-join($h[0..7].ForEach{'{0:X2}' -f $_});[Console]::Out.Write($s)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\PdfBinder_JS_42F4C5A42E7F543B\Global_Forge_Manufacturing_Contract_Specification.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ff915dbc188,0x7ff915dbc194,0x7ff915dbc1a0
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15349835522081288817,18011332835839563455,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4236038484555453242,11791136916600473305,262144 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,11174898343812223981,12695973650437059476,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,12914618259053673667,11671249461123251239,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,3383275256766061486,3268445325667117211,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,3006189463009332776,9112586978526007027,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,12106988144777319390,14945610420265142259,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,5765582485789329513,3946392624202929740,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4480,i,3009383465510497187,13110548997230324347,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4948,i,8620267205535540739,18199854403635185510,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:9
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,2747317023625448961,9472270137540730084,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5660,i,7237832458574391753,14154175999092398070,2097152 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:15
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,10841149182234346077,15171999038628358527,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,9437169013614784957,4081633463645948777,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,15110000601105085418,10792682868302909623,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,12881274784859946856,10804700936847867639,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,8928826338628032954,18399661061804071745,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,8928826338628032954,18399661061804071745,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,3371416734720596707,11556825265414624956,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,9994410718768408466,14771589198029106594,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,15431689072503937993,7476961122144939030,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,8117309851899293530,1232293724775405865,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,6284717062940160276,13758690145342730683,524288 --field-trial-handle=2188,i,13397949899581972898,8914029945885616276,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\e5ebfac2db3535e5.ps1"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ows5wl4c\ows5wl4c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86FE.tmp" "c:\Users\Admin\AppData\Local\Temp\ows5wl4c\CSCACF878F33D93429E917F3BF74A4E178E.TMP"
    3⤵
    PID:2872
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost32.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3932
- - C:\Windows\system32\netsh.exe
    "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_0118277a307141309411b68588481c8f"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1624
- - C:\Windows\system32\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 2417bdfcf8cfaea8ea7e4b25c9b8826e2e42dbf540ab7e716474b6080f16ffcf
MD5 e611b95093824439b76dcc10a9aa4d4d
SHA1 4ab982d57dda90de413348a5aa68472705038692
SHA512 99087e044b85adc5fedd74dbc0c98106ae8e0948e2b37bf315163dd53fc0264b627fc17add3d05a95e6e27422082396123bc0a48522be354372c1bbded1fc655
TLSH
T19851CE323371B1D889163F4719281AC463BF8755FA94AF4CB698621ED92741BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 11af72b538875dff745f94b92ac463771a61f1c2cd336a18f27ddc468bbe6739
MD5 75f04eebab0130ddcce7bc7f71906e58
SHA1 81321368786790b24a2e70207fd7c9151f974cff
SHA512 a28783bedb929d13d1efd36361089eacd7d10c4cab38a764d1c4d6975639c304b0730e2133fa959de6711f2c52b5f43781ed299fb40aa95ed36c4c35e797de05
SSDEEP 192:sxZmQUnmWRbyM/jK1Ml8Mcl/f0sVA7YWWrNGCodpym/W6+WNGY0sGOwbLYIg4J:sxZ4nmWZ0l/f0si7YXRmh/bG5PO5c
TLSH
