19ea2cefb78779e67ad73881531c8b5e900f77f8d78c08a4659f07805d9c72a1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
checker.exe
Size 8.7MB
Sample260722-dkw4ksaa69
SHA256 19ea2cefb78779e67ad73881531c8b5e900f77f8d78c08a4659f07805d9c72a1
MD5 5c23a6d16e675ca19b74abca9e102481
SHA1 455519ac850d595ffbeb03a900973c594bf21cfa
SHA512 eac7f29973c4aa6333ebae261bbea8deb7408b8bbed9284bb530c5326fb9b6cdd3cb896a4eac7879b142ad52a0937c2260e3ec97cb26337bbaf1cfa8e81f2d45
SSDEEP 196608:phcd3wLvVOpX7XEpXnH2ph1iut1/1QpL0uQg+R1tK/voK7pVFS8:phAEWrXEAphVtrQSg+R7K/vF7tS
TLSH
T19696336CB3E455FAF8F7843C9E51D511E3B278812F52D2BF17B009190E37AA04E39AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1176	powershell.exe
1000	powershell.exe
2756	powershell.exe
2688	powershell.exe
2672	powershell.exe
5852	powershell.exe
5164	powershell.exe
3640	powershell.exe
5688	powershell.exe
2620	powershell.exe
3004	powershell.exe
1124	powershell.exe
5248	powershell.exe
2412	powershell.exe
4572	powershell.exe
4232	powershell.exe
2696	powershell.exe
5488	powershell.exe
5260	powershell.exe
5456	powershell.exe
4992	powershell.exe
1064	powershell.exe
2100	powershell.exe

Loads dropped DLL 8 IoCs

pid	Process
2824	checker.exe
2824	checker.exe
2824	checker.exe
2824	checker.exe
2824	checker.exe
2824	checker.exe
2824	checker.exe
2824	checker.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
5756	bcdedit.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4168	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2840	cscript.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1972_1081766856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1972_1393134856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1972_454863459\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1972_454863459\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1972_1393134856\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3524	cmd.exe
3652	cmd.exe
6036	cmd.exe
4960	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	msedge.exe
5164	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291631219032054"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{2B9C7EEA-EE81-4A93-8D9E-CC27E04C528F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2696	powershell.exe
2696	powershell.exe
2620	powershell.exe
2620	powershell.exe
2620	powershell.exe
1000	powershell.exe
1000	powershell.exe
3004	powershell.exe
3004	powershell.exe
1124	powershell.exe
1124	powershell.exe
5488	powershell.exe
5488	powershell.exe
2756	powershell.exe
2756	powershell.exe
2688	powershell.exe
2688	powershell.exe
2672	powershell.exe
2672	powershell.exe
5248	powershell.exe
5248	powershell.exe
5688	powershell.exe
5688	powershell.exe
5852	powershell.exe
5852	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
2100	powershell.exe
2100	powershell.exe
2100	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5456	powershell.exe
5456	powershell.exe
5456	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeIncreaseQuotaPrivilege	2696	powershell.exe
Token: SeSecurityPrivilege	2696	powershell.exe
Token: SeTakeOwnershipPrivilege	2696	powershell.exe
Token: SeLoadDriverPrivilege	2696	powershell.exe
Token: SeSystemProfilePrivilege	2696	powershell.exe
Token: SeSystemtimePrivilege	2696	powershell.exe
Token: SeProfSingleProcessPrivilege	2696	powershell.exe
Token: SeIncBasePriorityPrivilege	2696	powershell.exe
Token: SeCreatePagefilePrivilege	2696	powershell.exe
Token: SeBackupPrivilege	2696	powershell.exe
Token: SeRestorePrivilege	2696	powershell.exe
Token: SeShutdownPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeSystemEnvironmentPrivilege	2696	powershell.exe
Token: SeRemoteShutdownPrivilege	2696	powershell.exe
Token: SeUndockPrivilege	2696	powershell.exe
Token: SeManageVolumePrivilege	2696	powershell.exe
Token: 33	2696	powershell.exe
Token: 34	2696	powershell.exe
Token: 35	2696	powershell.exe
