hxxp://skytech[.]lk

Analysis

user interaction
yes
max time kernel
99s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://skytech.lk
Sample260802-bemlva1ela

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
154	1932	powershell.exe
155	1932	powershell.exe
156	1932	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
156	1932	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301062491335499"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{3787DC44-BA16-4F44-BAEB-5188576EDA14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2092	1492	msedge.exe	85
PID 1492 wrote to memory of 4820	1492	msedge.exe	86
PID 1492 wrote to memory of 4548	1492	msedge.exe	87
PID 1492 wrote to memory of 4548	1492	msedge.exe	87
PID 1492 wrote to memory of 4548	1492	msedge.exe	87
PID 1492 wrote to memory of 392	1492	msedge.exe	88
PID 1492 wrote to memory of 392	1492	msedge.exe	88
PID 1492 wrote to memory of 4828	1492	msedge.exe	90
PID 1492 wrote to memory of 2468	1492	msedge.exe	89
PID 1492 wrote to memory of 4828	1492	msedge.exe	90
PID 1492 wrote to memory of 4828	1492	msedge.exe	90
PID 1492 wrote to memory of 2468	1492	msedge.exe	89
PID 1492 wrote to memory of 2468	1492	msedge.exe	89
PID 1492 wrote to memory of 3700	1492	msedge.exe	92
PID 1492 wrote to memory of 3700	1492	msedge.exe	92
PID 1492 wrote to memory of 3700	1492	msedge.exe	92
PID 1492 wrote to memory of 3348	1492	msedge.exe	93
PID 1492 wrote to memory of 3348	1492	msedge.exe	93
PID 1492 wrote to memory of 3348	1492	msedge.exe	93
PID 1492 wrote to memory of 416	1492	msedge.exe	96
PID 1492 wrote to memory of 416	1492	msedge.exe	96
PID 1492 wrote to memory of 416	1492	msedge.exe	96
PID 1492 wrote to memory of 2016	1492	msedge.exe	99
PID 1492 wrote to memory of 4088	1492	msedge.exe	100
PID 1492 wrote to memory of 2016	1492	msedge.exe	99
PID 1492 wrote to memory of 4088	1492	msedge.exe	100
PID 1492 wrote to memory of 688	1492	msedge.exe	102
PID 1492 wrote to memory of 2684	1492	msedge.exe	110
PID 1492 wrote to memory of 2684	1492	msedge.exe	110
PID 1492 wrote to memory of 2684	1492	msedge.exe	110
PID 1492 wrote to memory of 996	1492	msedge.exe	111
PID 1492 wrote to memory of 996	1492	msedge.exe	111
PID 1492 wrote to memory of 996	1492	msedge.exe	111
PID 1492 wrote to memory of 4472	1492	msedge.exe	113
PID 1492 wrote to memory of 3232	1492	msedge.exe	114
PID 1492 wrote to memory of 1932	1492	msedge.exe	115
PID 1932 wrote to memory of 2436	1932	powershell.exe	119
PID 2436 wrote to memory of 1176	2436	csc.exe	120
PID 1932 wrote to memory of 2852	1932	powershell.exe	51
PID 1492 wrote to memory of 224	1492	msedge.exe	121
PID 1492 wrote to memory of 224	1492	msedge.exe	121