T1C462FA12AA345977CCDBD319F956BB53E6F8147292541E48EAFC9A0C01E6BDD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 775722003616ee7793e76bc9686aa7600edbb8fdcc96176c466ccb9c58cb3313
MD5 43496ab3edab1a4e6bec7f6625af8ca5
SHA1 ee64f8e5c502729714ea60a7a275848e800dceb1
SHA512 2b6dd632040c7fbc0b9ef1c9ca07599e909332b99f1ac8e27492bd770faf61e3d00b7c6f23c9f734ced763a5f2784917e62cc2539e35d56854bd0d9ec6396964
SSDEEP 768:Nk/Xh8dF2En7pLuLXwkWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EWgjLls:Nk/Xh8dF2EhEXwkWRmwcQDwu1jaKEWgS
TLSH
T10B032B7B6C0CCB7F4F844E9CEC267E9A6DE8018B9698895447FA890C03C66EF51171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ca39367fc736bf82df45baab2d1b448036ddf6bb71862938caec873bdd356f2
MD5 e24da2408032399ddaa68fe3de265258
SHA1 5c28bbcba2c39a8e4fd8de8eb6446544e0e422e6
SHA512 0f6a98487a102f8640a4e956d64ea4fb9a79ce8180d2ae319e401625fb96fb3fbc6f5821941a20c3bf62539d9407dcfbf81de53c55743b81b6cc05ce0344b2ea
SSDEEP 48:KXVBDPTgvXqzImpgKB1p7gF5wMabRtyBkIvKxGEry1HIlKYcwG:Kg+MKfq6ykgKxGK+HyKYc9
TLSH
T144911513307A12013C3E354D86A587A74A41B6A37429753B3BE850B26E6BE215EFFCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 91576b0ab94ff910623de7f1dd10b12770064d173f75295e36a2078abde6719b
MD5 e17e5e58144a7d65aaaf96cf2c66e51c
SHA1 c0e4695e56ff68890828b1d6c5c980045e9d7bac
SHA512 0f9df26e9c35b95c4cc45ff9162b5562eda1f26bf5cdf38a32839a6ec7dbbf0d696cb5021001448d831f5581be84f48e656822063678cf8c04f17cc2300fb5e8
SSDEEP 192:FvoWuSafT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aoafQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10824630A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA264694DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3c8202f81eb9318d22a1c5b3af22d58726d601a9ba4545be23a34c2755e7c87b
MD5 edb3302dd3adbeb55b037e9ccf53e12e
SHA1 9426cefa6970be50a4d7371a439107b80b4e6d56
SHA512 b2aed85bf0ddd846eba81da39bac58ddfb93782669286fd49cd7c021fc3ff5ef4e781d9c36077bae85b5545314acfa331511c2f84f5fcc8c93a87ea11442fd8d
SSDEEP 192:uuZB8NyJQJaWW4B6H3iE3QmiU15P4Z4r/rUH5ml+xPEbTRkcBIq+PYHU8:nz8NyJWW5XiEgGr/E5I+xsbTPXU8
TLSH
T11A422A3568799CB79DE79600F54B3763AEA4207B9BC42F98D5EC5B0C05D728C230AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d0ddafcad5df9cd8c40df4ddac09936d788dba01a755c6383b9b048d4b9f3c00
MD5 c1ff996d8919cb0c6ce3ab2b10d14a36
SHA1 95266791db5d61533f797b0161a0ac28f54d2086
SHA512 1577923008f3c7156110acd3cb0b67c3934aff94f3844526952aeead3667b2c800590c1c04629e108af411edaa7bc581a08f031a178723158617db0da7f5db96
SSDEEP 192:uuZo8NyYeQJaWW4B6H3iE3QmiU15P4Z4r/rUH5ml+xPEbTRkcBIq+PYHU8:nS8Ny9WW5XiEgGr/E5I+xsbTPXU8
TLSH
T15A4219356879ACB699E79600B44B3763AFA4207B9BC42F88D5EC5B0C05D738C230AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48384e30efade8f2de461be6342945f2f0664307d6758f9e44cb8303e87c6c55
MD5 54665a9ddf0ef8d88b84b9263423f88c
SHA1 3d5c339b045655291a8341a74a89724d0027ccdb
SHA512 88b5b069d26348fb8cae6ac4545c0da43f27523557873ac13a9823baa770052216d57373b01b73d8010fb5c7beed2c991761d3544c2562647100af37911b7aba
SSDEEP 192:1GNe6t6H3BQmiUyKHBHj2Qq/rUH5ml+xPUD9MBOZU6:1GNe6MXfdF2Qq/E5I+xz8U6
TLSH
T16302FA3878B86CBB8DA35E45B44B77275F95216FE7956F88D9E81B1C01DB28C1302933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a776a6f2ddc7ef0fb82b87d2c80d0242c1c752cf7f04d81fa2f5c0ff2af15b5
MD5 dff0a75ef73ae1744403b5a341820677
SHA1 c5cf005cc64ba16da42f7202056f9ecb1f868178
SHA512 d3522d7f791aa68f500f153556c195bc6ece782146a95df3abb33e9765477b6c118b3e8b432e18c9fbc1278643bd5cc07476b6502851871d478dc743f9794d72
SSDEEP 192:1GNz6t6H3QQmiUyE0j2Sq/rUH5ml+xPEbTy/9nBIq+PYHU6:1GNz6MXQU2Sq/E5I+xsbTiXU6
TLSH
T109122B3468ACECAB5D979901F48B33679E95217BDFC56F89E5E80B1C04D738C270A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aca29661-cadc-4a58-817e-bb14fa5cfc13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aca29661-cadc-4a58-817e-bb14fa5cfc13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1008B
SHA256 22fa0adbe74430ddee68ccd7512ac14ac232588de4732d3463d67d136ee6e3e6
MD5 c639ac8be8b64b0b9d98ceebc7bd3e5d
SHA1 890c0b55031dcd41b4641cb00e5527dd5d73287b
SHA512 9ad6efc4ae3b113bd77889a8b64ae413dfb9c115f3016f480ef6de108f19963a4e15a3339beeff469bb64d8ef50d9595d3562290ed202fc8763dca8acb179741
TLSH
T185115523F78CC134C899017A108CAE0171B483CB009FCE8B7E84C118E57F98AEB541E4
MD5 SHA1 SHA512 TLSH

