Overview

overview

10

Static

static

10

2026-07-11...id.exe

windows10-2004-x64

10

2026-07-11...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 01:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe
  • Size 5.5MB
  • Sample260711-carknscx4x
  • SHA256 2e22b99caa901311372998458c729ff0f7c57962b7e9cd124fa82205c3606808
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencetrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 58 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 58 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 58 IoCs
  • Detects executables calling ClearMyTracksByProcess 58 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 58 IoCs
  • Detects executables referencing many IR and analysis tools 58 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 58 IoCs
  • UPX dump on OEP (original entry point) 62 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 25 IoCs
  • UPX packed file 62 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1875162379-3804078649-638427191-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://metamask.io/zh-CN/download
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x338,0x7ffe1993c188,0x7ffe1993c194,0x7ffe1993c1a0
          4⤵
            PID:1104
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,7575667054565955182,14064109341916160903,262144 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
            4⤵
              PID:5820
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11033407482046356437,7176448973125157960,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
              4⤵
              • System Time Discovery
              PID:4360
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,18087034261137555409,18318233872987882175,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
              4⤵
                PID:5808
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,8683323670419022542,4995150422406989967,2097152 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
                4⤵
                  PID:5324
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,18303876926316178532,11590625480886080053,2097152 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                  4⤵
                    PID:5056
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,4751814095773651265,8560186080535080790,2097152 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
                    4⤵
                      PID:936
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,3181772172288683961,14130883646720762122,2097152 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
                      4⤵
                        PID:4768
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13462517092265408869,12717077834476686619,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                        4⤵
                          PID:6008
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1627697492018558874,10122631350119641503,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
                          4⤵
                            PID:3396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,12585529989444427513,569560964175066210,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
                            4⤵
                              PID:2112
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13462978851510286783,12078042043115126224,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                              4⤵
                                PID:2488
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13462978851510286783,12078042043115126224,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                4⤵
                                  PID:5508
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,8752952911511036640,3330404296399448795,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                  4⤵
                                    PID:5932
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,4664405644092080162,11079910949229712519,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
                                    4⤵
                                      PID:1988
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,15963405334372164853,9402949410320113513,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
                                      4⤵
                                        PID:788
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,2915875738379425193,1244113112651410469,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
                                        4⤵
                                          PID:2512
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,1061812118756719668,11058142047136083199,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
                                          4⤵
                                            PID:1200
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,8693940002232469526,7137553709955087867,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                                            4⤵
                                              PID:2200
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4294543877929765662,9006237162296264167,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
                                              4⤵
                                                PID:4288
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,17827360681199413631,1744024996077949833,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
                                                4⤵
                                                  PID:4540
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,12876587373274642590,13551693740412115508,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
                                                  4⤵
                                                    PID:4076
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,7569857484197189037,17168338816014043652,262144 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
                                                    4⤵
                                                      PID:4408
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,9912477295797993562,15219283227344303798,524288 --field-trial-handle=2604,i,3429386442513846132,17033604534465279625,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                                                      4⤵
                                                        PID:2568
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4268
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5704
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe' -Force" >nul 2>&1
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2188
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-11_0a9ec3eb11111a1a9f67bafda38cdd62_icedid.exe' -Force"
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4056
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4368
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 2 /nobreak
                                                        4⤵
                                                        • Delays execution with timeout.exe
                                                        PID:4544
                                                    • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                      "C:\Users\Admin\AppData\Local\iusb3mon.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3292
                                                      • C:\Windows\SysWOW64\dllhost.exe
                                                        "C:\Windows\SysWOW64\dllhost.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Adds Run key to start application
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3376
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3332
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            6⤵
                                                              PID:4056
                                                            • C:\Windows\SysWOW64\SecEdit.exe
                                                              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
                                                              6⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4900
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
                                                            5⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5996
                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                            C:\Windows\SysWOW64\prevhost.exe
                                                            5⤵
                                                              PID:2852
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&1
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4088
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks.exe /query /tn "WinSvcMon_3C6F10A0"
                                                                6⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1444
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240728437_wd.xml" /f >nul 2>&1
