defendnot | hxxps://sites[.]google[.]com/view/obsluga-zamowien-piotr

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/view/obsluga-zamowien-piotr
Sample260826-jplrasvbph

Score

10^/10

discovery execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016832-411.dat	family_defendnot

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2464 created 628	2464	explorer.exe	135
PID 2464 created 4484	2464	explorer.exe	140
PID 2464 created 2376	2464	explorer.exe	146

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
146	2464	explorer.exe
146	2464	explorer.exe
146	2464	explorer.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3980	defendnot-loader.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	sites.google.com
14	sites.google.com
48	sites.google.com
57	drive.google.com
58	drive.google.com
59	drive.google.com
88	sites.google.com
7	sites.google.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Invoice.pdf.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
4360	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4220	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2592	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\HardwareID	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\Service	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Invoice.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Invoice.pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Invoice.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Invoice.pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Invoice.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Invoice.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Invoice.pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322042528766345"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A7B51AE6-2340-49F5-88C7-4FD0DB7517DE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1976	2368	msedge.exe	85
PID 2368 wrote to memory of 2592	2368	msedge.exe	86
PID 2368 wrote to memory of 3736	2368	msedge.exe	87
PID 2368 wrote to memory of 4352	2368	msedge.exe	88
PID 2368 wrote to memory of 3736	2368	msedge.exe	87
PID 2368 wrote to memory of 4352	2368	msedge.exe	88
PID 2368 wrote to memory of 4352	2368	msedge.exe	88
PID 2368 wrote to memory of 4148	2368	msedge.exe	91
PID 2368 wrote to memory of 3908	2368	msedge.exe	90
PID 2368 wrote to memory of 4148	2368	msedge.exe	91
PID 2368 wrote to memory of 4148	2368	msedge.exe	91
PID 2368 wrote to memory of 3908	2368	msedge.exe	90
PID 2368 wrote to memory of 3908	2368	msedge.exe	90
PID 2368 wrote to memory of 4728	2368	msedge.exe	92
PID 2368 wrote to memory of 4728	2368	msedge.exe	92
PID 2368 wrote to memory of 4728	2368	msedge.exe	92
PID 2368 wrote to memory of 4716	2368	msedge.exe	93
PID 2368 wrote to memory of 4716	2368	msedge.exe	93
PID 2368 wrote to memory of 4716	2368	msedge.exe	93
PID 2368 wrote to memory of 4832	2368	msedge.exe	97
PID 2368 wrote to memory of 4832	2368	msedge.exe	97
PID 2368 wrote to memory of 4832	2368	msedge.exe	97
PID 2368 wrote to memory of 1100	2368	msedge.exe	98
PID 2368 wrote to memory of 4292	2368	msedge.exe	99
PID 2368 wrote to memory of 1100	2368	msedge.exe	98
PID 2368 wrote to memory of 4292	2368	msedge.exe	99
PID 2368 wrote to memory of 4372	2368	msedge.exe	102
PID 2368 wrote to memory of 2828	2368	msedge.exe	103
PID 2368 wrote to memory of 2828	2368	msedge.exe	103
PID 2368 wrote to memory of 2828	2368	msedge.exe	103
PID 2368 wrote to memory of 4040	2368	msedge.exe	104
PID 2368 wrote to memory of 4040	2368	msedge.exe	104
PID 2368 wrote to memory of 4040	2368	msedge.exe	104
PID 2368 wrote to memory of 2376	2368	msedge.exe	105
PID 2368 wrote to memory of 2376	2368	msedge.exe	105
PID 2368 wrote to memory of 5068	2368	msedge.exe	106
PID 2368 wrote to memory of 5068	2368	msedge.exe	106
PID 2368 wrote to memory of 5068	2368	msedge.exe	106
PID 2368 wrote to memory of 2996	2368	msedge.exe	107
PID 2368 wrote to memory of 1052	2368	msedge.exe	118
PID 2368 wrote to memory of 3840	2368	msedge.exe	119
PID 2368 wrote to memory of 2996	2368	msedge.exe	120
PID 1736 wrote to memory of 2464	1736	Invoice.pdf.exe	133
PID 1736 wrote to memory of 2464	1736	Invoice.pdf.exe	133
PID 2464 wrote to memory of 4360	2464	explorer.exe	136
PID 2464 wrote to memory of 4480	2464	explorer.exe	141
PID 2368 wrote to memory of 5080	2368	msedge.exe	144
PID 2368 wrote to memory of 5080	2368	msedge.exe	144
PID 2464 wrote to memory of 3180	2464	explorer.exe	147
PID 3180 wrote to memory of 3980	3180	powershell.exe	149
PID 3980 wrote to memory of 4220	3980	defendnot-loader.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/obsluga-zamowien-piotr
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe6e63c188,0x7ffe6e63c194,0x7ffe6e63c1a0
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,15819394710267336206,72269711665230874,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,14790138073803714404,4762136623709219593,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,17988534910974411390,1394847646713120419,262144 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3008450628830791001,5404835520247413572,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15817021186897025123,15763438682889705975,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,9786489715630023341,16341334388303910722,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,2667310122506407035,12665722908461867828,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5208,i,3250704735951216404,5878043856827227669,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16431139353443152572,110548886938521357,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,486771497279623378,17314732996610382950,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5923968147686944396,251568748679256974,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5923968147686944396,251568748679256974,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6072,i,6505520544467610654,20068199245079675,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6720,i,13419396090557771950,15745878483657676044,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,14547743569457624770,17200356260018710604,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6620,i,6239967613141988680,13938897525696780265,2097152 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,11054505970280782127,10690138881586763047,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16483898264731419474,14707821968627956219,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,6236743921784161731,6411219234649466653,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,2898214445053450748,7133624009233741240,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1967528946823733340,15459569370729077634,524288 --field-trial-handle=2476,i,9640447677610479535,7836137137022160676,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1380