Token: 36	2696	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeIncreaseQuotaPrivilege	2620	powershell.exe
Token: SeSecurityPrivilege	2620	powershell.exe
Token: SeTakeOwnershipPrivilege	2620	powershell.exe
Token: SeLoadDriverPrivilege	2620	powershell.exe
Token: SeSystemProfilePrivilege	2620	powershell.exe
Token: SeSystemtimePrivilege	2620	powershell.exe
Token: SeProfSingleProcessPrivilege	2620	powershell.exe
Token: SeIncBasePriorityPrivilege	2620	powershell.exe
Token: SeCreatePagefilePrivilege	2620	powershell.exe
Token: SeBackupPrivilege	2620	powershell.exe
Token: SeRestorePrivilege	2620	powershell.exe
Token: SeShutdownPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeSystemEnvironmentPrivilege	2620	powershell.exe
Token: SeRemoteShutdownPrivilege	2620	powershell.exe
Token: SeUndockPrivilege	2620	powershell.exe
Token: SeManageVolumePrivilege	2620	powershell.exe
Token: 33	2620	powershell.exe
Token: 34	2620	powershell.exe
Token: 35	2620	powershell.exe
Token: 36	2620	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeIncreaseQuotaPrivilege	1000	powershell.exe
Token: SeSecurityPrivilege	1000	powershell.exe
Token: SeTakeOwnershipPrivilege	1000	powershell.exe
Token: SeLoadDriverPrivilege	1000	powershell.exe
Token: SeSystemProfilePrivilege	1000	powershell.exe
Token: SeSystemtimePrivilege	1000	powershell.exe
Token: SeProfSingleProcessPrivilege	1000	powershell.exe
Token: SeIncBasePriorityPrivilege	1000	powershell.exe
Token: SeCreatePagefilePrivilege	1000	powershell.exe
Token: SeBackupPrivilege	1000	powershell.exe
Token: SeRestorePrivilege	1000	powershell.exe
Token: SeShutdownPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeSystemEnvironmentPrivilege	1000	powershell.exe
Token: SeRemoteShutdownPrivilege	1000	powershell.exe
Token: SeUndockPrivilege	1000	powershell.exe
Token: SeManageVolumePrivilege	1000	powershell.exe
Token: 33	1000	powershell.exe
Token: 34	1000	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2824	1208	checker.exe	90
PID 2824 wrote to memory of 2696	2824	checker.exe	91
PID 2824 wrote to memory of 2620	2824	checker.exe	94
PID 2824 wrote to memory of 3524	2824	checker.exe	96
PID 3524 wrote to memory of 2840	3524	cmd.exe	98
PID 2824 wrote to memory of 1000	2824	checker.exe	99
PID 2824 wrote to memory of 3004	2824	checker.exe	101
PID 2824 wrote to memory of 1124	2824	checker.exe	103
PID 2824 wrote to memory of 5488	2824	checker.exe	105
PID 2824 wrote to memory of 2756	2824	checker.exe	107
PID 2824 wrote to memory of 2688	2824	checker.exe	109
PID 2824 wrote to memory of 2672	2824	checker.exe	143
PID 2824 wrote to memory of 5248	2824	checker.exe	113
PID 2824 wrote to memory of 5688	2824	checker.exe	115
PID 2824 wrote to memory of 5852	2824	checker.exe	117
PID 2824 wrote to memory of 1176	2824	checker.exe	120
PID 2824 wrote to memory of 5164	2824	checker.exe	122
PID 2824 wrote to memory of 1064	2824	checker.exe	124
PID 2824 wrote to memory of 3652	2824	checker.exe	126
PID 3652 wrote to memory of 4168	3652	cmd.exe	128
PID 2824 wrote to memory of 6036	2824	checker.exe	129
PID 6036 wrote to memory of 2076	6036	cmd.exe	131
PID 2824 wrote to memory of 2100	2824	checker.exe	132
PID 2824 wrote to memory of 2412	2824	checker.exe	134
PID 2824 wrote to memory of 3640	2824	checker.exe	136
PID 2824 wrote to memory of 4992	2824	checker.exe	138
PID 2824 wrote to memory of 4960	2824	checker.exe	140
PID 4960 wrote to memory of 5756	4960	cmd.exe	142
PID 2824 wrote to memory of 5260	2824	checker.exe	144
PID 5260 wrote to memory of 5452	5260	powershell.exe	146
PID 2824 wrote to memory of 5456	2824	checker.exe	147
PID 5456 wrote to memory of 612	5456	powershell.exe	149
PID 2824 wrote to memory of 4572	2824	checker.exe	150
PID 4572 wrote to memory of 5964	4572	powershell.exe	152
PID 2824 wrote to memory of 4232	2824	checker.exe	153
PID 2824 wrote to memory of 1972	2824	checker.exe	155
