hxxps://loadspot[.]amd64fox1[.]workers[.]dev/download/spotify_installer-1[.]2[.]95[.]452[.]g5c9bdf32-x64[.]exe

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.95.452.g5c9bdf32-x64.exe
Sample260805-etscesvxhv

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	2008	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303768717889753"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{2BD354BB-CBDF-4DE0-9350-28B4E264C8C4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe
3284	msedge.exe
3284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 3520	1228	msedge.exe	87
PID 1228 wrote to memory of 2008	1228	msedge.exe	88
PID 1228 wrote to memory of 2256	1228	msedge.exe	89
PID 1228 wrote to memory of 2256	1228	msedge.exe	89
PID 1228 wrote to memory of 2256	1228	msedge.exe	89
PID 1228 wrote to memory of 4924	1228	msedge.exe	90
PID 1228 wrote to memory of 4924	1228	msedge.exe	90
PID 1228 wrote to memory of 4892	1228	msedge.exe	92
PID 1228 wrote to memory of 3224	1228	msedge.exe	93
PID 1228 wrote to memory of 4892	1228	msedge.exe	92
PID 1228 wrote to memory of 4892	1228	msedge.exe	92
PID 1228 wrote to memory of 3224	1228	msedge.exe	93
PID 1228 wrote to memory of 3224	1228	msedge.exe	93
PID 1228 wrote to memory of 3780	1228	msedge.exe	94
PID 1228 wrote to memory of 668	1228	msedge.exe	95
PID 1228 wrote to memory of 3780	1228	msedge.exe	94
PID 1228 wrote to memory of 3780	1228	msedge.exe	94
PID 1228 wrote to memory of 668	1228	msedge.exe	95
PID 1228 wrote to memory of 668	1228	msedge.exe	95
PID 1228 wrote to memory of 4448	1228	msedge.exe	98
PID 1228 wrote to memory of 4856	1228	msedge.exe	99
PID 1228 wrote to memory of 4448	1228	msedge.exe	98
PID 1228 wrote to memory of 4856	1228	msedge.exe	99
PID 1228 wrote to memory of 4908	1228	msedge.exe	101
PID 1228 wrote to memory of 1408	1228	msedge.exe	103
PID 1228 wrote to memory of 2836	1228	msedge.exe	104
PID 1228 wrote to memory of 1408	1228	msedge.exe	103
PID 1228 wrote to memory of 2836	1228	msedge.exe	104
PID 1228 wrote to memory of 2836	1228	msedge.exe	104
PID 1228 wrote to memory of 1036	1228	msedge.exe	105
PID 1228 wrote to memory of 3292	1228	msedge.exe	106
PID 1228 wrote to memory of 4880	1228	msedge.exe	107
PID 1228 wrote to memory of 4892	1228	msedge.exe	110
PID 1228 wrote to memory of 4548	1228	msedge.exe	119
PID 1228 wrote to memory of 4548	1228	msedge.exe	119
PID 1228 wrote to memory of 4868	1228	msedge.exe	120
PID 1228 wrote to memory of 4868	1228	msedge.exe	120
PID 1228 wrote to memory of 3284	1228	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.95.452.g5c9bdf32-x64.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7fff8ae7c188,0x7fff8ae7c194,0x7fff8ae7c1a0
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,15456801374164569554,8372124277349354450,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,1794914967005445425,10831378758314148096,262144 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,12908355521078785012,7090216429133503070,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,15499924070606133933,11127432435628087963,2097152 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13770964912698981568,7664034427599561913,2097152 