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://skytech.lk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13332277480545562968,5036249755750284703,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,10495016622205426511,6779876238388807660,262144 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,18183107075132424332,7261009484094564593,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16548403007846079014,7350454212821055370,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,794181353081878600,16505697967146701208,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,5409658995574903027,5975464306759131870,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8882536814161956218,1722315437515298532,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5124,i,14808803906313236888,6441353635082308424,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,9649440644945278469,2104640873402321954,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15453683628349930412,2268367030372395369,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10720075347867324591,7665740953655751920,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10720075347867324591,7665740953655751920,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5004,i,1975550315134256975,13814280865358421492,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6024,i,13467067331028745417,6324511909733780695,2097152 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9994509490212236545,8259226293510528026,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3226487295393298717,717376298658502381,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11155417643821184839,6984517453730010118,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,12940183542635777382,12834145786052326140,524288 --field-trial-handle=2404,i,1653036712029767331,15875371295924312596,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1fer4j0b\1fer4j0b.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3B2.tmp" "c:\Users\Admin\AppData\Local\Temp\1fer4j0b\CSC6EEF16D76DA54577BB1B3C3F4997AA20.TMP"
    3⤵
    PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f84bc797307c0ae2ae9e9d8bff4e8596fd63969053871eceacc58b73dbb40220
MD5 57a4b710164ae80241593f38310e2734
SHA1 8b602adab5c8a92ea081fe27a146d65cfc27e5bb
SHA512 cec66983e65a4685c4494608d9ff50f426b42c8526d5a24e7becf16f690b0e6b5759556ddf2fc9aa182eceb59933b4a2b191b8f1ee33cde8207d356fbf8f17f1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bc0cdd72c5b9b70e5330e82c0e098eefce8846a0ffa82a6651f5ab21d5607257
MD5 c0d315a9a5bd020888e984ecf8f28b9e
SHA1 94441662b9f59eec2816df286aab3fa398bac627
SHA512 1cca92061cea8cd3ba60e8c691f3a9e5d7e0a834e1ad36c029834b4259071eb6831b8424a3cfeda81f4f74f8446a7a44dea9d628784952228c53283050e02328
SSDEEP 48:pcmsc4m3w20p/JKhnkUH6gaoGuZP0QaMtg36c1FgmyyBZuDHHrAaOQ3BXUhEZPfV:y6hkKms87CXrAoMlRPonATR8YCJ
TLSH
T10791C5E84BC5755EFB9239F2C2E13990BB34D0C68E436E85024055FC9AC6BF56702C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec33e9b43fa9b7046c67e046cbe2474b287d347c617ad2c4800a9ae3291e9c89
MD5 1e86fc575eccaef5bb225cdea466d04d
SHA1 87cc6cfa0ddf888fcefe1e580555103fa8afcb60
SHA512 461ea92d3b2a2ff9faeb10b56a6c9281f4e72cda1df0df7ebbeb886345903b6c481b38a51f50a1cd1b10685364db5a0692233f1dfb657dee8a5ede80cbbb69a9
TLSH
T10981C8D083C5755EF79239B3D2E179513B34C0CA4E037E4A0254A4FC9ACABF56716C28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d9f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d9f0.TMP