PID 1972 wrote to memory of 1216	1972	msedge.exe	156
PID 1972 wrote to memory of 4816	1972	msedge.exe	157
PID 1972 wrote to memory of 3480	1972	msedge.exe	158
PID 1972 wrote to memory of 4816	1972	msedge.exe	157
PID 1972 wrote to memory of 4816	1972	msedge.exe	157
PID 1972 wrote to memory of 5668	1972	msedge.exe	160
PID 1972 wrote to memory of 5668	1972	msedge.exe	160
PID 1972 wrote to memory of 1616	1972	msedge.exe	161
PID 1972 wrote to memory of 4852	1972	msedge.exe	162
PID 1972 wrote to memory of 1616	1972	msedge.exe	161
PID 1972 wrote to memory of 1616	1972	msedge.exe	161
PID 1972 wrote to memory of 4852	1972	msedge.exe	162
PID 1972 wrote to memory of 4852	1972	msedge.exe	162
PID 1972 wrote to memory of 6028	1972	msedge.exe	163
PID 1972 wrote to memory of 6028	1972	msedge.exe	163
PID 1972 wrote to memory of 6028	1972	msedge.exe	163
PID 1972 wrote to memory of 2916	1972	msedge.exe	164
PID 1972 wrote to memory of 2916	1972	msedge.exe	164
PID 1972 wrote to memory of 2916	1972	msedge.exe	164
PID 1972 wrote to memory of 5660	1972	msedge.exe	165
PID 1972 wrote to memory of 5660	1972	msedge.exe	165
PID 1972 wrote to memory of 5932	1972	msedge.exe	167
PID 1972 wrote to memory of 3580	1972	msedge.exe	168
PID 1972 wrote to memory of 5932	1972	msedge.exe	167
PID 1972 wrote to memory of 3580	1972	msedge.exe	168
PID 1972 wrote to memory of 2496	1972	msedge.exe	170
PID 1972 wrote to memory of 4752	1972	msedge.exe	171
PID 1972 wrote to memory of 4752	1972	msedge.exe	171

C:\Users\Admin\AppData\Local\Temp\checker.exe
"C:\Users\Admin\AppData\Local\Temp\checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\checker.exe
  "C:\Users\Admin\AppData\Local\Temp\checker.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture,InstallDate,LastBootUpTime,TotalVisibleMemorySize,RegisteredUser,Organization,LocalDateTime | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance SoftwareLicensingProduct -Filter \"ApplicationId='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL\" | Select-Object Description,LicenseStatus,GracePeriodRemaining | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cscript //nologo C:\Windows\System32\slmgr.vbs /xpr"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\system32\cscript.exe
      cscript //nologo C:\Windows\System32\slmgr.vbs /xpr
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | ForEach-Object { $_.HotFixID + '|' + $_.InstalledOn.ToString('yyyy-MM-dd') })"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-Culture).Name + ' · ' + (Get-TimeZone).Id"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_Processor | Select-Object Name,NumberOfCores,NumberOfLogicalProcessors,MaxClockSpeed,VirtualizationFirmwareEnabled,SecondLevelAddressTranslationExtensions | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_PhysicalMemory | Select-Object Capacity,Speed,Manufacturer,PartNumber | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;[Math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB,1)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_VideoController | Select-Object Name,DriverVersion,DriverDate,AdapterRAM | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,Version,SerialNumber | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate,Version | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance Win32_DiskDrive | Select-Object Model,Size,MediaType,InterfaceType | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtected,BehaviorMonitorEnabled,OnAccessProtectionEnabled,AMServiceEnabled,AntispywareEnabled,IoavProtectionEnabled,NISEnabled,AntivirusSignatureVersion,AMEngineVersion,AMProductVersion | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-Service | Select-Object -Property Name,Status | ForEach-Object { '{0}|{1}' -f $_.Name, $_.Status }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-MpPreference | Select-Object