Submit Download

0b7ed066-fa24-4775-ad60-ee38da9f6b20.tmp

Path C:\Users\Admin\AppData\Local\Temp\0b7ed066-fa24-4775-ad60-ee38da9f6b20.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Global_Forge_Manufacturing_Contract_Specification.pdf

Path C:\Users\Admin\AppData\Local\Temp\PdfBinder_JS_42F4C5A42E7F543B\Global_Forge_Manufacturing_Contract_Specification.pdf
Size 19KB
SHA256 2ff32adafc416a10f1b5d4cb4b4789b481d4db7b7961d1f3eb64b7cbd1fc3a2a
MD5 2b673698b14fa1e23d0782a3160142a8
SHA1 a09fe2c76c378d7b37eb3a7d877cbb8a4ad8e627
SHA512 1ea621c72f8fb8d7e1944b1498153fbca2ff174f4b0646ec6eef320fc0f741df932b4b908c05b834f05d267731fadb6e726c86a2a354e3dde7975ce0eb7260ab
SSDEEP 384:NcDa7h5TxtiGXF5bcoAQuFqziimIpNRTmoRhxMsCgb1:ya7LlIGXF5oFBIpdp
TLSH
T1CD929F64C7C55CACE901C521A32E3DE9943DB1B1B9CC3CD2147D0ACD558B93AE963EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES86FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES86FE.tmp
Size 1KB
SHA256 8ddbacbc145c482187ab41a85e0e0cd55ec2ef643efb2dd20f657360cdc180f1
MD5 8b05c2ba465343fde89df02c6bc82aa1
SHA1 84d8414a08e0b74d4050873346d96eda99210c3c
SHA512 285f74d11121ffbcd6508da2cead171e4109493455baae59ef8af91bcd2709a05c2f5a44b0a6c7990a47af6f4502db5d70a0ae889000502b8ebcaf5d5c86c369
TLSH
T16521890583E84B0BF0735B3168FA272BA624FD69EF62535B854042282C41104EEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dpfpdy3h.5f3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dpfpdy3h.5f3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bc2663d4-1491-485e-9957-f16853f7a4b9.tmp

Path C:\Users\Admin\AppData\Local\Temp\bc2663d4-1491-485e-9957-f16853f7a4b9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e5ebfac2db3535e5.ps1

Path C:\Users\Admin\AppData\Local\Temp\e5ebfac2db3535e5.ps1
Size 2KB
SHA256 26f96de6971bb8a8fd94f419907abbf923f30c23a9818f130727566a155fb404
MD5 6d34aeaa61361ca1fa5b843e64a1989d
SHA1 935634f3870282d28cc54954f59554cb481f1a65
SHA512 f257f19e46dc1a60ecae900643a3ec91cf50cced209e07142cb0a6baf310533453c5b028cad16733d710044ab2c1e31bca5fa025f900546416713ff06adc8b80
TLSH
T19F416005AD9151B1C670CF24A881AF9FF66F443E98660200726D9315BEA0F6F876E0DA
MD5 SHA1 SHA512 TLSH