Size 3KB
SHA256 fd56247d2e781b822862ee19c27f2ac169a14b8ea747d47bde28d25638ee8c71
MD5 37a9d0fb3b7f1ecbd4ff06ea31c4a3c3
SHA1 c3de94137dd5b40e33ef1efe4b34e7030e09ed2a
SHA512 68d013b48d72e3ba9cb0faacabbb2f798915bc86e9684b768629b6c40d78a6665b662b6a281b2ba52821ab38b84d334b45b942652509cb410e8250f80bd4419f
TLSH
T1DB7191D403C6759EF3A23973D2D232917770D1CA0E43BE490154A8FCAAD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f92bde27138fe5f7c607dbeebc44ce9b9812dc3bada97f119b9c3840d3a95685
MD5 91022ff97526c6888aba6a3ba9b3a760
SHA1 ade35f2f0bba46dfa1ae27b98157c70324fa3f67
SHA512 097eb561b4e5653148dde39d693a3ecf10dafe852d9a70b2776177130f959dbf680944c688dcd66acbed3afcbc2ae62552c9ddef588e7ac95f5eb9ae0f170680
SSDEEP 96:DgOsY4o0NDzAQC9LUws8qotVyd4Vt7AUwQ:D7sY4o0ND7C9LUwsXuVm4Vt7AUT
TLSH
T109A199B7C3E4C22D8D0212F5A6647D17CE1D09244B683D2AD9D4AE4BF3F1472E2016AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0d8bb5f9b6537088320b76ea94eb00921f111df2e90f3cec152b1e744dca82b3
MD5 84ba22b6664420aaa692ab5e9d549071
SHA1 5a041e877a75fbb88b42c790ecfa98f98910f1bf
SHA512 ab9233053346cfc3744dcb5bdf17db29a82082fc9ea11045122b1500280ed5bc0d3b139d1865048be8f66da9155ea8816dc51d927a3f58c6362b1b8a74281854
SSDEEP 192:sxZgRhyM/jK1Ml8MkB/fesA4AIdpjbHHW6+WN4iQ/YLvlJNIgrJ:sxZgxMB/fesA4BXHbC/w9
TLSH
T1DC42F911AB346A77CCCBD209F955BF53D6F9047292900E54A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 328561571e66f6d11ed28d7ac517ea281c9d49a973cc9351dfce25cbddee4177
MD5 6a808b83a1aec51d3d79e426f3c18fe1
SHA1 7e68c26c369562fa47dc50abf6f01bb900734437
SHA512 d5ca1bf1d2f9a60930ab928a1ab3eff25980416ee10620f653706999f75d6f6c1a125735967f301ec4e8569c93af13d11fa3f4cc141f36a077b58b27dd8097f6
SSDEEP 192:sxZgRhyM/jK1Ml8MkB/fesWpmIdpjbHHW6+WN4JxXYLqjJNIg5sJ:sxZgDMB/fesWpHXHbOXnO
TLSH
T18F52E711AA34AA77CCDBD20DB945BF53D6F9047292500E54AAFCDA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 79e992db2ba7a756a5f4f3cc6b734a52599bfa19a8480e867688d73c13e5d136
MD5 7789c3c53ea73c733c4efad14aceb235
SHA1 b3f07089fb1aef3843d38b11eac46002a71bbfe4
SHA512 1eb30b3cd765db5847838af331e15237e0ab68d63095feda8f007c4c6ad2a2538e412986b3b2b9be3d920d8d0957412c97586036c8f270ae022798bc40333db0
SSDEEP 768:/js6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN8roRG:/js6pD1WvxzWju1jahILIsNnRG
TLSH
T1A4D2FA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 842ed1aa42ccafa34f704fb7b54f5dd7a377af4e4c560a1e852d48defa9b5ad2
MD5 3b771dfc96dbcefbb86241539dc137af
SHA1 3bf01d99700309b1db685d30834c0be49bd73fc4
SHA512 3a38d60779e6a161b0a75af68084b44935c2ec149d7282f3d66ef9810504ea33d34977d3813acca564a49aa0f13f7d027806484a517c7c72100b7c13c9e93104
SSDEEP 96:KUAAKtePW9OK2QSOn2KUUiisoKxWSK0K/aL:iilZBlbio
TLSH
T1BED1061632BB02112C3E390CD3A497679782B6633014E96B7FE860715EA6E384DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e7e0b0f-9940-49f7-8dd8-51fbfbe1076f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e7e0b0f-9940-49f7-8dd8-51fbfbe1076f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f5a1a6645d62e85137338941e6b47cc0e7ba6c365b500d1084210d402cde8d7f
MD5 89c8bd74492e7bdda0ddc9f2e2fa0c3a
SHA1 243ba98b9ecca121b2a74f9879e11e7cc812c015
SHA512 55b01ac24e372c9efe9d8e370cec8884eaae3b955b12ed4acf0a99acf5f2b84de7bf5ec16b0da85c84059df7b421d3ba7b902ac2734633fcb0441619f8a2fea7
SSDEEP 192:uiLsNwfQGPdm7+3vDqQmiU1nfl4atb05O29h2HoN/LMyqqzU8:XsNwf5id6a9gO2MHWAQU8
TLSH
T1443219326868AC675DE3A141F5473A139FB84037DE892F90D6DC6E1C01EFBAC234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 12345fd02ae8c3675689b1d26b621d550d10c714cc6af73f6ba926ece8a1cda2
