hxxps://www[.]mediafire[.]com/file/nzlgha33gkcyx94/MALAWARE!!![.]txt/file

Analysis

user interaction
yes
max time kernel
900s
max time network
734s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/nzlgha33gkcyx94/MALAWARE!!!.txt/file
Sample260809-kxtbsack8x

Score

8^/10

bootkit discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
530	5160	powershell.exe
542	5160	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
529	ifconfig.me

Modifies boot configuration data using bcdedit 4 IoCs

pid	Process
5904	bcdedit.exe
1820	bcdedit.exe
1832	bcdedit.exe
2752	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\hal.dll	powershell.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	powershell.exe
File opened for modification	C:\Windows\System32\winload.exe	powershell.exe
File opened for modification	C:\Windows\System32\winload.efi	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
904	powershell.exe
2404	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3548	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307395618097043"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{ED0100EC-FD54-4E8C-8DC0-7FA68AA476E8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
904	powershell.exe
904	powershell.exe
904	powershell.exe
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeSecurityPrivilege	5892	msiexec.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeBackupPrivilege	5904	bcdedit.exe
Token: SeRestorePrivilege	5904	bcdedit.exe
Token: SeRestorePrivilege	5904	bcdedit.exe
Token: SeRestorePrivilege	5904	bcdedit.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1284	2476	msedge.exe	85
PID 2476 wrote to memory of 4668	2476	msedge.exe	86
PID 2476 wrote to memory of 4764	2476	msedge.exe	87
PID 2476 wrote to memory of 4764	2476	msedge.exe	87
PID 2476 wrote to memory of 4764	2476	msedge.exe	87
PID 2476 wrote to memory of 1584	2476	msedge.exe	88
PID 2476 wrote to memory of 1584	2476	msedge.exe	88
PID 2476 wrote to memory of 4596	2476	msedge.exe	89
PID 2476 wrote to memory of 4596	2476	msedge.exe	89
PID 2476 wrote to memory of 4596	2476	msedge.exe	89
PID 2476 wrote to memory of 812	2476	msedge.exe	90
PID 2476 wrote to memory of 812	2476	msedge.exe	90
PID 2476 wrote to memory of 812	2476	msedge.exe	90
PID 2476 wrote to memory of 1776	2476	msedge.exe	91
PID 2476 wrote to memory of 2484	2476	msedge.exe	92
PID 2476 wrote to memory of 1776	2476	msedge.exe	91
PID 2476 wrote to memory of 1776	2476	msedge.exe	91
PID 2476 wrote to memory of 2484	2476	msedge.exe	92
PID 2476 wrote to memory of 2484	2476	msedge.exe	92
PID 2476 wrote to memory of 4276	2476	msedge.exe	97
PID 2476 wrote to memory of 4276	2476	msedge.exe	97
PID 2476 wrote to memory of 4276	2476	msedge.exe	97
PID 2476 wrote to memory of 3772	2476	msedge.exe	98
PID 2476 wrote to memory of 3772	2476	msedge.exe	98
PID 2476 wrote to memory of 3936	2476	msedge.exe	99
PID 2476 wrote to memory of 3936	2476	msedge.exe	99
PID 2476 wrote to memory of 3892	2476	msedge.exe	100
PID 2476 wrote to memory of 3892	2476	msedge.exe	100
PID 2476 wrote to memory of 3892	2476	msedge.exe	100
PID 2476 wrote to memory of 4172	2476	msedge.exe	101
PID 2476 wrote to memory of 4172	2476	msedge.exe	101
PID 2476 wrote to memory of 4172	2476	msedge.exe	101
PID 2476 wrote to memory of 420	2476	msedge.exe	103
PID 2476 wrote to memory of 4232	2476	msedge.exe	106
PID 2476 wrote to memory of 4232	2476	msedge.exe	106
PID 2476 wrote to memory of 4232	2476	msedge.exe	106
PID 2476 wrote to memory of 2592	2476	msedge.exe	108
PID 2476 wrote to memory of 2684	2476	msedge.exe	109
PID 2476 wrote to memory of 2112	2476	msedge.exe	110
PID 2476 wrote to memory of 4460	2476	msedge.exe	111
PID 2476 wrote to memory of 4460	2476	msedge.exe	111
PID 2476 wrote to memory of 4460	2476	msedge.exe	111
PID 2476 wrote to memory of 4492	2476	msedge.exe	112
PID 2476 wrote to memory of 4492	2476	msedge.exe	112
PID 2476 wrote to memory of 4492	2476	msedge.exe	112
PID 2476 wrote to memory of 1500	2476	msedge.exe	113
PID 2476 wrote to memory of 1500	2476	msedge.exe	113
PID 2476 wrote to memory of 1500	2476	msedge.exe	113
PID 2476 wrote to memory of 3184	2476	msedge.exe	114
PID 2476 wrote to memory of 3184	2476	msedge.exe	114
PID 2476 wrote to memory of 3184	2476	msedge.exe	114
PID 2476 wrote to memory of 3804	2476	msedge.exe	115
PID 2476 wrote to memory of 3804	2476	msedge.exe	115
PID 2476 wrote to memory of 3804	2476	msedge.exe	115
PID 2476 wrote to memory of 3360	2476	msedge.exe	116
PID 2476 wrote to memory of 3360	2476	msedge.exe	116