MAPSReporting,SubmitSamplesConsent,PUAProtection,EnableControlledFolderAccess,EnableNetworkProtection,CloudBlockLevel,CloudExtendedTimeout,DisableBlockAtFirstSeen,DisableScriptScanning,DisableArchiveScanning,DisableEmailScanning,DisableRemovableDriveScanning,DisableScanningMappedNetworkDrivesForFullScan,DisableScanningNetworkFiles,DisableCatchupQuickScan,DisableCatchupFullScan,AttackSurfaceReductionRules_Ids,AttackSurfaceReductionRules_Actions,ExclusionPath,ExclusionExtension,ExclusionProcess | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Time Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState,pathToSignedProductExe | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "driverquery /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\system32\driverquery.exe
      driverquery /fo csv /nh
      4⤵
      PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus,SecurityServicesConfigured,SecurityServicesRunning,CodeIntegrityPolicyEnforcementStatus,UsermodeCodeIntegrityPolicyEnforcementStatus | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Confirm-SecureBootUEFI) -as [string]"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,TpmActivated,ManufacturerVersion | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-CimInstance -Namespace root\cimv2\security\microsofttpm -ClassName Win32_Tpm | Select-Object SpecVersion,IsEnabled_InitialValue,IsActivated_InitialValue | ConvertTo-Json -Compress -Depth 4"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /enum {current}"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /enum {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All).State"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {D8AA8F1C-7FF8-4099-984D-698FF99D1146}
      4⤵
      Drops file in Windows directory
      PID:5452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM).State"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {563874D7-7435-4873-BF2A-B304F22A20AD}
      4⤵
      Drops file in Windows directory
      PID:612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux).State"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {0A60C002-D116-4D85-ABBC-B9BE901AA6DB}
      4⤵
      Drops file in Windows directory
      PID:5964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "$ProgressPreference='SilentlyContinue';$ErrorActionPreference='SilentlyContinue';$WarningPreference='SilentlyContinue';[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-CimInstance Win32_OperatingSystem).DataExecutionPrevention_SupportPolicy"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\compat-report-1784689518.html
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffc1d94c188,0x7ffc1d94c194,0x7ffc1d94c1a0
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,12769500531606066379,15169838193757010038,262144 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17781440756103876418,14580103235486618869,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:11
      4⤵
      System Time Discovery
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,15832172939892148057,1825067622697129670,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,7381536942780530440,14084591340078576248,2097152 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,1062295878218206338,13405816000090697950,2097152 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2901515675397738589,6955091668933780316,2097152 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2502890752657737720,11664457754295708084,2097152 