MD5 fceabda69d464f9c5c1b3a406c7c5d79
SHA1 9122ccc8d5533e2344e3b6b382466b6f98e26d93
SHA512 71a22a05c0b16f1f5e59cb9c9a3721960232d556545da8f65f45a21a1c380615abdf50ee862ffe9c0d95fc49210ff7b58d4ba335105ed1fbd5d0c6e97ca3d2ba
SSDEEP 192:uQLsNwOQGPdm7+3vDqQmiU1nfl4atb05O29h2HoN/LMyqqzLqy6:dsNwO5id6a9gO2MHWAQX6
TLSH
T129422A326868AC775DA3A141F5463A139FB88077DAC92F90D6DCAF1C01DF6AC2307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e05efeeb9111c3503945eea848561a2833d90dc8df84757e0a6e208e62ec08f4
MD5 85a0fd2a34a87765747c5130fb503e83
SHA1 8c534870adfebe2d2b3c39381563d69b37cd6054
SHA512 0e2de8f84bc254d7b9e0d932bb19db95294867961a8942885408e677f22a92d6678276011c014d6172a58c87a45513ca4a7d789e1564addf441d627c5b492b1a
SSDEEP 384:0iFPZcIwfsNw8TUNTUlIlO+57A6a9gO2MHWgQnTKwBODNZOCZWe:PFHoVwg67uOB7QnewBKZOgWe
TLSH
T1BAD207F258DB9876D9AE9743AB7E2D078EBCC063F5846A50B39C990CCC9617FD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f944fbd2e020efd2695949fee7e0d1cc892107693089a11c92a26e7ec9abf3c
MD5 50cb3d75c8008faddb6b0c9f94eccbfd
SHA1 d4522cf58f2bbded93ffbbca7859436283485720
SHA512 f9127ba8683dbabffdb84eac1da8792e39db1a88a717c1601567a7fb0d8518046c5cc1486f9ae407de9e16d29805216c060bd43c4ae0cf38a6742d3c69b73f98
SSDEEP 192:qON3EV6O7+3hQmiUyhzGttb05O29h2qgGReU6:qONC61OGt9gO2MscU6
TLSH
T1C102F9346C386CB74AF3AE46B98737275FA5112BE9952F80D6D81E1C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75f4362857f4c76e43a97b0a79f684676dd1b0dcd5cd51d9b0695b96a36a2d3f
MD5 540925491a8fed4575ee606d793c633b
SHA1 ac73a8e9780c1b7efe88466a06a35974cb0afe58
SHA512 746247ceeace453a0eae930ae2377b5e1b30a35801a7982e25c8f5af2e961f749b1741a46378b4633ad4dc31f1f4410a94d4c24a26a59b4a91751b9bc0fde23a
SSDEEP 192:KONh6O7+3eQmiUyyzmttb05O29h2HoNQcNyqqzU6:KONh6U3mt9gO2MHWRQU6
TLSH
T16F121A317868AC675DE3A146F5873A178FA5413BDE8A6F80D6DC2E1C01EF66C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 81948c318966912c2443d21d483b335250a54d051fbef77c40006c071a9e7461
MD5 92a4bfbdcd6d933e8699a5907781c8b8
SHA1 6da0bc102e17d32f5dbe7f66d649d5b1b43122de
SHA512 b53a64a405f0dc4a821e12c6e4cfa45dd441c5c848885fc537e82011960980e88adc5705f6c7b8fbbdb703d90f47e4f3879b796e19eee2e17ff5367841259030
SSDEEP 384:BsNwh5id6a9gO2MHWAQnTKwBODNZOCZWy:By7uOBBQnewBKZOgWy
TLSH
T17C724B35683CAC675DE3A145F94735078EB88067EA892F94D6DCAF1C01EF6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b515d9d6322a3138feec34516c2032188aaf0101c4a9f96c738ea9dddbac252d
MD5 f2d78385d07d5ddf2c48b582684d5e73
SHA1 93c7313aee0760a221ca752bb0af8469a47896ac
SHA512 cccabb55e9673b97f3d34046c3151c342d5120a4d4ab49f9ef49eec33753cf438d936bb63837057cbe3e650b5d15611b036663359019fc49fe1f6132783b32f4
SSDEEP 384:iZcI1sNwO+5id6a9gO2MHWAQnTKwBODNZOCZWe:Q1O7uOBBQnewBKZOgWe
TLSH
T1EA927D716D3C6C775DE7A145F94635078EF88073EAC92F9496ECAF1C01EAA68130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33652abc-e655-476e-b557-c54be6cc0c76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\33652abc-e655-476e-b557-c54be6cc0c76.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fccc4c3d4083e61313fed7af351df4cfafdd90817b50a295ea6faa26d6368421
MD5 d2e67d784881fca261d24dfe4cc97e8a
SHA1 d817b7fefc325c8b8c0302189b76ad70d80203c7
SHA512 0fb5a85b3bc5544006c5d16831e66b23a4a22dff182d46321246e693f692d8ade6810dff82ae6f4c191a0ca0db17ee02442f2f678914b082fd37fccb6b13119c
TLSH
T1DD413858A6E91149F3B7BE5AABF6A96D887F78332F0BD4AD00110D4F0622A00D871737
MD5 SHA1 SHA512 TLSH