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,12152475409407894047,7808594442333770744,2097152 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,12672826192391160182,818462485817201732,2097152 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,9370186034581948684,7982306411457128565,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,12238616664884003326,17428962723338358393,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10274549758322173069,13060087196173788021,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10274549758322173069,13060087196173788021,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,6375848682691291482,2123618885211201997,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5960,i,2038128299184618749,12156412745107035140,2097152 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10198743649130163328,15609535609827664240,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,14894687478632040805,15103117822204081914,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,14706068912105749350,4407767029333403419,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,12597447659753472645,12586044528709229264,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,16094738668101235414,218494503231018752,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17837000018684854755,12345081302690028505,524288 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1208,i,18104989603662097304,2245159777381235391,262144 --field-trial-handle=2228,i,8521753080488831386,17588016597795199489,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12104dd3c2fda03eed8e9fe97d1c8c331237df73b825255f2c8a4424f9eee8fc
MD5 0272cacbbb6ed8ce74e6c664a085e187
SHA1 e18e3d395cae9ca66345f804f048f752074420a7
SHA512 d7df299a22bf1ed1d6757011261fcc585bb9aee7db699aa7f37cf58e7bd5302ee7ae45218f61624dc842a99548b44160f0e1bd6af1382db157a77eea1ddef3c1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b6ae8319e25f9e8a0f6b274d9f4e897288fe1e869acca125ec1785e3f10c1e7
MD5 2a811c8a3909da617c89c5c06bb124a8
SHA1 404e1cd35f98d48e514c26d205995047cafba9fc
SHA512 d16fa30665161a8b63271d9cb8e5703afc80f5124e60fbd983547c04026ddc5821efbd9fc1328bbd9fcf8f59ee1599e66442ebc3be5b1b6a0c1872dac5107bd2
TLSH
T1E8716E0BC891D892E33FE3F0C5E24E813DBC912B09930EE5A944A4BD98387F1D45300B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ce96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ce96.TMP
Size 3KB
SHA256 40d9e27fef53ebcdad4e6b7129a4c9fdf080a7ad6e119aedad95b1a997df1602
MD5 9a68823b159103f688a457bfdb946201
SHA1 62b7f88e4cdfc8a940b754d9dcb51dcdf0e644ae
SHA512 892d408c621f98ab1683e2e2e7b4ae294a8384cdeff7bc5522b70a94fa894ef699c24ac67f6166570e1538a6b031cd80dc79c66c7d6e8ba34966568f4d7f12be
TLSH
T1B9716E0BD981D892E33FE3F0C5E24E817CBC902B09930EE5A944A4BD98387F1D45300B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dc5fd730901f260b3ec48a911bb2c81017066380e65dfaecddd15b27c41fa413
MD5 97701ced0fed98ea591faef5059465e0
SHA1 1d115a7a6ffcd4ea43eb3d74f42b6c46e9aa2b31
SHA512 79a08f07c8c3de3ad73e257ce0344df22b4e2111d93165fbce8f73cc009e1bd30f09496b2c0a0939e6d7b695d0b9b00f9beb294e5df558d218d4ee219b2d7de8
TLSH