PID 2476 wrote to memory of 3360	2476	msedge.exe	116
PID 2476 wrote to memory of 4808	2476	msedge.exe	117
PID 2476 wrote to memory of 4676	2476	msedge.exe	118
PID 2476 wrote to memory of 4808	2476	msedge.exe	117
PID 2476 wrote to memory of 4676	2476	msedge.exe	118
PID 2476 wrote to memory of 4676	2476	msedge.exe	118
PID 2476 wrote to memory of 3052	2476	msedge.exe	119
PID 2476 wrote to memory of 4520	2476	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/nzlgha33gkcyx94/MALAWARE!!!.txt/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,17804718596120301746,17234599813197989191,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2506880097990366463,14786994994739692896,262144 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,6149933051599585169,376801651414778161,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10276933372662760289,15200366040576825379,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8839472636535816788,3881852005239423459,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13309470758565361639,2361387131904502389,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,15090309583367898732,9698209859320189109,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5136,i,1419164223263411549,9116846217139602670,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13780357484446302211,17911218070183158888,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8186382468732201393,5189412082879758475,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5892,i,3729005170970751211,13772108578803577420,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6148,i,7161350311752041294,16478003024288818077,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,9705005938013094093,18308138753537810425,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,9705005938013094093,18308138753537810425,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6016,i,6163255436991660295,1459772658689101750,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,17458847882967768973,11788838714386537709,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15165768484220166056,18098505459476573414,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6084034479145186385,2176188070398377150,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6856,i,11451418983161113905,16445018752273723732,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6876,i,2923921640585214828,9927191847656685509,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5852,i,13481099565288756011,7340036575116243018,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4468,i,8299668122765002729,995076598158511006,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4516,i,3674514804034388652,1267118583440003728,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7316,i,15599041197340226260,6675848842115669238,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,4387219835698814849,10252173276476332515,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7600,i,10215011334340344620,3747902878640731462,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,7871007977556248733,2156264156163934223,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8044,i,11635300717103410950,5880434363019972852,2097152 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11785508424149882419,11870425331638411153,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11785508424149882419,11870425331638411153,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,3111117085730580463,16863855875616559829,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2136,i,3357753725772177351,6265926261794249366,262144 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,15012543931104474696,11936436520643263552,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1652487251936601271,1261283305997088736,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,9764402654638871950,2846855331168255010,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,1956368002954826461,17160003598283212190,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,2203550131396705930,14192487551132024097,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7712216505323241092,9477696105811951509,524288 --field-trial-handle=2356,i,4655860744741608577,3688175087291374904,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\MALAWARE!!!.txt
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd3196575h60f2h4a0dh964ah0ad9fe8f4999
1⤵
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd3196575h60f2h4a0dh964ah0ad9fe8f4999 --edge-skip-compat-layer-relaunch
  2⤵
