63fab34fd2ea8e172e0eee6c5f232b00af820fd8422aaa66fe9ef30b9525bf45

Analysis

user interaction
yes
max time kernel
29s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 333KB
Sample260627-axtmfafz2s
SHA256 63fab34fd2ea8e172e0eee6c5f232b00af820fd8422aaa66fe9ef30b9525bf45
MD5 90786477167b63abc34ab03fb87cd105
SHA1 c9d8ff614a9186c98db3e01ed039b3ac1e92281d
SHA512 fdc5312ee677a2caf4e8db7bf71a23ba80649a30b8983e9f594041e91c531fdb6d6b0c959a28e26ae293714d2bb386e2f1b250aca628cefe02f2efd5acc4cd00
SSDEEP 6144:F/RwSGgnpUl/j5lZK2Veyl1J/KGse+Tpr9VRJ8C/UUB30djVdM:JX7ul/hK2Ve6KGKTpr9VRJVfOM
TLSH
T12F743A2BE76358FCC16B903586A7A7B2B431FC8903206E5E5695C7323E35D600F9DE68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Svc32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RuntimeSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{LoaderMonitorHostAgent-lvrium}	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{LoaderMonitorHostAgent-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\AgentMonitor\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\AgentMonitor	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6968	powershell.exe
6132	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinHost\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Executes dropped EXE 1 IoCs