T176219AF7C7D5C66E89011AF0AA24AE2BCE2D0A15432C3C19DAD4FF1BE3E2465E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b8d0e93749941eb8d1bde288b52a4bad5dfd7864f425ed99ecd56da6cdfd74ea
MD5 937a8d222555f944b34e98f2997834f6
SHA1 c3c89c1a6ef9610ae2194e4ed15087d0979acef0
SHA512 0eefdd79d6716a374c99f0924a9f786628266a17abe42207fcf608c6f62e2390786302d8f15508240bd0a0fa5f039a1c361a7a5165431c6ceb37dac9715c31f8
SSDEEP 192:sxZGR+yM/jK1Ml8MkK/fqskirlIdpJHW6+WNGY4kUW7IgrJ:sxZGQMK/fqskKWJHbGo9
TLSH
T1CB4209116A34AA77CCDBD209FA517F53D6F91473A2900E44A9FCDA1C05E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6143e159415036cc7fe9728896f3250237051063bab084d398135784b1b270a2
MD5 333d2ba8dd7874a9d7ec8b16cafed5e6
SHA1 d1b0b230111fdfd37f6e16977f158f73ba487b22
SHA512 6646263eac03eef11b11574d8b58e538e8365743b6707789fee9e3cc2c8c78c81793e1afa3c986e97925c3d9adf6727633f82cd3478b7e4cd3e66c82fe8f3794
SSDEEP 192:sxZGR+yM/jK1Ml8UQK9K/fqsbiDlIdpLHW6+WNGY4gbe7Ig5iJ:sxZGQq8K/fqsb2WLHbGZY
TLSH
T14E52E711AA346A77CCDBD20DBA517F53D6F91473A2900E44A9FCDA1C05E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ade7363843e4745fca3063365d68b9e5b9b69c0a4b113f8e480552ebca554402
MD5 665abb909dba4c4cb4d4d43b6e265316
SHA1 51e437ef39f7be2370e01a155356173b24b673ca
SHA512 8ef6f454a8454698ddc90388ac3ad30a0155c6409520ced725bf394cefa1313891370958d1c6c8f6bf2a71b81a7f362ec100b4e50b83edcc84fb9a65916d8563
SSDEEP 192:sxZGR+yM/jK1Ml8M9K/fqsbiDlIdpJHW6+WNGY4rCW7Ig5wJ:sxZGQ1K/fqsb2WJHbG7K
TLSH
T16352F811AA346A77CCDBD209FA517F53D6F9147392900E44A9FCDA1C05E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8b7e08e19c84e09b336e81fc8b2e865f344acaafa8c67cb5eb473ad3c3dca52c
MD5 8c61d9f39be5b575bfe9233a02781d4c
SHA1 83289b5bcf1ea8328d6bc14f87e221cabed5f3a0
SHA512 9437bd6859edca551f02509514be93753db53b94180dc502b13aae6e0b82ed9eedcbefe0f43b582dec845000236c58192ca49c312052f0b7f07c6ca092eceeb1
SSDEEP 768:0G8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdDro8kgUnB:0G8iJPNWvx76ru1jahALocdwYUB
TLSH
T115D20B3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA890C03C76EA51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6cac2d62f452876bbdec3456141802081edeae38091ebcda08b178aec8f2d05
MD5 9d17bb4b89191201f5917def17b88aea
SHA1 37c54868e3ad16af3b1c1eb5b64aab0517579a8e
SHA512 cabe57f54c3e7c280c6da6cba213775d45fbfd9beb704bcf18c241380f83f5c4ec2c675bdd14a9799ba29138acdfa7adf2eae6d12f5e1ff7823aa5762d576daa
SSDEEP 24:KdIffM9aidqa24qm+9Ijg2KiVha+21EImSm8MF8AnyXYpfEvWazdbXf4vT+2IjDc:KgxINKiAwfyJGInK3qo34IrKVCsDyV
TLSH
T1B291340134BF5A413EBE260C96A08626474171637125A63BBBF900B25E6BE391EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ec8737a1bf2c75e345fced00d27030774c08f573b9ca3de755a9d6897bf2648e
MD5 e8800a1e5f054b17cf94d5d27977eb86
SHA1 1cee7b76722da975a2196bbe6dd0492e7cfea229
SHA512 d68626a3fb31e9db774c1e59bbbe02eb98f2fcaa7cb5e8678b115b86c8962c147c21c97712154fdd458cbd4092731a857e433980710c0064298f3f21e60a543c
SSDEEP 192:uHZMY+xasuheOwQxMl74sNfYXQirg/vmmy6+QmiU1ajA4k03Y9519HIjqIVs+jrX:ySmZcIa4sNfWhrgD76Ovkh951W7H
TLSH
T15B827C716C787C7799E7A545F09636179FB8903BD7C86FD080ECAB1C05DA2A8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2663bc10eedb10affc5789e75a852ab30717bd3d62031291b82eb82283db9a35
MD5 876a6a181f69a841f8497e6d9ece01ef