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5932
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240728437_wd.xml" /f
                                                                6⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2180
                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                              C:\Windows\SysWOW64\prevhost.exe
                                                              5⤵
                                                                PID:3476
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4860
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2392
                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                5⤵
                                                                  PID:6124
                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                  5⤵
                                                                    PID:1308
                                                                  • C:\Windows\SysWOW64\prevhost.exe
                                                                    C:\Windows\SysWOW64\prevhost.exe
                                                                    5⤵
                                                                      PID:3492
                                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                                      C:\Windows\SysWOW64\prevhost.exe
                                                                      5⤵
                                                                        PID:916
                                                                      • C:\Windows\SysWOW64\prevhost.exe
                                                                        C:\Windows\SysWOW64\prevhost.exe
                                                                        5⤵
                                                                          PID:4404
                                                                        • C:\Windows\SysWOW64\prevhost.exe
                                                                          C:\Windows\SysWOW64\prevhost.exe
                                                                          5⤵
                                                                            PID:2620
                                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                                            C:\Windows\SysWOW64\prevhost.exe
                                                                            5⤵
                                                                              PID:1248
                                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                                              C:\Windows\SysWOW64\prevhost.exe
                                                                              5⤵
                                                                                PID:4400
                                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                                5⤵
                                                                                  PID:5504
                                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                                  5⤵
                                                                                    PID:5668
                                                                                  • C:\Windows\SysWOW64\prevhost.exe
                                                                                    C:\Windows\SysWOW64\prevhost.exe
                                                                                    5⤵
                                                                                      PID:4900
                                                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                                                      C:\Windows\SysWOW64\prevhost.exe
                                                                                      5⤵
                                                                                        PID:5072
                                                                                      • C:\Windows\SysWOW64\prevhost.exe
                                                                                        C:\Windows\SysWOW64\prevhost.exe
                                                                                        5⤵
                                                                                          PID:5508
                                                                                        • C:\Windows\SysWOW64\prevhost.exe
                                                                                          C:\Windows\SysWOW64\prevhost.exe
                                                                                          5⤵
                                                                                            PID:3792
                                                                                          • C:\Windows\SysWOW64\prevhost.exe
                                                                                            C:\Windows\SysWOW64\prevhost.exe
                                                                                            5⤵
                                                                                              PID:2964
                                                                                            • C:\Windows\SysWOW64\prevhost.exe
                                                                                              C:\Windows\SysWOW64\prevhost.exe
                                                                                              5⤵
                                                                                                PID:5044
                                                                                              • C:\Windows\SysWOW64\prevhost.exe
                                                                                                C:\Windows\SysWOW64\prevhost.exe
                                                                                                5⤵
                                                                                                  PID:2436
                                                                                                • C:\Windows\SysWOW64\prevhost.exe
                                                                                                  C:\Windows\SysWOW64\prevhost.exe
                                                                                                  5⤵
                                                                                                    PID:4400
                                                                                                  • C:\Windows\SysWOW64\prevhost.exe
                                                                                                    C:\Windows\SysWOW64\prevhost.exe
                                                                                                    5⤵
                                                                                                      PID:4372
                                                                                                    • C:\Windows\SysWOW64\prevhost.exe
                                                                                                      C:\Windows\SysWOW64\prevhost.exe
                                                                                                      5⤵
                                                                                                        PID:4540
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:5768
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                  1⤵
                                                                                                    PID:3492
                                                                                                  • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                    C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3744
                                                                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                                                                      "C:\Windows\SysWOW64\dllhost.exe"
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4076
                                                                                                  • C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                    "C:\Users\Admin\AppData\Local\iusb3mon.exe"
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1144
                                                                                                    • C:\Windows\SysWOW64\dllhost.exe
                                                                                                      "C:\Windows\SysWOW64\dllhost.exe"
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1708