  PID:5324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ypsqux2t\ypsqux2t.cmdline"
  2⤵
  PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /export C:\bcd_backup.bak
    3⤵
    - Modifies boot configuration data using bcdedit
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" -noninteractive /delete -encodedCommand ZABlAGYAYQB1AGwAdAA= /f -inputFormat xml -outputFormat xml
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1820
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" -noninteractive /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat xml
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1832
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" -noninteractive /delete -encodedCommand YgBvAG8AdABtAGcAcgA= /f -inputFormat xml -outputFormat xml
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x518
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 940d17921bde8de627e1df6a2514c8b3fa162d125a077e8179f39b5b8c9051cb
MD5 8f1976d278f5f3878b71e37366030520
SHA1 2e1a106c74408bccb299bfe5d6c47bfc6830d443
SHA512 8bfb55b62052ebb4ad84ddc2856f84c4fd88e93032fd4fe6b83405a4748dfa127f9c01d819995bc08a7b34a940622e650868f0b9546ac5df1bc6c24f7018fd3f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1FAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 47aaec1be2c9f183bd9bcd94246f26fbdbf431cb02883e5437e1e796353bd3bc
MD5 dad3b6b9edf0b903f6d859b3353ce733
SHA1 ad37df0d4ae4e00e97f55dda461ec129cc69bb47
SHA512 2cee771b757eb75caf0fc3df72852ad5c4279706b4c1f687179c96b4968c036d853fa56a10a5d0e9937413fae5a2624b7ac0a2984c769c5b308b759a45b18d04
SSDEEP 192:6jo4arnnnnnnnnnnnnnnnnnnnnnnnnnnnnMFLO:6jo4arnnnnnnnnnnnnnnnnnnnnnnnnnl
TLSH
T165E1505A42D4CB9A9F05508B4AA0775D50F0370EEBDCE508378C9DD9318E89EFCF9AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 dd35fdf05c5809e6a66a8dbfe4dd41d3f6234a02ef221648156aee2df94f4aa2
MD5 3ddd5d3cd8f45c440374ac35374abcb2
SHA1 a2a57e3675c40e21ba2366fdd56872d48fb29aa6
SHA512 50bc14b5529e7df144534ed702ad5431ce2ddceb875030355e1f1240b987706070f1a4b3aee26ce0eba27671c0f1ae06d6ede3773bd91ef8b5e8a35c96f361dd
SSDEEP 192:PjoBHUUUUSSSSSSSSSSSSSSSSSSSSSSSSSM+LO:PjoBHUUUUSSSSSSSSSSSSSSSSSSSSSSp
TLSH
T18CE140864AD4C7AB8F15108B49B0A35E90B1370DEBDCD608135CDDD9358E89EE9F2BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 3727a731d69c5e59d0011f676798143bcbaf46186784477554bdbfac5567392f
MD5 1bd563ec8351e2cf23b6871aab6d567b
SHA1 1ecc64c87dce394a6ffd9fe8e518421549b926ba
SHA512 118b14828129d49d0969b441b6c5851b9234c9379a681747b66d2a041e8b8deadfb94ee3a5cf6a766f91cdd1298770d993b557d7fc51a29d01444fb42b28e29b
SSDEEP 192:Q8j1lw7ttSYY8Vfc11uu33d/IIRR22//kkkMpLO:Q8j1lw7ttSYY8Vfc11uu33d/IIRR22/Q
TLSH
T1F8E16A4B86D5C39BDF05508F4AA4525C51B07B0EEBDCE908239CD9DD324F8AEF4E1AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 386cb06a362b1658f7b3b7157dbc4034e129e98fa2ef85215d4bc9c716c1f439
MD5 0685303e94443675d0cc5afdabf322e3
SHA1 49ffb0c434a68db60b644dcb36697d8b4728ab23
SHA512 f1b564381f603e5a205cc937ab60aaae02d897d62655522d870a113719cc2c364bfd412255d5af94747ccec3f0fe447700c391ff5100bbc91d4e626239c733ef
SSDEEP 96:WEiY8ILDhbqQHdDC8mtv5j0WDv7UF6dfHT:WBNkDNqWMDp5Nv7UF6JT
TLSH
T1E591B3EB0C325841EB502630D8D13B8874BC44974B5F5E2E4A649FFF5A0EBF18D66C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fe8e13c6540980783b991ae2b80367ed7eb33c896f1caa9d31db9073b4479a7e
MD5 6493ebf3e0ad467ab7eb2bab069aa21a
SHA1 1b67384a39ddc1bfa9f38f990a684f181c18304f
SHA512 6696ee3692b4664ff8a00cd0b1365403533735998831609fe1c33ff47ecab087eb4d90ad1595b9bfe083961e16a9aa2e7640f74d4e4f403d5e72a27eb5e8c4a2
SSDEEP 96:mRoimaILcCbDQGlP19h/8mtw7TjrWfM7iF6Ih7d:mrxkcuD3P1DCv0M7iF68d
TLSH
T1D9B1C6EB09755810EB502630DCE13B8C38BC4083679F4E7E5B299EBF152E7F9C922918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a478.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a478.TMP
Size 3KB
SHA256 57ea95391d103fa13f04550a00937cad38215469666cd1fe06fd8f7118b293e0
MD5 35182cbf814a3c92a2cdddcea5cd504a
SHA1 389d251d399d862245f8da5535d8792f07726821
SHA512 52e6d5efda3058f042765e6240bc02d4a91501973d288461f48bd9fa2b8c6b83242b1319d161a0038cde61ab5fe88189ca81e350a0cf2aa3923e57dc3521ec31
TLSH
T1AA712BDB0D324981E7912730D0C1374471FC89A70B1F9E4D8A689FBFA5167F28E26D18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 8a9fdfe6e8d6f18b2fbb345602f842476967618cf909f7d440713a0218e496d2
MD5 b93a377f94d16aa65d69bebf319ca091
SHA1 8c933c3c9a3fb8697d7c0d9acb578e5e3e77f795
SHA512 68d3271bf06696d3b82f949e3e4aac1dd07b5637482cce95f6cf80eba1391a8e13cfaecec4ef2f0712879dfbd22a4a9839fc427719fe3001de0255e70564b9c5
