420a4492980aa3eabf4221bc642d521577b3fe90378ca31d5b6db40c89e0f313

Resubmissions

02/08/2026, 22:31

260802-2fdcnsgn6w8

02/08/2026, 22:29

260802-2eq75sgf778

Analysis

max time kernel
26s
max time network
27s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 5KB
Sample260802-2eq75sgf77
SHA256 420a4492980aa3eabf4221bc642d521577b3fe90378ca31d5b6db40c89e0f313
MD5 20e34bc16322a1187ee5fd074942b479
SHA1 8a51616eccae728c71239981db06e0f2e7e61492
SHA512 ba944063a39f369ac6109707c320a9c05c4ddf3373e0a915a6c9737784ad0c9adea6aeacf49296290ff01316929f2eb4c8f8877a6ac6577ca8e75927900f929e
SSDEEP 96:Ka2GHKmExkXiYWgEwI0MwbLdYm4A+WgJ7g9E+p2ePohWMBR:Ka2qukyYWgbFLF4zv6EG2ePohZ
TLSH
T1A2B18527F8C2CAA903F1D5E2A8819044F763131FB6CA6C76F94CD18C4F70199E19EA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4976	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4976	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301834349966810"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{E38BF118-21A2-42C1-A204-DB5EDC274B0D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	powershell.exe
4976	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4724	msedge.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4724	4976	powershell.exe	84
PID 4724 wrote to memory of 4756	4724	msedge.exe	85
PID 4724 wrote to memory of 2440	4724	msedge.exe	86
PID 4724 wrote to memory of 4856	4724	msedge.exe	87
PID 4724 wrote to memory of 4856	4724	msedge.exe	87
PID 4724 wrote to memory of 4856	4724	msedge.exe	87
PID 4724 wrote to memory of 4968	4724	msedge.exe	89
PID 4724 wrote to memory of 4968	4724	msedge.exe	89
PID 4724 wrote to memory of 1248	4724	msedge.exe	90
PID 4724 wrote to memory of 1248	4724	msedge.exe	90
PID 4724 wrote to memory of 1248	4724	msedge.exe	90
PID 4724 wrote to memory of 3492	4724	msedge.exe	91
PID 4724 wrote to memory of 3492	4724	msedge.exe	91
PID 4724 wrote to memory of 3492	4724	msedge.exe	91
PID 4724 wrote to memory of 3872	4724	msedge.exe	95
PID 4724 wrote to memory of 3872	4724	msedge.exe	95
PID 4724 wrote to memory of 3872	4724	msedge.exe	95
PID 4724 wrote to memory of 2240	4724	msedge.exe	100
PID 4724 wrote to memory of 2068	4724	msedge.exe	101
PID 4724 wrote to memory of 2240	4724	msedge.exe	100
PID 4724 wrote to memory of 2068	4724	msedge.exe	101
PID 4724 wrote to memory of 2596	4724	msedge.exe	103