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Command and Scripting Interpreter

                                                                                                        1
                                                                                                        T1059

                                                                                                        PowerShell

                                                                                                        1
                                                                                                        T1059.001

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Persistence

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        1
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Privilege Escalation

                                                                                                        Abuse Elevation Control Mechanism

                                                                                                        1
                                                                                                        T1548

                                                                                                        Bypass User Account Control

                                                                                                        1
                                                                                                        T1548.002

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        1
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Defense Evasion

                                                                                                        Abuse Elevation Control Mechanism

                                                                                                        1
                                                                                                        T1548

                                                                                                        Bypass User Account Control

                                                                                                        1
                                                                                                        T1548.002

                                                                                                        Impair Defenses

                                                                                                        1
                                                                                                        T1562

                                                                                                        Disable or Modify Tools

                                                                                                        1
                                                                                                        T1562.001

                                                                                                        Indicator Removal

                                                                                                        1
                                                                                                        T1070

                                                                                                        File Deletion

                                                                                                        1
                                                                                                        T1070.004

                                                                                                        Modify Registry

                                                                                                        2
                                                                                                        T1112

                                                                                                        Credential Access

                                                                                                        Discovery

                                                                                                        Browser Information Discovery

                                                                                                        1
                                                                                                        T1217

                                                                                                        Query Registry

                                                                                                        2
                                                                                                        T1012

                                                                                                        System Information Discovery

                                                                                                        3
                                                                                                        T1082

                                                                                                        System Location Discovery

                                                                                                        1
                                                                                                        T1614

                                                                                                        System Language Discovery

                                                                                                        1
                                                                                                        T1614.001

                                                                                                        System Time Discovery

                                                                                                        1
                                                                                                        T1124

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Command and Control

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        ziliao.jpg
                                                                                                        • Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
                                                                                                        • Size 305KB
                                                                                                        • SHA256 5f7f150dde9d6cf9d21c7926d4e5c670ad1d7f5002020629e2aa11c0e4fbbd87
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        21db0f91-33c7-4e6d-bcb0-b72ec4d14f28.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21db0f91-33c7-4e6d-bcb0-b72ec4d14f28.tmp
                                                                                                        • Size 39KB
                                                                                                        • SHA256 df21077d46cd3aa0265dc9e4dc52533da041a0f2f63eb8429b9dc61267376e92
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        27b4b192-7a5c-4c28-800b-ea5a0f350104.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27b4b192-7a5c-4c28-800b-ea5a0f350104.tmp
                                                                                                        • Size 14KB
                                                                                                        • SHA256 3fa8228dae0da395aa4b1aec0e49fc66186a08cbbf772372322e2c785e5e106c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        temp-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                        • Size 3KB
                                                                                                        • SHA256 0cd911ebc0e3f44ad6c648df70aab48767064234b054da8a65225ac514c16fc7
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index~RFe5976eb.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5976eb.TMP
                                                                                                        • Size 3KB
                                                                                                        • SHA256 5a435f84d28af4d574b1fe609a5bfeca1ce5b4378673b89b4be4b22819d0d64d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        SiteList-Enterprise.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                        • Size 2B
                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Edge Profile.ico
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                        • Size 70KB
                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Network Persistent State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                        • Size 3KB
                                                                                                        • SHA256 0b61fb92dbf06d4699c5099211c0988ed06e1c6b2c97bc4f90f009e091e20005
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        SCT Auditing Pending Reports
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                        • Size 2B
                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Sdch Dictionaries
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                        • Size 40B
                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 14KB
                                                                                                        • SHA256 53f5122ab8889cd8fa287ddfc6a00bfa2e6640390fef4f7574003168b046e8d9
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 14KB
                                                                                                        • SHA256 bb2b352d85d7b858c0e1d4c0d7af4e1db13474a8c56851c30e4cd1a630d7add8
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Secure Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                        • Size 32KB
                                                                                                        • SHA256 3e2e313913c67d7d8b7a4d5320145133155aca417f72c717c145edeb60578672
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        7a732d61-804b-4484-bbf8-f2c8b7d322ef.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7a732d61-804b-4484-bbf8-f2c8b7d322ef.tmp
                                                                                                        • Size 22KB
                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 38KB
                                                                                                        • SHA256 48c3f3b40faacc21ba18d623d3c45118bd63c418034cdd206f4a69a55ade5e93
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 35KB
                                                                                                        • SHA256 d9eb13634b9d92128bea63396dd210a3282abf78aca3dab5502cf9df8f93584f
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 43KB
                                                                                                        • SHA256 666bce84d350d7deea8360e771d961aab62bf161e2b83e47d2db3f1cf9e5f843
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 492B