SSDEEP 384:DWdESke/ft7GDbB1Xe/PhJ4+viMmoRJYReOpBe27y4IYAkYKr1a9x6sKmY+LA3zH:ARopj4Mg+skfBy0OChnv
TLSH
T16A9278F753A1D62E8A115BF896049E1BCF1C1226432C3C2589D1EE87E3A3073E16E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 83936546ab22f3c90e0e02e8031051b92a51847d9f195bd71eb692f14839d6d4
MD5 6e00758bbcec96431cc515ee6f09b5f2
SHA1 137620338069070945e872792b08e194cdbefa1c
SHA512 3b5136748255d85fa467523a4e20ba61d12c722f9959edd07de239e65706d2f897bdc0835badcfe93b0c24c2c77369b05d52351b8f4ac9058ae0a7421cf4696a
SSDEEP 384:DEjLBJFWP1r73VR6+e6HZJRlA/mDkVJWteCUBhy4IYY4X1YHK17g7JhszmY+Lhx3:fyHVjTuSgSbkfGukRTz6
TLSH
T195B277F383E5D62E891117F85614AE1BCE1D1619432C3C2989D5EE8BE3E3072E16A74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc7d9728a5f507ad99d5f870727bd384503d4917d95b8c0bdda86eb5134b69fe
MD5 eacaa95b3612cac54d3442ce2d0467c2
SHA1 e1d563a30edeb2522df691e8c35374587bcc6b45
SHA512 4c99df6d009bedd4c5a83a262bd6a0c5e178621ab9fd3065559e219376fe2c828e8b9946628c8596203893bf2d6a4d6d8c6ce0aca358609b1552b99f8aaf766e
SSDEEP 192:sxZU8RIiyM/jK1Ml8Mko/fbsaBiBnIdp8FHW6+WNm1m4/YLMWkuFDIgrJ:sxZU8vMo/fbsgiW0HbgZ/BA9
TLSH
T1F75209116A34A977CCDBD209BA55BF93D6F9043292900E58AAFCD91C00E3BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5fdf60e03f8a288c629ab5f2157d8bd579e724db9a4da64d58ccd99e3311a31b
MD5 92cb5933ee6c74e4135d5755af24ac52
SHA1 7a52f552169212e91f25c8b82acf778d1366b313
SHA512 20b7999f19227558fdd618eb6fe4d73cd0b163cecf17b320dbc9ac0a35f9ca0eaef83fb79340e7ae780a9a89361fae31c12321e54959db283b979af4d3dd64ae
SSDEEP 192:sxZU8RIiyM/jK1Ml8UQSlo/fbseBTB5IdpbGJ2yGHW6+WNPW1MUEZYLIYRPFDIgS:sxZU8vqqo/fbskTIpHbvZGS
TLSH
T1AA62E852AA345977DCDBD209F941BB93E6F5147292900E58AAFCDA1C04E3BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aa34f64d3b10ed0b36f7face13a2f59ea99d77c16a018bbdf73069519615db5c
MD5 ca593b31224cafe87564dcddc4b39713
SHA1 dfeeab45a74b373ac82342165ac98cd375d31c6e
SHA512 dd34e9482d608c3d4915a161b6dabed0e6eca02e1b9acd1d5bb97d663a12cf1aedc49bff86f4c7a4838b7ae802b0abddf2eaf25073291a3d2e2ff585f77ba78e
SSDEEP 192:sxZU8RIiyM/jK1Ml8Mlo/fbseBTB5IdpbGJ2yGHW6+WNPW1MUEZYLIYRPFDIg50J:sxZU8v9o/fbskTIpHbvZGS
TLSH
T1F962E812AA345977DCDBD209F941BB93D6F9147292901E58AAFCDA1C04E3BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 21931616dcdf7c30d285e947393dc9313b03a463b5027382ae81fccd9c82b31c
MD5 10f77920dc3d117fe01697c2f6788e60
SHA1 e8ab4b82e78e255798f9ec67f81dc32e2bdc5836
SHA512 27c00af8628c48511dc8930081b5025b7e13ff7702fa485afaeb10cb16da18b2b347afbf26c08550c133468e61032b0d7a715a3dd9d9f51714ad7e1fdb4fdc8f
SSDEEP 192:sxZU8RIiyM/jK1Ml8Mdo/fbseBTB5IdpVGJ2yGHW6+WNPW1MUEZYLTjuFDIg50J:sxZU8v1o/fbskTIvHbvZFS
TLSH
T18362E7126A346977DCDBD209F941BB93D6F9547292900E58AAFCDA1C04E3BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b530300ecd54ee87438c8b809eca590bce60f486a8df8af5ff2f2ebae1148554
MD5 f7e1d7b649c28943dd32c4bd2e98c1a9
SHA1 0f898d68537ae68057d992dda68f48d5d23df696
SHA512 fffb212777e1d4e0b7a738e307b3413a85a780a7b9ec3d46447770df78b0b8e7300dde28f2bcc1288ea5c000a15355c27f07a0b26732ef96dbcd1a44bb772dfe
SSDEEP 768:aIs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNJroEK:aIs6pD1WvxzUju1jahILIsNiEK
TLSH
T14CE2FA3B680CCB7E4F841E5CEC2AAF966DD801CBAB94895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 853b744b291e14631667afea3089141240c5a01bcbc5730cada7571765bca0ea
MD5 fdad64db0a1c96186194586396c995b1
SHA1 8efd5092a296e9bf66345cd642aa5d046b0b38dd
SHA512 9e96495c5621657282631405684cedec00ca71cd4de538298b393c2af85e4fa84403384b62d04735bfa42df31bdc1337e16cd1a546a62a9a8238555fcefe4993
TLSH
T1AE51D84E4F61895AE8BC02B314B2949033759CCD4B82DA1768FC1236FD43B692D0B2EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cddc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5cddc5.TMP
Size 2KB
SHA256 a9ee15a3dce887dbdda2e6e0281de6af54d69fad8b07f1a344d01f965cdc561b
MD5 1bc82163b9c11ddbf41e04b9f969418e
SHA1 1db62a645dc4142540a514600101a99f2c239e8d
SHA512 8f1fac1b3cf8cfad8d07a1b8b19f34408662a4d149cda042feddf42a785a072db4e9d2c3272e0eb9ab4c27f823d780a5c720565faaded4828d565b92a6c4bcdd
TLSH
T1BC51649E4D824A39E894417709E3A8B437392900C719BF5374FC9636AC9379E3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 80d52a9c6925d78d8b5083ca3b7f0f8261fc8f462d137118ae0c1ad1da9d358e
MD5 1841f33401a4fd96eb31506e1362c886
SHA1 13c5842ccdda85d48ea13aa03520d70918b07291
SHA512 59093319f59070479f4a940636d7c0eccb70decd20f9dd21aa4cd31e9b43b2acababb3d46a064f6cbddcf27d6f4db0fc985fb1627c36c4885508e64f73548afb
TLSH
T199E0D8BB6EA76820EDABE3E7247154750141381CC805BC4F546E96C750B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