Submit Download

1fer4j0b.dll

Path C:\Users\Admin\AppData\Local\Temp\1fer4j0b\1fer4j0b.dll
Size 3KB
SHA256 5dab7aabddb1ac6d6a89a05e2152b7684adec1709b961791fec21d52b3d35aca
MD5 40a330914c3a31005aedd6ddbd499d74
SHA1 23a72837f5e715d089f41f8d79ff98afd434563e
SHA512 d0eafe0c604278c24cf5aa0e9ec8f63de468b20491c69809316bbbd482f9f16354465a87f726175af76e1803cba347741aebd2402fcea4bbdb102f1a44c6a6ac
TLSH
T1F571FD1A97D8466BE07A0734BEF3031723B4F8549B73A37E4A9442297CA22701D31BB5
MD5 SHA1 SHA512 TLSH

Submit Download

RESF3B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF3B2.tmp
Size 1KB
SHA256 602f2d2dfd6ca1597fcae63074baeaa7c15b88b2c2517dc2e9a122199f63904a
MD5 78a0b25daa0abd53538e31e82eb81fee
SHA1 a7859e48e52917e34b3545f6e789301cdb664cdc
SHA512 fa0a920776f7398ee1776dfd82b78aaa44e152727b987b5c6a726e6614c27f926b2829faa20772706c078492bd9f2a24df026d21484a74301d351ef6c5eeb283
TLSH
T1BB219E0553E94B0FF0775B3179F9036FA178FD64EF62A36B854052282C61604DFA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lliypaml.qf0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lliypaml.qf0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1fer4j0b.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1fer4j0b\1fer4j0b.0.cs
Size 606B
SHA256 b0bcdb5c1d836552ffd334ef5fd1758f23765b0330c717de391830b994575ca0
MD5 b2f05ae3dbe22505e6f4ee487bc173a8
SHA1 2d60899ce1cd4c219abba639f3b174e9b90fc39a
SHA512 974cbc92fb5be6b7acaf3b46e71a29241275b457d6dd1fc7a206fa80bee6ea2b8015815a2b59a241d007151852fbbe71977af35d5fd6c81364af7c12d39b758c
TLSH
T11FF0285423529792A423943E4986F4ADF213407312FE6C00FAFC2722CE47145E23965E
MD5 SHA1 SHA512 TLSH

Submit Download

1fer4j0b.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1fer4j0b\1fer4j0b.cmdline
Size 369B
SHA256 a1d6ff2b1f6b59fd0cc0e763b0bbda5a6646088ce54d4c66ee687f7622ad92d6
MD5 9e2c363946484f55689efc15b4362ca9
SHA1 3bc5739460afb04470b9a8edfa844d3492608cf3
SHA512 be5be16d251727f2b756877e709c9c9c4a8f86c2845f79212434f7a9d7c74b5a45091c0d2628c0e5533b72bb2889e2941b72acf9c0c51ede8da1efede4e2ef75
TLSH
T1D0E0C03B8346CB7DC5DD2407256AC4ACD272874329C27F8453404C0DD037004ABE2783
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6EEF16D76DA54577BB1B3C3F4997AA20.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1fer4j0b\CSC6EEF16D76DA54577BB1B3C3F4997AA20.TMP
Size 652B
SHA256 3302bc3ae9d4bb68bce605587c46baa812dc27a7411ffd4613dbbeb092d0240b
MD5 69b73f9698f9bf55cb74103032c1287e
SHA1 5050a0a2367b691f62a4f2e908ee05ccb07a9d58
SHA512 1b7a0ae6e10c54d29273279dd93080e93d8bfd8ade571d5005216c5f3d8a6071abad06e66422b2547dffc682ba0fec8700f0d3de7445b781fea9e44517aa67a5
TLSH
T196F05E49A3F8020EF0F74B30BDF643A391ACBC64DE32A3ED544003192C745108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1932-433-0x000001471E0E0000-0x000001471E0ED000-memory.dmp

Download

memory/1932-420-0x0000014702E60000-0x0000014702E68000-memory.dmp

Download

memory/1932-407-0x000001471EC40000-0x000001471EE02000-memory.dmp

Download

memory/1932-377-0x000001471E0F0000-0x000001471E112000-memory.dmp

Download

memory/1932-421-0x000001471E0E0000-0x000001471E0ED000-memory.dmp

Download

memory/1932-380-0x000001471E920000-0x000001471E964000-memory.dmp

Download

memory/1932-381-0x000001471E9F0000-0x000001471EA66000-memory.dmp

Download

memory/2852-426-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download

memory/2852-430-0x0000000000C00000-0x0000000000C19000-memory.dmp

Download

memory/2852-432-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download

memory/2852-429-0x000002B8CB8D0000-0x000002B8CB8F8000-memory.dmp

Download

memory/2852-424-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download

memory/2852-425-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download

memory/2852-428-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download

memory/2852-422-0x000002B8B2D50000-0x000002B8B2D95000-memory.dmp

Download