pid	Process
5556	UpdateAgent.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Helper64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HelperHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AgentCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6968	powershell.exe
6132	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\MsMonitor.exe	x_plfg.exe
File created	C:\Windows\SysWOW64\Ms32.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\RuntimeProc.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\SvcAgent.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\LoaderHost.exe	x_plfg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\CoreHelper.exe	x_plfg.exe
File created	C:\Program Files (x86)\WinTask.exe	x_plfg.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\HostAgent.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\HostHelper.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\UpdateHelper.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Helper64.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\NetCore.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\NetMgr.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\SysHost.exe	x_plfg.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2428	sc.exe
6532	sc.exe
2456	sc.exe
6616	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	x_plfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	x_plfg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5124	vssadmin.exe
6296	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269941720282196"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2882181966-868590553-1461876573-1000\{C7980E70-6E9C-4CE6-A6DB-22F607DEACED}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6968	powershell.exe
6968	powershell.exe
6132	powershell.exe
6132	powershell.exe
6132	powershell.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe
5984	x_plfg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
7000	msedge.exe
7000	msedge.exe
7000	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	6968	powershell.exe
Token: SeIncreaseQuotaPrivilege	6968	powershell.exe
Token: SeSecurityPrivilege	6968	powershell.exe
Token: SeTakeOwnershipPrivilege	6968	powershell.exe
Token: SeLoadDriverPrivilege	6968	powershell.exe
Token: SeSystemProfilePrivilege	6968	powershell.exe
Token: SeSystemtimePrivilege	6968	powershell.exe
Token: SeProfSingleProcessPrivilege	6968	powershell.exe
Token: SeIncBasePriorityPrivilege	6968	powershell.exe
Token: SeCreatePagefilePrivilege	6968	powershell.exe
Token: SeBackupPrivilege	6968	powershell.exe
Token: SeRestorePrivilege	6968	powershell.exe
Token: SeShutdownPrivilege	6968	powershell.exe
Token: SeDebugPrivilege	6968	powershell.exe
Token: SeSystemEnvironmentPrivilege	6968	powershell.exe
Token: SeRemoteShutdownPrivilege	6968	powershell.exe
Token: SeUndockPrivilege	6968	powershell.exe
Token: SeManageVolumePrivilege	6968	powershell.exe
Token: 33	6968	powershell.exe
Token: 34	6968	powershell.exe
Token: 35	6968	powershell.exe
Token: 36	6968	powershell.exe
Token: SeBackupPrivilege	2768	vssvc.exe
Token: SeRestorePrivilege	2768	vssvc.exe
Token: SeAuditPrivilege	2768	vssvc.exe
Token: SeDebugPrivilege	6132	powershell.exe
Token: SeIncreaseQuotaPrivilege	6132	powershell.exe
Token: SeSecurityPrivilege	6132	powershell.exe
Token: SeTakeOwnershipPrivilege	6132	powershell.exe
Token: SeLoadDriverPrivilege	6132	powershell.exe
Token: SeSystemProfilePrivilege	6132	powershell.exe
Token: SeSystemtimePrivilege	6132	powershell.exe
Token: SeProfSingleProcessPrivilege	6132	powershell.exe
Token: SeIncBasePriorityPrivilege	6132	powershell.exe
Token: SeCreatePagefilePrivilege	6132	powershell.exe
Token: SeBackupPrivilege	6132	powershell.exe
Token: SeRestorePrivilege	6132	powershell.exe
Token: SeShutdownPrivilege	6132	powershell.exe
Token: SeDebugPrivilege	6132	powershell.exe
Token: SeSystemEnvironmentPrivilege	6132	powershell.exe
Token: SeRemoteShutdownPrivilege	6132	powershell.exe
Token: SeUndockPrivilege	6132	powershell.exe
Token: SeManageVolumePrivilege	6132	powershell.exe
Token: 33	6132	powershell.exe
Token: 34	6132	powershell.exe
Token: 35	6132	powershell.exe
Token: 36	6132	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
7000	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5984	x_plfg.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 5628	5984	x_plfg.exe	90
PID 5628 wrote to memory of 6968	5628	cmd.exe	92
PID 5984 wrote to memory of 1692	5984	x_plfg.exe	94
PID 1692 wrote to memory of 6532	1692	cmd.exe	96
PID 5984 wrote to memory of 6524	5984	x_plfg.exe	97
PID 6524 wrote to memory of 2428	6524	cmd.exe	99
PID 5984 wrote to memory of 6732	5984	x_plfg.exe	100
PID 6732 wrote to memory of 5124	6732	cmd.exe	102
PID 5984 wrote to memory of 3516	5984	x_plfg.exe	105
PID 3516 wrote to memory of 4872	3516	cmd.exe	107
PID 3516 wrote to memory of 6280	3516	cmd.exe	108
PID 3516 wrote to memory of 1112	3516	cmd.exe	109
PID 5984 wrote to memory of 4084	5984	x_plfg.exe	110
PID 4084 wrote to memory of 2976	4084	cmd.exe	112
PID 4084 wrote to memory of 6640	4084	cmd.exe	113
PID 4084 wrote to memory of 6132	4084	cmd.exe	114
PID 5984 wrote to memory of 3288	5984	x_plfg.exe	122
PID 3288 wrote to memory of 5464	3288	cmd.exe	124
PID 3288 wrote to memory of 2588	3288	cmd.exe	125
PID 3288 wrote to memory of 2456	3288	cmd.exe	126
PID 5984 wrote to memory of 3396	5984	x_plfg.exe	127
PID 3396 wrote to memory of 1788	3396	cmd.exe	129
PID 3396 wrote to memory of 1900	3396	cmd.exe	130
PID 3396 wrote to memory of 6616	3396	cmd.exe	131
PID 5984 wrote to memory of 2864	5984	x_plfg.exe	132
PID 2864 wrote to memory of 6740	2864	cmd.exe	134
PID 2864 wrote to memory of 1496	2864	cmd.exe	135
PID 2864 wrote to memory of 6296	2864	cmd.exe	136
PID 5984 wrote to memory of 7000	5984	x_plfg.exe	137
PID 7000 wrote to memory of 1108	7000	msedge.exe	138
PID 7000 wrote to memory of 1736	7000	msedge.exe	139
PID 7000 wrote to memory of 708	7000	msedge.exe	140
PID 7000 wrote to memory of 1736	7000	msedge.exe	139
PID 7000 wrote to memory of 1736	7000	msedge.exe	139
PID 7000 wrote to memory of 4580	7000	msedge.exe	141
PID 7000 wrote to memory of 4580	7000	msedge.exe	141
PID 7000 wrote to memory of 7064	7000	msedge.exe	143
PID 7000 wrote to memory of 7112	7000	msedge.exe	144
PID 7000 wrote to memory of 7064	7000	msedge.exe	143
PID 7000 wrote to memory of 7064	7000	msedge.exe	143
PID 7000 wrote to memory of 7112	7000	msedge.exe	144
PID 7000 wrote to memory of 7112	7000	msedge.exe	144
PID 7000 wrote to memory of 4568	7000	msedge.exe	146
PID 7000 wrote to memory of 4568	7000	msedge.exe	146
PID 7000 wrote to memory of 4568	7000	msedge.exe	146
PID 7000 wrote to memory of 1020	7000	msedge.exe	147
PID 7000 wrote to memory of 1584	7000	msedge.exe	148
PID 7000 wrote to memory of 1020	7000	msedge.exe	147
PID 7000 wrote to memory of 1584	7000	msedge.exe	148
PID 7000 wrote to memory of 6320	7000	msedge.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6968
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:6532
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6524
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2428
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6732
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "MsMonitor" /TR "\"C:\Users\Admin\AppData\Roaming\UpdateAgent.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6280
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "MsMonitor" /TR "\"C:\Users\Admin\AppData\Roaming\UpdateAgent.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:2588
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:2456
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:1900
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6616
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:1496
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd2dd4c188,0x7ffd2dd4c194,0x7ffd2dd4c1a0
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,1873283116519482929,7753812332349262184,262144 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5023360508739443597,10700961441548464928,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
    3⤵
    - System Time Discovery
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,12702764422571772281,2988935631167238908,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,18256790122162132496,8049040539005414140,2097152 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,6633297763003368688,1367019626727108517,2097152 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5096,i,14598329701516522364,13654369983431063269,2097152 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14395468305854215791,7601513074866270888,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16522253458610149513,1895326263156295612,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6686984002934282532,15288966242145521797,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6686984002934282532,15288966242145521797,524288 --field-trial-handle=2612,i,10633499084372503096,5363818351223386399,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:6320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:6120