002e21f0e454ee70_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\002e21f0e454ee70_0
Size 63KB
SHA256 2220f52f5e6d44d29401dac936bf9cb5ab885956377a816a5e8dedc5a2e379e6
MD5 759ceeb15e3e899d2ecf171ce1135613
SHA1 5ffe486c042842f9fb58259d88551a359db82ac2
SHA512 5e570e31064a102efabbeb3743da51d76d4791c73782d0e8aa7ac8c09e90d3431a0dd287cafa27f242dfaff88a6c0ad5b540d9994ca2ddd517b559779eb07adc
SSDEEP 1536:W8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:W8k3vFpxh4Y473qW
TLSH
T114536BA6377178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E44AA60267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 86452c5b4109144ea1630386b0e217fe3200930ddbf37d37dc181871f8b08c5a
MD5 f82f7ade9ec80fa9d31beb9b055a4e8f
SHA1 bddfafe6c99da69fd31f2d6fe1d2a59e0b25bcbb
SHA512 f58bf363951332c631a29ea48b12366cce681a14a1c962c8732ab5262bb2bb1b4591f1e37bf8fdb3116bd5faab6ddf1e9a263a421931e9296bdb71215ad5fa18
TLSH
T147A002142645B805D10116B01F87024633118A198B25161E55D22049E8DD2538511315
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5c2ba08e87bc9bd353d40d3a4d1d25a675c5fd37a252a918343b1b0f3a106f40
MD5 9393e35c0dba2cb1053e4894f1481ce7
SHA1 a97f75bbc5979626ff7dbe06b7360823bd29d99d
SHA512 8e90f9684889fa891a354a37491cab17bc1891f6969dcdefbe0dd8caec2db3a27a8bba4c447bb46d10df10f5e7c8e2a1429d5a0e93b893afb728f271843aa7bc
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIypOIPKTC8pKIPK3qkfyp0IbK9Kca:KUAAKteP6OYKTCEK4K3qmq0gK9KN
TLSH
T1EBB1021371BF06022D7E2A1EA2549727A7427163301DA42B77E950B11E6BE384DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c36.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6f7c83cb1cb6339cd02c0e9635018df4b93ae382c43242859bcbc7b2aa5d2736
MD5 7f6721e7af696bf3fb428ca99ec51675
SHA1 c2882c8ee77542cf532b1ab31a6d98e1f8919ca3
SHA512 a1f436fbeefa4b33c66c0008d6f45957ab8bc262e1958ef7322a418d625cc238f9377a1a79baed8bc41710469a6489e9f7b1cfcf67900a98a9fa607568f90092
SSDEEP 384:0ZcIhsN4VPCCocZPa95OVnuzJrcSnTKwBODNZOCEWI:yh9CUCjOJ2hcSnewBKZO9WI
TLSH
T12D927D72683C6C766DE3B145F98B32078EB88163EAD52B58D5EDBF1C00EA658130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9e5cbca73bea356bc7df746a8496f6cb432db7c0b18a1c27082a3b98b492a5e2
MD5 123de80ff69f0d8f5dab807702803f9e
SHA1 e458c9fb36318af765c40e8f0e3b4e0083aee02b
SHA512 156cae5300593d8edafa7e69ed7b7d94390e4058b9aedcd567d09c003edc11834b503b3623430f2d8239692728c50fbaa34e205af4d00a144593d30c5f32e1c5
SSDEEP 384:ziFFZcIKcsNo8TUNTUlIlvPCCocO++7da95OVnuzJr2SnTKwBODNZOCEWI:eF9pRwglC/++7gjOJ2h2SnewBKZO9WI
TLSH
T1A9D22AF258EB9876E9AE5743E77E2D078DBCC063B4851954B3989A0CCC9617FD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7e4bd38476cafe3d8b5c267801e29116f8fdc36b36bbd5b557c86c3c806dcfa
MD5 3b3d672cb1dc7b4b49b0182de79a8401
SHA1 021acf89abf2e261969e35fa99236b0372223048
SHA512 3874460be294dd01ec9ef93ade68c95b3f370b7b2ba079001e0b38b650a1b52d96ba039b770d2a3c073c608dd839e66f8e3b13197801a872e754cd777f3a22cb
SSDEEP 192:qONi6O7+3hQmiUy/hGttb0gO2KDgGJqdU6:qONi61OGt95OVHIdU6
TLSH
T1F402F8397C286CB79EF2AD45FA8727179FA5113BE9A12F40D9E81E0C00DB65C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e62e1a922fccf11af1d834f818d5fb94cb64d1d35b117cdbbd8b7c69e16209b3
MD5 2620743003c16d0a23580389bdadee66
SHA1 cf48a7177fe0dce09c60400e0b6aac6c464e377c
SHA512 ce57a782534a0d9f8e7de6a4d50c27c71aba0fba8cb25be33237d3177e7aed3b063ca32dd3d2255853f6285fb4345ba2d57654e0ce6eac22aa78f722b9c03589
SSDEEP 384:YZcI6sN4vPCCo+Qda95OVnuzJrKSnTKwBODNZOCEWI:m6PCPgjOJ2hKSnewBKZO9WI
TLSH
T1ED927D72683C6C776DE3B145F94732078EB88063EAC52F54D5EDAF1D00EA658130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e0bc8e84da2cbf13c3dd1a1b1132879810f40ce3359d89325e393b12b6bfd278
MD5 164e297558237e33d355f3a6f380c495
SHA1 14bc10be6442746b147cb4f5140133867082a5fb
SHA512 2de33f0f23fc34542364e1833d92b45dc02eb687a70b213198e86ed5785596e5c9d4e8dddc6e4a44b12f9e2d57d8070f69cb8db6f8e692787e82a6f230d5b088
SSDEEP 384:/ZcIasN4DPCCo++da95OVnuzJrKSnTKwBODNZOCEWI:XajCtgjOJ2hKSnewBKZO9WI
TLSH
T1BF927D72683C6C776DE3B145F94732078EB88063EAC52B58D5EDAF1D00EB658230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de9fd29c8d4b55b3c20599c517681aaa292e9344ef7579d97fd3abc773743643
MD5 486494a59105a134fd84577868da6cc9
SHA1 7caad07ae472258dafeb4eded605e0d83a16ae0d
SHA512 5b985ea4e7ca86a4615097a5f9b897ee695d397ad3e79f00c52ee2c3a6578679aed8fef7b08a4cac503cb123c05bb4f4555fcb648c87454ffff7b46003a15dda
SSDEEP 192:4ON/h6O7+3sQmiUyYhNttb0gO2KnyF0SJr5cN4qxmU6:4ONZ6yLNt95OVnuzJrOSU6
TLSH
T1EF121A357838AC776EE3A441F98736178EA54127E9462F80D5DC2E0C01DFAAC234AC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