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,8249893074146914744,11379550317401863273,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7269454964562651495,14458452413166422114,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11521044423965214410,1386070865955093247,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13725062516766679143,6010381097530186477,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13725062516766679143,6010381097530186477,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,81017551487728022,13544205248442201543,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,11624854619279459653,6253510296858387651,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12794944950831952162,1006556103069630362,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2453687138566221942,3112200515391866997,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,15826225113838683805,18165838936422123909,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,16664496272609081694,10672787421600524459,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11831713007628967831,4632477471724383419,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,11964075299725192399,8291205901408449008,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,6105639342397149988,14377522140819039625,524288 --field-trial-handle=2320,i,2636791696993412966,6146363396877281957,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:1700

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv BJiW0wgO006yrXGQzxAv1w.0.2
1⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a628854c4e0bda1b8dc66ad161f3f2b6e4588a0ff88a279802582e697f748552
MD5 1875abd361605fc3cedb3941f39f787f
SHA1 20eb43a25b6470da170047c2dcf769d25a311136
SHA512 8a524c1561b1f09120e94694caa8d9802d6e04df704ca1fe7b27b6f300c2c5c2555be394f456e4491a8886c340ae27681155a0bc47279ba16054894cc17034a4
TLSH
T107619398F32A0BD8DB256ABD14D254A7B2F4A521030B6E144C633CB45A73F8474E3B67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a14a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a14a2.TMP
Size 3KB
SHA256 8214a84da7256d1adb1e48b40759edf170726e750f8ab0f6d107487e83f18372
MD5 ae3ac9f02d3436a66e03ffcf614a0b38
SHA1 17bea6325dc79aa7a8f4203cb7f9db0d59985e2f
SHA512 dd66d9800fe49fc01cdb48a0a03c7080d4a46afa706d9b8f1d7b0db8fe2444ce97454c1ab1eff8042ac27d5854c8e8eb5756e369eec852f1e9433c5e43b4054d
TLSH
T1F261A498F32A0BD8DB256ABD54D254A7B2F4B521030B5E144C633CB45A73F8474E3B67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dc6ebe11ebdc353f5206d798b34534d8a82837d8f6ede3f847be47757987a200
MD5 28cdfd0b0997e3d9ac607083f584dba4
SHA1 289dc34ab1311dbab80fe10db3beb923fe77efd1
SHA512 b4da02b35790dec1348a8b14255504e92ad24421b017bc7a9c700d0e21f76d675b53ad2feee0c6e32d370ae41eb716d3c1ecba0be8f311f82936261802b04790
TLSH
T1A151DEF7C3E8866D890156F0AB147E1BDE1D0915832C3D5AC8E4EF5BA3E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2bf1acd020c464af1c421aa5f8ef047dc6aa12f9b8ccaaa092343e8412caa761
MD5 2cac2f6252d14c582a95dd0c4d155ae3
SHA1 68cea11e27e54cc4459d44aa72d7184e375a5616
SHA512 0fffda9bacfa8f9f0669767eb93bb3eb2194572b576fb3833f67b7d6fa1f799ecf69d0849c731f284cf3caa7b70dcec716e550f1d45699c8feeb06a390d72ce5
SSDEEP 192:sxRqRPCX/f5snwgBZgHnrlPdzoA8p4j/g6+WNIYD9S6S0GShIgDr/J:sxRqIX/f5snwgP6rlPQ2/5I2Skp
TLSH
T1C542C71AAA28993B9CC7D219BB65BF53D6F95033A1901E48A6FC960C04E76DD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1a0734614bd64a3816bac623bf529b52802a3820de8eca1e1c2b8a06d7f24acc
MD5 3db4ebde14fff5813b047dcf5f4bf447
SHA1 a2ca6409e75ec5d6f1a45a0d99711de859dccc6c
SHA512 e1881e17d70fe1e9890f14b03731feefa810c80b617adc25a144fa45249769db3c1f2fc090f3d02ef754eeb2d6600a80951e09c148f3ba48a9b771501bd7ea4d
SSDEEP 192:sxRlRPCX/f5sIwgBZgHnrlPdzoA8p4j/g6+WNIYD9S6S0GShIgV/J:sxRlIX/f5sIwgP6rlPQ2/5I2SkT
TLSH
T1E032B81AAA28993B9CC7D219BB65BF53D6F95033A1D01E48A7FC960C04E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6cb50d84a179313cb8e902af3bb62f49f06d2d2ca77785496dd24516a37ec2ae
MD5 7a338c0a08c2ab7746bacf10a5f16226
SHA1 419edbcc742c0b13763b354a717273ac2c7dbe5d
SHA512 b166f17e6149961de4e438799717c9e3e356296e6e0337ce0a31f46d392700f51d99ec5b2b89523b2ff13713777e1f4032e57db51129b09ce3a72b5f50cd3e0c
SSDEEP 192:sxRqRPCX/f5snwPBZgHnrlPdzoA8p4j/g6+WNIYD9c6S0GShIgD5/J:sxRqIX/f5snwPP6rlPQ2/5I6Skb