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffafc7fc188,0x7ffafc7fc194,0x7ffafc7fc1a0
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15661027330840573330,8670754127805490726,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,9673188951375075734,9623430837881432166,262144 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,13995593412585928848,8781557519565022986,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4838115519123897733,16657370668212730207,2097152 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2738566883159869427,16768232026300921441,2097152 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,1368822048862623420,16581204626923550171,2097152 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,7867314663091593623,5252287352562230585,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,732965980003011249,18433350720061321625,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9736472962732636128,10144481865247309532,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9736472962732636128,10144481865247309532,524288 --field-trial-handle=2936,i,10989350125999537014,4693945613810548582,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4e7a1d5ee1811cfebf84f773f57811d67ad0c2d6f1e870664dd8eb502ee0839d
MD5 63ffb5a3c9f4c13580aa94b54dacda86
SHA1 3d07086d77a6b2072178020220c0a244af44c80e
SHA512 f3703f0374563731691166ecb01ddf8fd475b364534f19678716fe5400f3e5735e7da28e10858d9c0f57110e575764ac29dde5e17f91d54b3befddf6e9fa7b5b
TLSH
T136E02BBAC835BC3708FA0B6850904F06EA5413172741851F7A3D920A8FF423B02868AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 772fbf76aded0b434591363bdce39451415a41048109960e386037f1565b4cfd
MD5 7ad41cbf50c8c62fc607defe9eb30a75
SHA1 88d3ceebe008985cea412221535323396c34520c
SHA512 c83ad236d77a09f36b82a8bd04dcd94909fc6be59cfe931f763fdaf18247739aa5c6e37712ba664241cc18b35aa238404b84d693780f6e07891ef875217b8b4f
SSDEEP 192:sxZVR7yMqZjK1Ml8Mja/fssm5tCCZtJCzodpoAnHW6+WNryh/YqMLKdIgj4J:sxZVY7a/fssm5EEtJ5BHbA/Vjc
TLSH
T11E72E815AA3499778CE7D209FA45BF93D3F9152391904E549AFCCA1C04E7AEC321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f74968807bbf149f679d31e35b7a244171b4927414ddc0a6dd53d46bd61c631f
MD5 94f9d4b524f4f10ba01922b1e84f5aac
SHA1 d3c8b0a76b94ce81b50dae9631fb9f7174533d24
SHA512 d5b3d1c3cf0eb6c1fad3ab97bfc0d2de3a9e4e86590bb8941bf905b6f83297761bc7d1ca09ccc75186abb7129a0a6a0b586972e708e828b22d8616494d08420a
SSDEEP 768:+IM2tRw7pLuLnF5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHf1sLl2cNV9roj:+IM2tR8EnF5WvF32/u1jayf1sLUcV2lF
TLSH
T1C1F20B3B6C0CCB7A4F844E9CDD2A6E8A6DE8018FA6D8895487F9484C03C76EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2cdbac21e349d96_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\c2cdbac21e349d96_0
Size 191KB
SHA256 ab59345df89e0817afcd02555adcca7b7e7b530ca5fda56f27ea3c59d84218ed
MD5 d6f8f08bdef3f53903c66eaa65484ce9
SHA1 8b08b76f57f27a17d5015b7fd2a5604d554f056a
SHA512 8f20aca788d738768a294a9b4d4f6319e38aab4f18d4377bd6a8aa32f8c075d930f5b1df2e567806778148ec062e250af19cfd88bba571c69873037f739b298c
SSDEEP 1536:ho/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:SSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T1C4146C715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 fbb89ed7543ef7b54b7da626ded82a1f597320722119a4d8fb27b42a51e70d81
MD5 9ef458628198664201b9d535930b44da
SHA1 e60ef9912fcb3248bcae50c47ad410e954e89914
SHA512 de62a1aeeec28f66695732a5a9a1166d172ff1947234c3f7e670076ec2fa266ac3cde7b1cb652cb1ec425934b72e6648818e438310a7f6dfe5114ceb01c192a8
TLSH
T18CA002B9A3C10805E80402703186078023218D119666924381900154D9777657D43950
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d4263e90679ca646d12eb5d432e7233f957788914f8fee8ba16ac2c8ecb5a6f3
MD5 c996530f51ce2bef26866fd6163c05b4
SHA1 4adefbab1c0a4666d3f76e9f6aae869fd8f08452
SHA512 302e1352b3dedff0703464756ab4d37ea604c14bd082204bf41a83914fa61ffd2d452f6462d4bb218ee2ca8862b08f2cdf0dc4f7c27a88c95628b9cf9fcd9904
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJS2:KrFjPXY9/gfrWThFLh/DNTVlrrxA
TLSH
T198B25B16313B12423CBD2C08A7A6D6779D8231B33119E66F7BA904A64E67E125DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6c12463a915bf7ac39679b3c7e56d24f55b20aad45f15f65aeb869b8f1f3d02e
MD5 ca7f0c3dde52d45092da62e77dca56af
SHA1 3fd643307fac8955027a05b62cdedfc17ecd44c1
SHA512 40ce4ea376ad31a6e3210be75b74633106cf15b8a8dd6bb72458389c7be780d378b69982ecabf4af67c06ae36f94f777ad2060ffdd6f8bec31c0066a8605b4ca
SSDEEP 384:nKiF9CcmyWCs3sNm8TUNTUlImkrn7fWmRmitfCUGrcC9ih8H3e4KV8p0UHPty/7Q:BFccps3dwgrdGrf68XI8p0md
TLSH
T1E5B25B36EC68D9BBEDE78F89B74E2A07DEE0112785D889D8CAD81D0D00871ED070B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a9ff7aec8378d242421fb78f5316fec340dae0179a9581e7f513e7c5912bed38
MD5 68038209ec9a007ecb49652c19ba6f48
SHA1 61391fb526850c3a3d895fa0b82a7f93d13eab97
SHA512 1ae267ec610d80bea1fcc2b871a456a14925d3fd32376f2c61b7cc5df3d33257b67cdbf6ea631abb92f51b7fd3488f6a85ca59cb09d29ee315943f0c51bd08bf
SSDEEP 384:nGiF9CcmyWCs3sNn8TUNTUlImkrn7fWx6/itfCUGrcC9ihS2Ne4KV8p0UHPty/7Q:tFccps3wwgxGGrf6S2NI8p0md
TLSH
T1FAC26C31EC59CDBBFCD79B99B74A2A47DEE0117389888AD8DAD85E4C00871ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c4f1f94da70dbb56a45f78cf09d0405a3a4016aaa24145e15eac403c9df2cabd
MD5 b2a230c6be13a4f3df367a202a04eff6
SHA1 b02ba3f4288f4523a92c3976901cd0147113af1b
SHA512 be3192e173c003fbb11dae71d60fc3eca776c8a41e4359b384359275d803f19039db1698033f153da13271976c1a73562b4c873810f477805f62255b480588c4
SSDEEP 384:nGiFiZcI+3sNL8TUNTUlI4k3mn7fW/BOitfCUGrcC9ihSINDWNv+xQAX3ty/7IgZ:tFQ+3gwgb1lGrf6SINDa2xQAXS08
TLSH
T1DAD26B71ECA4D9B7ADE79B95FB4A3643DEE0416388C88ED8DAD85D1D00831EE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e25c4806be6eb38f639edd19fb06180e07e4c0d62ebe6891d8fa9c6b94d8a9c7
MD5 571433116750991ede2a39907d2c3167
SHA1 31208bb94d7a6a70c5befdea8e3ae3960e7be58a
SHA512 cd40598cd3c5a068c28bdfc3d4bda87dcf6504112e4606296b19f04bbe6fc66840c23484f633803e0db36957d2768aa33a5d50bf5d2caa9ae05ad0aa952c88bc
TLSH
T110412C5CB6E91108B3B36E5A9BF7A86D847FB9771E06D45E00110E4F4666A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0a0wqut3.rn4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0a0wqut3.rn4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4976-0-0x0000027302490000-0x00000273024A0000-memory.dmp

Download

memory/4976-62-0x000002731D740000-0x000002731D95D000-memory.dmp

Download

memory/4976-9-0x0000027302490000-0x00000273024A0000-memory.dmp

Download

memory/4976-1-0x00000273025B0000-0x00000273025D2000-memory.dmp

Download