753086a3-9777-4068-a17e-2a51f83aef90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\753086a3-9777-4068-a17e-2a51f83aef90.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a774ee0e354152943ef0b1e0613875416a164ae15a41d41f1ff61cbf5012e983
MD5 d0f6ff289a0776a3bafaf44f3646b727
SHA1 556adb3c5398365760e99983beda859d1902cf5d
SHA512 dc5e0c6057ce0cf6dbc9a0abca3273517977dbb222c8809982a4653374288edd27fa484191a27a5b7b75134fe8234026a927fcc9ab7c8f08f8d567f33f663987
TLSH
T1FB412B5CB6E91108B3B36F9A9BF6A86D487BBC372E06D55D10110E4F0A62B40CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_laanu05e.pzx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laanu05e.pzx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 5KB
SHA256 94e6b220d69599bce77fb0fb6430d72d5e6fd142c055f3b1bfa026f2464aa171
MD5 3c1c7d366776b7063b0baf0cfdfd98cf
SHA1 968488e8de37ebbfa2745b86d3755758b20e7c1a
SHA512 1f4db694aa62b60e268b6fb95c7d5e78270bd66d7f1ff2e6607ca9f0e7b6bf33e8e8711bb781458e6b7cc24c05ff17fbce503f34c6ed0cd41a508c13ddbf9016
SSDEEP 96:gzkWTQCFt0mVGPFDBWAtRFkRWH/yjt7R502TiNqlTdTglnO5b8k9:gzkdAZV7WFTf8702CqTdT8nOV19
TLSH
T1B6B19519A7E8C617A12260A6FA6BD440BC18523FB040FD0B71DD87E9AF5C345C7D8DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MALAWARE!!!.txt