TLSH
T1BF42D81AA928993B9CC7E219BB65BF53D6F95033A1901E48A7FC8B0C04E76DD631740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 467f448996e61fecb027d882cb7f05815fafd207a72db1dc05345d025f017e59
MD5 7506a3fbeaa8e460a3f93c6508c6655f
SHA1 788145a7bc03902f97147cab100a4cfac3fa3ab7
SHA512 687e3109121e1f4da7532936e478b7070c4b0a2fc337160181fd00c84afc8f373f10504f0ed21e7709993d102303222cb166343f12e590c2a4cf67e829d56946
SSDEEP 768:azfW9L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSI7dYc16Fropxt:azfW9dE7J0Wg/XfHfu1ja9I7dYy6+pxt
TLSH
T178D2DA7B640CCF7F4F800A9DAD197EDB6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 75b42291214d17fe93e9f45b46027f6212d4f77f30f991ca913b7d377f3b1c58
MD5 3dfc6ab8d24f8a02c4d7132657664bec
SHA1 f81a0dd89354bb805e0e9203cc1f909ca4a2922a
SHA512 3f3a92071eb15feb0f2eadc8a81a0668b3ed08a0493abd33a91b5679986e56e91b780351f58559e17a9a612cda14598beb2444d539f68ba6168ef1d7335bbe5b
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpk3/4HklQUuSW0Wyf/gc0K4xgW0cUUfOSZUvjBp:CB+PrZ7/KPMrTxygd4Bpk3/4HklQUuS5
TLSH
T10E91781835F60680393EB60C94B59D5B82C2B472301AB96B77A851E18F67E239DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 66cc6fb8ff6a962968ad9dd07415bafd5502d070448c4eeaefd12ede8c6be644
MD5 b5e6c6beb0cdb0043a696ca0edcb2111
SHA1 97026824e964c9b67e804d98dae84156ad992573
SHA512 1deaefcc7220b88599379735d5c7f169eca4eaa25de90baa4f03862dc1053b9e0cc3ba3a01cb7c7f57823309dd4a2ec0d6cbdea204c1f04c52e37d0d5315128b
SSDEEP 384:natNn/s3n9S938N2iPjFLuMBWZlf8hyEGGnFiROYQy2rEoajo4cdR8eHhVODjYPm:aj+9m3rcWi0VRPkrEnjN3Gac1FLMj5
TLSH
T1EBF2A0756DA58DB38CEAD38675477B52AFD016A389C00E94DADABA0D05C37EC130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3faa99a4fcd27bd37f08c8991901145b2c5c3d709cce434955fc7089156fddbb
MD5 a420e398b855d9c25f886afb9ee866e0
SHA1 cb75e4c64d4e86a9b5280ec647311e58941eb49d
SHA512 3cdda5ec26aa4eb72dfe4d4f8fc12487c09b04239f47a2ea686c3d6487cbd33cf57fa9012cb28b1fb3911bfcaf22660c0786f9830f693e40ff954bfc851c1a5f
SSDEEP 384:nktNn/s3n9SU38N2iSjFLuMB4Hfc5yEGGnFiROYry2rEoajo4cdR8eHhVODjYPNM:kj+9L3rr5sVRPFrEnjN3Gac1FLMj5
TLSH
T1DDF28E79E965CEB39CE793C677467B42EED016A385C80DD8C9DA6E0C04C36ED170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fac5e219f88e8fbf4ac329c05bc766d8358302fcf71c0405767244aa5eb86235
MD5 42f8924dd2ca4a0c1f59151e89800154
SHA1 33a1fe49c89c0751e99d9552ba3862a08f5fbe08
SHA512 f76e6bd05baa92550b575d1d357e37e06d9b7144efbc81acd678d3a5b83df74391751b94e1113660ccd8de5b616367b9164978fe323ba06426855e4c98bd2d80
SSDEEP 384:nVtNn/s3n9S938N2iSjFLuMBWZlf8hyEGGnFiROYQy2rEoajo4cdR8eHhVODjYPm:Vj+9m3rrWi0VRPkrEnjN3Gac1FLMj5
TLSH
T15BF2B0756DA58DB38CEAD38675477B52AFD016A389C00E94CADABA0D05C37EC130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ed69f52e39ebd67c992d7ea567fc9e3b55c0be59c32814b9009145d540505c76
MD5 f9abd86de3728850946c4c5ce257280a
SHA1 bd886c20e6867496765fd0f9d553b1941537cb39
SHA512 aee585bee78d36f6a159abfc3f3015bf9219881242ca803fdc123500b1f7ef383f01b1578d041ad66396f7c38dca189f8426eaa4aa8feba31af788573eca8b08
SSDEEP 768:rrv+4UNbdS3Gmi0ZrEnjN3Gac1ZweVH1SCz:rbsbg3FZQnjMaDEH1V
TLSH
T14B03CF3669B88EB38CEBA38571477A037FF4525386940BE4CACD6B0D06975EC130B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5d851596dd2f829e0999c01f8d2388743e52c7ae03c84217f83a0bfebff7af1a
MD5 97f4ff7f40d886088bbb67b69e2d7c98
SHA1 dcf7216b4ca5aa8eb6ab45a5c7ad8d91341d2240
SHA512 cc3f6e93a938f24edb5b1f2e3ffd535e9f139f1bd3ec82b672f1da5732e2762ae75d05d9b21f107129996429e20b696eff016884db4ff458c419908412eea0f7
SSDEEP 768:Grv+4UNbdg3r8Wi0VRPnrEnjN3Gac1FLMj9:Gbsbq3rrHPnQnjMace
TLSH
T14913C0717968CDB38CFBE24675477A53BFA416A389C00BA4DAC66A0C05C75ED230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

1a8b7e9d-eb5a-4f38-85c4-8fd0cdb0f4de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a8b7e9d-eb5a-4f38-85c4-8fd0cdb0f4de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download