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:2444

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:6148

C:\Users\Admin\AppData\Roaming\UpdateAgent.exe
"C:\Users\Admin\AppData\Roaming\UpdateAgent.exe"
1⤵
- Executes dropped EXE
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:356

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f60cd2d9231e56b0a0784a59fb17664fa333e06aac5ee1d5692effc5152b5c30
MD5 cce4d9b2c5f5fb7c3bfaaab4af8f0448
SHA1 17b40c534fd35eb849f575565dee407cf6215d92
SHA512 5e1cbca923a813696df373e5b185a1b3fc4f73a39029b41c0ce02bf3dea25ad383c02c9763a6d8965f882055fcabaceefe0852b44c19af280ddaf74994edc4e6
TLSH
T119D080357B46EC53C41630715C3743B46256825A6967D5177450801EC88659577D214B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff07219f3594693f0fac57895f6888104d17957d039d3530d82987134771108b
MD5 26fba9d3c09d715a1b951844cadd62c5
SHA1 9e4dc8d0a08f2feba8c030b217c14a6a5c1e4827
SHA512 fc2fc417004bf59d775f5e0fafa0e6d4883632e585e21934aba3d8697554f979efd3a818d1e74c7713d51b1993f1678a707621ebef66bdf01536cd7793ff1e31
TLSH
T184D080357B46EC53C0163071583743A4625682166567D5177850D01EC846595B7D2147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7edc152d4ab9cceb4196c358e1e360399afe1d0b51166fefd0da2641fe934ccb
MD5 f22fe3389f0284da378455a2b7cc4533
SHA1 b57de47638ef9a46010f7ae131e18f644d6e904c
SHA512 8c925e5fe22e6feb1d0161e0248bb7d67adfdf3f4d5de820bc22b1e5508cd1e8d5a73a755e03554312ded0b665b7cc254f885a1118223b5df75b9832d0558251
TLSH
T128F0F9BAC821AC3719FD1B1830940B4BF75013672782954B3A3C920C4FB16BB464591C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c4aa7fec766b650d4bd77146126c7c14f4e36db7f8e2204851a0fd79a3c0e8d2
MD5 13a7e40da5d6f58a1d606e559b6b91ad
SHA1 17448568c770ca0df59e493c11f13ecee587f97c
SHA512 e5868fa5165f3b9f354cbd7f9bc1fc958de06c9cdc8a7bb0df32f13d715b361c695b16fa83df98f74ac71395a09978289a5e6e34e56f04f855ad5e7c58d02351
SSDEEP 192:sxR4uRfyMqZjK1Ml8wcQ/fx+sTBdGrMpPZ5NtBWlIEzoA8pqZ/g6+WN9Ey/Y0Z9Z:sxRR4CQ/fUsfpRLW+l6/5z/P4K6gPDjj
TLSH
T15D72EA156938497B8CDBD619FA55BF53D6F81533E2905E44AAFC8B0C04EBADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d976ae68dfc509772a2f6941c0c70a80d35c05866e367c29460d2d7519157a66
MD5 e1e499e687c7eae14320a017cc1a7fad
SHA1 cee81b33b22ecf4f74877e2a2304889a32227d55
SHA512 e8e782722431299d362f93eb8d08a678467e4a19f8b1b1e7d6450263cf6869a80bac54ad39a8d341af3a470d44ceede6af1925d8527d24038401a8991c699210
SSDEEP 768:PXoDFl7pLuL7jGWgoqfjs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaP9RiW5oroVRAQ:PXoDFzE7jGWgoqfjsu1jaVP9QW5TVRAQ
TLSH
T1EDE2FD3B680CCB7E4F84499CED29BD9F6DE801CF96D88D5447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5ca8b37f965e8e43acd67286e6296a2477c3339cb6020275e364ee4904814bc1
MD5 2d4f551871b517599dfbc79a5a462a54
SHA1 e0fa0cc820fe975e2d0a337d7fc3934e51c83039
SHA512 b61c4a2f53f7c58bb78029722b442e226c54fd2804ae761b4b669d9a50b610e3dd716b57c7ff23d513067c3a3b97310b515c5fb7c35b633fd4bc64a04f9685af
SSDEEP 192:6H76D7ElhDfFJfpdBJ9XvC7904Zey4uOVSXeKs4hY/woPKOSNw:6b6XEHDdJBd79/ChZPw
TLSH
T13BB23A51797E220538FE2918D1A5856F674130B3301AA63B3BBC60E61EA7E005FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0c0c135dc6c5e615283c4588fb38294dc65407884ef37dd30a2346c94b25a439
MD5 ef82bb2390b62d7a960fdabba8d34fcb
SHA1 3826d9e6c1d3378f78a810f8d7f3aa848389e45d
SHA512 5b2359a706f211b7479019b2e77a49f558f0fa382fc6399f7c87cbed3af71ba8630ed1805e637a7497e6eabe3ac1b64224d26d977b830c3949e559ec9c6dff09
SSDEEP 384:n/iF1tNn/s3n9S/8N18TUNTUlIRfUGhn37kmfoFGio9VQqWLj5ZYITGT0I9aY8LS:KF1j+96cwguYKGisQqWJ6i+02a+vh
TLSH
T1C6C24B36D865DAABDDF64FD9E709764AAEF001A7C4C859C8DAD81D4C00C72ED1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf013530ac0ac299b8f7a19644c0c12a81354115a860c34249c9567f8771608d
MD5 0c8bc51fc8784bb517547ef046904a9a
SHA1 8c857a6e3ccaf378248e09adcb2db02d90564fcf
SHA512 d7be40eba4b83a54ac620fe33d733fe066b8317b7317a59c1a6321b606bd347022a0b783e9894839b46ffdcec8f98937b485165ae67ee4342bb072ef9a23be6d
SSDEEP 384:n4iF1tNn/s3n9S68NbY8TUNTUlIRvUGhmHNkmfoFGio9VQqWLj/IpXigaRmn15wy:DF1j+9/BwgyfYGisQqWwN6mn12bfm
TLSH
T125D25B36E864DE67ADE78FD9B34A7646EEE002B3858C59D8D9D90D4C00D72DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ouelbef4.c0h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ouelbef4.c0h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\31
Size 2B
SHA256 e5a08ffd3d7509c66e79642edbdcd8ed889269a7164c718afca541304188423d
MD5 946490ad0fdc17b3b899760a445128f0
SHA1 2934526b788a419c15c351c8462a7a7eef4633fb
SHA512 0f3cb2ce12431693621c47573b3d81a5113be7388db3dea9f4d457439ef04c987f5c01f49f5f067ad4cbf0e451b402f70313c9908a47291a80b947a78d4b37f2
MD5 SHA1 SHA512