Path C:\Users\Admin\Downloads\MALAWARE!!!.txt
Size 10KB
SHA256 5f49974a44fffc0c10741167c1a665eff72f5eced39fa6c5f1550666f3c6518a
MD5 5906c8e75a35a8f06c321a2cbbe7b651
SHA1 58d535e4001e924fdd2b090a13edd14c54dbff73
SHA512 4736a933c4b42f48c6b8f89c3a2c88c00412d024bc8790296b0e6d747d86e40c55c5ff94be2b1e7ac49a345d8d080c4c8bc16352fb8d42586a427c26b43cfd81
SSDEEP 192:gzkibAWV7tFVzf8B0SahCClTl0OlGTtlxw0trub+o4jCkC9X7GqfO:obAmBjf8BohCu0OlGZlxw09ubtH9X7GL
TLSH
T10E22C3256BDEC68382325152B64A9081FE29123F3155BE0A70EDC2D4DF7D344CBB8E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ypsqux2t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ypsqux2t\ypsqux2t.0.cs
Size 1024B
SHA256 3a5bd2c7a58d6e28c003d0df87945a5604526e83963ecd9a24ca6d418f725c72
MD5 aa1e7870b6d5a5bd8ec6c9e6358e66aa
SHA1 40bfe2fa986f8e562d96fe0a26f4f58a99306f94
SHA512 6eb34d18f88e402320940612ebb81a9412ea9aad4434ee923d5961afb233a3beb2d4dd9cabc0aec72d0f7c5b14c7eedb20eda5226c4158125c1bd79fede049e2
TLSH
T1E111CB00570B825066AB4305A685209BAEA2902625FFA817BDFD63214F4F244FB3571D
MD5 SHA1 SHA512 TLSH