                                                                                                        • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 252B
                                                                                                        • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 132B
                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 372B
                                                                                                        • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        b7cdbd23-0596-4c06-901a-f86e87df66fe.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7cdbd23-0596-4c06-901a-f86e87df66fe.tmp
                                                                                                        • Size 13B
                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        StartupProfileData-NonInteractive
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                        • Size 1KB
                                                                                                        • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        StartupProfileData-NonInteractive
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                        • Size 1KB
                                                                                                        • SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        StartupProfileData-NonInteractive
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                        • Size 21KB
                                                                                                        • SHA256 51cee80e2349c4fca2f9d11b11550a8eac8fbd2c0de7ad2dfa34686b0feb6a60
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        StartupProfileData-NonInteractive
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                        • Size 21KB
                                                                                                        • SHA256 1585bcdd014f32a9f7794f84f24e7c10601f2f193d7fd071ee87c68eaa2d23a8
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        StartupProfileData-NonInteractive
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                        • Size 21KB
                                                                                                        • SHA256 f5c640bc299dffdff7a71becc79004c2cf9760c5a176cc58c2066fce1ee3609a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        240728437_wd.xml
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\240728437_wd.xml
                                                                                                        • Size 2KB
                                                                                                        • SHA256 e7a3ea2e3efdddaf01be9c1c6171c7c69eb2d6e4a28077474788055e7245f5a1
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        SeDebugPrivilege.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log
                                                                                                        • Size 2KB
                                                                                                        • SHA256 4ef2d1e0d41531cbf24b559261586d4abb7f3aaa8637bd895f630ed3b1d3ba45
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        __PSScriptPolicyTest_mxmnrjyw.hpe.ps1
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mxmnrjyw.hpe.ps1
                                                                                                        • Size 60B
                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        irsetup.exe
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                                                        • Size 2.4MB
                                                                                                        • SHA256 4533dd35bd5c1a5dded81a81a6366cc82ddad43c4ae87e7721952617622b89f4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        lua5.3.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                                                                                        • Size 479KB
                                                                                                        • SHA256 b9265b509f82dca729f9ff7515a154e64360b2d07bb364afadc01a02c7998c03
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        content_new.js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4548_1186945741\CRX_INSTALL\content_new.js
                                                                                                        • Size 10KB
                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        iusb3mon.exe
                                                                                                        • Path C:\Users\Admin\AppData\Local\iusb3mon.exe
                                                                                                        • Size 152KB
                                                                                                        • SHA256 89aa5ef4988a7b8e5a3cde0d2633a294cf682318b2fb761bed6f55f942c5a0c4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        memory/1708-740-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-730-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-743-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-732-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-742-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-731-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-741-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-735-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-739-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-736-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-733-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-738-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-737-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1708-734-0x00000000009C0000-0x0000000000AA9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2392-542-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2852-456-0x0000000000330000-0x0000000000338000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2852-441-0x0000000000330000-0x0000000000338000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3212-9-0x00007FF6F9EF0000-0x00007FF6FA6D3000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3212-376-0x00007FF6F9EF0000-0x00007FF6FA6D3000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3212-364-0x00007FF6F9EF0000-0x00007FF6FA6D3000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-439-0x00000000055B0000-0x0000000005616000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-440-0x0000000005620000-0x0000000005686000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-436-0x0000000002380000-0x00000000023B6000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-443-0x00000000056A0000-0x00000000059FB000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-480-0x0000000006E50000-0x0000000006EE6000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-488-0x00000000074B0000-0x0000000007A6A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-481-0x0000000006030000-0x000000000604A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3332-482-0x0000000006150000-0x0000000006172000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-453-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-424-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-459-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-382-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-386-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-385-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-479-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-383-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-381-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-418-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-420-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-426-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-454-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-452-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-428-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-379-0x0000000000710000-0x000000000075D000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-380-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-393-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-392-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-391-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-390-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-549-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-442-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-427-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-384-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-422-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-419-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-455-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-389-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-388-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3376-387-0x0000000000C70000-0x0000000000D59000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4056-215-0x0000017A27A40000-0x0000017A27AF2000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-474-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-466-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-467-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-475-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-473-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-469-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-477-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-472-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-468-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-470-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-471-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-476-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-478-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4076-465-0x0000000001010000-0x00000000010F9000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4860-524-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5704-70-0x000001E0B7FB0000-0x000001E0B7FBA000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5704-51-0x000001E0B7E30000-0x000001E0B7E52000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5704-68-0x000001E0B7ED0000-0x000001E0B7EEE000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5704-69-0x000001E0B7EF0000-0x000001E0B7FA2000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-489-0x0000000007A40000-0x0000000007AE3000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-483-0x0000000007800000-0x0000000007836000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-437-0x00000000059F0000-0x000000000603A000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-484-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-451-0x0000000006D00000-0x0000000006D4C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-487-0x0000000006DE0000-0x0000000006E00000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-450-0x0000000006710000-0x000000000672E000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-492-0x00000000081B0000-0x000000000882C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-502-0x0000000007BE0000-0x0000000007BEA000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5996-438-0x0000000006090000-0x00000000060B2000-memory.dmp
                                                                                                        Download