Submit Download

UpdateAgent.exe

Path C:\Users\Admin\AppData\Roaming\UpdateAgent.exe
Size 333KB
SHA256 63fab34fd2ea8e172e0eee6c5f232b00af820fd8422aaa66fe9ef30b9525bf45
MD5 90786477167b63abc34ab03fb87cd105
SHA1 c9d8ff614a9186c98db3e01ed039b3ac1e92281d
SHA512 fdc5312ee677a2caf4e8db7bf71a23ba80649a30b8983e9f594041e91c531fdb6d6b0c959a28e26ae293714d2bb386e2f1b250aca628cefe02f2efd5acc4cd00
SSDEEP 6144:F/RwSGgnpUl/j5lZK2Veyl1J/KGse+Tpr9VRJ8C/UUB30djVdM:JX7ul/hK2Ve6KGKTpr9VRJVfOM
TLSH
T12F743A2BE76358FCC16B903586A7A7B2B431FC8903206E5E5695C7323E35D600F9DE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-65-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/1640-52-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/1788-62-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/1900-63-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/2444-53-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/2588-61-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/2804-214-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/2976-37-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/4872-35-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/5464-60-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/5556-58-0x00007FF7AA470000-0x00007FF7AA4CB000-memory.dmp

Download

memory/5984-139-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/5984-254-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6120-46-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6132-55-0x000001C3C9380000-0x000001C3C9432000-memory.dmp

Download

memory/6148-56-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6280-36-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6532-215-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6640-38-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6740-64-0x00007FF6A99D0000-0x00007FF6A9A2B000-memory.dmp

Download

memory/6968-26-0x000001E278700000-0x000001E27870A000-memory.dmp

Download

memory/6968-16-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-31-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-30-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-29-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-28-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-27-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-33-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-24-0x000001E278620000-0x000001E27863E000-memory.dmp

Download

memory/6968-25-0x000001E278640000-0x000001E2786F2000-memory.dmp

Download

memory/6968-17-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-34-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-15-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-14-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-1-0x00007FFD2D55F000-0x00007FFD2D560000-memory.dmp

Download

memory/6968-13-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-12-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-11-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-10-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-9-0x00007FFD2D3D0000-0x00007FFD2DD74000-memory.dmp

Download

memory/6968-8-0x000001E278230000-0x000001E278252000-memory.dmp

Download