Submit Download

ypsqux2t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ypsqux2t\ypsqux2t.cmdline
Size 369B
SHA256 445cd849d7948037a744b0f51a2aaf082a971488b70c2e5056b71f38f9aeaf5d
MD5 2d368c71cfe6dcb81c76cd0a4c2898aa
SHA1 47554774041ad37534acde3cf86ac2e1af1d9511
SHA512 17689b03115f009dcee8657e7ebc045d433c3475ef50b52d302eba4f2bec76f1c6f3c1410139417e3ef40a8204973c52e85be28405a6df12a411e901d8e7c30c
TLSH
T119E0683E4346C2BD81F910872969C6ACC3720A632940FF88D440C49DD11744427D1B4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5160-578-0x0000025FF0E00000-0x0000025FF0E76000-memory.dmp

Download

memory/5160-635-0x0000025FF4170000-0x0000025FF437A000-memory.dmp

Download

memory/5160-634-0x0000025FF3DE0000-0x0000025FF3F56000-memory.dmp

Download

memory/5160-608-0x0000025FF1050000-0x0000025FF1212000-memory.dmp

Download

memory/5160-586-0x0000025FF13B0000-0x0000025FF18D8000-memory.dmp

Download

memory/5160-577-0x0000025FF0D30000-0x0000025FF0D74000-memory.dmp

Download

memory/5160-569-0x0000025FF0830000-0x0000025FF0852000-memory.dmp

Download