SHA1 9ffe111c9a49a95b23afcf0721f76a92535a76b9
SHA512 359c7047972db772cdecf0b4b6b9c416b67b7b5c2b6b99334375ba28b1393330d50b15e62ec2c66fefb11d862794feea9a1ddf28afb61d6142014301e5581b5b
SSDEEP 192:uDWLsNfQQirg/vmmy6+QmiU1ajA4k03Y951SLIjqIV0:w8sNfQhrgD76Ovkh951f7u
TLSH
T1BE42293168786C778DA3A545F0973617AFB8812BD7C92F94C5EC6B1C05DB2AC230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31a8e5efe4d228578d9aab0450741561454ee26c41d95e68c291405074e436ef
MD5 a45241d33d0c9fb823910ef3b239778e
SHA1 bf28092f6917c1c36831c87211495aa3c2b5f963
SHA512 ae254b5963fc59d936841f54e63c7e47281f094550e771dd3b0d01274fe41ccd8358276ea7cbb6b4ca504d9a0235ad5c81f9394aba603e650ab8df5390d55a7f
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop5q5DMBhPwivh50xy0SFYKzAxqbsak:gONp6kDfQmiUy0AZ903Y2Qif9U6
TLSH
T18602D83968782CBB9EA3AE05B48737175FD5113BEA952F84D5E81A1C40D725C2307527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 5559f09d8c89363c2a707bb96a8c5b781c815cef5cc85e849af060a9e73c6fad
MD5 b8fabc8730f7bc67f526aad70c11cfbd
SHA1 4b3f477232951bbe6cf4aefce66b70a48cb9af6f
SHA512 11353e256379341ebc0bc1ba172cfaf24042eadf0ddb923e539882ad5983dd8bf69208499f098bb0d50a908e1a23379d2d4ca79eaf78a472fdc618e1c3531eed
SSDEEP 192:uxWMY+xasuheOwQxMJsNfYXQirg/vmmy6+QmiU1ajA4k03Y951SLIjqIVs+jr9Yy:qNmZcIOsNfWhrgD76Ovkh951f7H
TLSH
T11F727C716C787C769DA7E545F09636179FB89137E7C82FD480ECAB1C01EA2A8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 6310d7332da6835234afad213f802a6a894bb2cc1d8bf387150c37fbe2892f0f
MD5 5b162c94caf1d3435adcad7fea855a1d
SHA1 2292282554945bddc30e287f35e484fbf7bf1a6e
SHA512 b7c54fa2606ed9d632fe44c8bbe35f20d074fa6108aab07d6d0e41a2a7347f3b7eb2bf54d813349f2e8250de86c7e2798b9cd77513aafd556dad111924095f6e
SSDEEP 192:uxWm+xasuheOwQxMJsNfqQirg/vmmy6+QmiU1ajA4k03Y951SLIjqIVs+jr9Yy:qFZcIOsNfqhrgD76Ovkh951f7H
TLSH
T1BC728D706C783C779DA7A541F09636179FB89137D7C86FD484ECAB1C01EA2A8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ea2486e27ddc99e67404f910f9ee07cac77c76fb7f794a680719519a7558c9c
MD5 8a5cc8e46fa7367ab452e93daee84609
SHA1 321b48c556f7336e4e4bac3c7e54246499b263f2
SHA512 85eb63442cdbfb6fd31aa2fe844b7c8a54a16723081d133ecaf3a3e65b8e1a508ba58ed3e903db62dfc924d5843c2a249417067d932eab66780242a481bedd93
SSDEEP 96:BNqONk2QsjpfmUTwOK5ih/cIPURHl8h4otop5qyDMBF/Pwivh50xy0SFYKzAxqbU:BkONq6kneQmiUyPAt903Y951JcRjqIU6
TLSH
T193121A3168A87C7B9EA3A445B48736179F95422BEBC97F90D5EC261C01EF2AC230B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7c44be07aa4a9ad6050e896a33ae2a3c04a5b3cce5292948011d1f419fc52f31
MD5 e513f8fc3755335a0cea549a7dcf23ac
SHA1 07eb488cb56c13607510f9f52973b816adc53a58
SHA512 50f2fcb16a4a1a69973175b4aa7c1e00827ce1e6b69558d8e29e44cc918b2180742dfbaafc39c73170827ae71b916d5a5616437fc8b357e20763ebada55331a3
TLSH
T1AC412758AAF91148F3B76F5A9FF698AE847A78772F06855E00010E4F0B63B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j3efiiow.qgo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j3efiiow.qgo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3916-252-0x0000019355C50000-0x0000019355CC6000-memory.dmp

Download

memory/3916-251-0x0000019355C00000-0x0000019355C44000-memory.dmp

Download

memory/3916-243-0x000001933BAD0000-0x000001933BAF2000-memory.dmp

Download