Submit Download

ows5wl4c.dll

Path C:\Users\Admin\AppData\Local\Temp\ows5wl4c\ows5wl4c.dll
Size 3KB
SHA256 e5283c9184f96b9b61a383d0d34f0ab87286c72ec7b08cafe3c3d08c0d769ea9
MD5 b5fab3299aa2bc0c360c028238ec2cb5
SHA1 d5e270a746dfa7d7132255e84fbe634dc480c237
SHA512 68b69b3d8c05fa9f7bb0146eb1c374ee47a2367f825f3f6eac3e2b1d8c7591096f18cd35e76dc54c8b93e183d657c63f6260c6851069d5bc3f68ad58d3ae4aa5
TLSH
T1CE510E16A3F8456BE4770730AEE3435637B4F8109FB3576D5A900229AC503646D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4492_1953477093\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d401d48-0cc0-4dda-a4c4-731321aee19a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4492_671518586\5d401d48-0cc0-4dda-a4c4-731321aee19a.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost32.exe
Size 999KB
SHA256 434ef33a760933ec1e909add2d7fcd2d63add6c391dc31b8d101cdd7bc7ff63d
MD5 68ce28a1c89e57e335db1cf1d414ef83
SHA1 36640d55182ec42ce0f6e8d9da1b8e113b2b1619
SHA512 3b8d087da14d7d303a8a3a850aeada3dddff45bc92b65a21c1b5254488cdddfca3f1e87132fad9f96fa4124aa8539430c502b71e9f0516b189052f34e27b7b39
SSDEEP 24576:S0PjefN9cWvcFR0iPzmI78XUUgFsWcSMw0V8:LmNOWvq0iPzmE6rr
TLSH
T1E025F01873FC1719F3BF8F34A8B451544AB6F867A856C74C2D8621DC2932B95EA60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCACF878F33D93429E917F3BF74A4E178E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ows5wl4c\CSCACF878F33D93429E917F3BF74A4E178E.TMP
Size 652B
SHA256 168b08e09e9a4e13c40dde7d6b6dce0cc4782b32df4e0b17f133b23073d8042a
MD5 2e34ae7a13e12ec663578107c9c3359c
SHA1 5580f549006ff2581c328d015e6ee1209ee8d1fc
SHA512 1011db98edea89feb863329ece1952757d38703bae1d1a9a1d7f32a8383476a5d342067893057fd9a1454f8179b1a420952475414f24635a96c1d7143bacaf02
TLSH
T182F05E09A3F8020EF0F34B31BDF6536395A9BC64DE3393ED1550435928649209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ows5wl4c.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ows5wl4c\ows5wl4c.0.cs
Size 209B
SHA256 e738df1d88b97f2cddf8d584ce681a91467fb890e4fa2976cdf17cce6c2e8e1c
MD5 101ed62b4bd64f902a97f4492cf5f030
SHA1 5bdba11cfa0ec42af6ebc166877345aa2b977edb
SHA512 069f4392cb6c8632cc16a26d5115c2538f929f99fc8377346b0514e8cf9de8568d041336e964b95fabbf09bd6c85e175c4abf615555a6ccc2eb3ea9ebce3fd13
TLSH
T17AD0A71865A35DA100024C160C46A1FD7623423B255A2605A6B50210DF4A0094131A19
MD5 SHA1 SHA512 TLSH

Submit Download

ows5wl4c.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ows5wl4c\ows5wl4c.cmdline
Size 369B
SHA256 cb36cf615da565715bd895dc984391803bd1a788860247d38e75ce30f26efb83
MD5 c28dd9c70c57e0ef3d07aac3bdb52137
SHA1 2bae49862a7ca71aaf3a8e8c333688806fc73472
SHA512 29b53737193e3dc0b7b96508d62ff07bbac71a4f2435c5d70a00c713b400faa9cfe7b54671031c5d481e5a88cd8b1ec1420f8a16e99addf6c3cb5fcf96aeb91b
TLSH
T1C4E06F6B4387C27D12EA500B326BC6AC93730783E9883FA4A060848DE06B0013BD2B85
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2956-9-0x000001E03A4C0000-0x000001E03A4D0000-memory.dmp

Download

memory/2956-2-0x000001E03A960000-0x000001E03A982000-memory.dmp

Download

memory/2956-1-0x000001E03A4C0000-0x000001E03A4D0000-memory.dmp

Download

memory/2956-0-0x000001E03A4C0000-0x000001E03A4D0000-memory.dmp

Download

memory/2956-10-0x000001E055AF0000-0x000001E055B66000-memory.dmp

Download

memory/3888-537-0x0000026ECB6C0000-0x0000026ECB773000-memory.dmp

Download

memory/3888-538-0x0000026ECB780000-0x0000026ECB78A000-memory.dmp

Download

memory/3888-539-0x0000026ECB7B0000-0x0000026ECB7CC000-memory.dmp

Download

memory/3888-540-0x0000026ECB790000-0x0000026ECB79A000-memory.dmp

Download

memory/3888-541-0x0000026ECBB00000-0x0000026ECBB1A000-memory.dmp

Download

memory/3888-542-0x0000026ECB7A0000-0x0000026ECB7A8000-memory.dmp

Download

memory/3888-543-0x0000026ECB7D0000-0x0000026ECB7D6000-memory.dmp

Download

memory/3888-544-0x0000026ECB7E0000-0x0000026ECB7EA000-memory.dmp

Download

memory/3888-536-0x0000026ECB6A0000-0x0000026ECB6BC000-memory.dmp

Download

memory/3888-529-0x0000026ECB660000-0x0000026ECB668000-memory.dmp

Download

memory/3932-559-0x000002A2E7D00000-0x000002A2E7DFE000-memory.dmp

Download

memory/3932-572-0x000002A2EA750000-0x000002A2EA7A0000-memory.dmp

Download

memory/3932-573-0x000002A2EA6D0000-0x000002A2EA6E2000-memory.dmp

Download