\??\E:\Invoice.pdf.exe
"E:\Invoice.pdf.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Downloads MZ/PE file
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\winver.exe
    C:\Windows\system32\winver.exe
    3⤵
    PID:1056
- - C:\Windows\system32\ComputerDefaults.exe
    C:\Windows\system32\ComputerDefaults.exe
    3⤵
    PID:628
  - - C:\Windows\System32\sc.exe
      C:\Windows\System32\sc.exe create moimoi binPath= "C:\Users\Public\moimoi.sys" type= kernel
      4⤵
      Launches sc.exe
      PID:4360
- - C:\Windows\system32\winver.exe
    C:\Windows\system32\winver.exe
    3⤵
    PID:4404
- - C:\Windows\system32\ComputerDefaults.exe
    C:\Windows\system32\ComputerDefaults.exe
    3⤵
    PID:4484
  - - C:\Windows\System32\sc.exe
      C:\Windows\System32\sc.exe start moimoi
      4⤵
      Launches sc.exe
      PID:4480
- - C:\Windows\system32\winver.exe
    C:\Windows\system32\winver.exe
    3⤵
    PID:3436
- - C:\Windows\system32\ComputerDefaults.exe
    C:\Windows\system32\ComputerDefaults.exe
    3⤵
    PID:2376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "C:\Users\Public\defendnot-loader.exe --silent --name 'Virus & threat protection'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Users\Public\defendnot-loader.exe
        
        "C:\Users\Public\defendnot-loader.exe" --silent --name "Virus & threat protection"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pause
        6⤵
        Executes a command shell one-liner
        
        PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22df140cf27633bb5a5cfb41856accaa97390f0e68ea50ce283a05244e70c75e
MD5 8309d4388bf9ad61f64efb2cff858a46
SHA1 5d506ca1d6f3121b4913ac8dd94595ef742deb8f
SHA512 c96144f89130652cb71678e2400de8c4bfd6104eb4607c508a56a32ccdaf7e724e084d306bf7a01138b4da19f98f2e33e355a539958acc257501ad3d4835f6fd
TLSH
T1F0D023207E7DB5D1E1271038E513474032DD55F63547520BF550451E5D7A4C393DE9D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fabdfa6de79b96749b4f5f0f69094d1f7d0314d353c8f7d8a047ae67d4906235
MD5 42dd31284251167d93bf85f98a3d6314
SHA1 9c7f0b2c4c0c51fa98d695020c29bb73a11eb993
SHA512 984d319823f77eea17495373a7c974e9530cc21c283299cf8dd7b3395c5f48d4f4c02ccfe375d7b9a5b67992bc3798a77035243e5e82b1fedcf8ea14f0cf3829
TLSH
T1C381C6F5A6C109A5CBDAD370A2E21000FB3B71EDFA1F3ED28C941AF4590B715B6D9606
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58acf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58acf4.TMP
Size 3KB
SHA256 d5edb30c3dcac4c43cd305a6b8768e8ea79f85c0e0e919fce5d8a5420b6a5c06
MD5 1f59f16cbee8eea978c0b0b7c74a17d2
SHA1 4263da2d81ec5b77ddcff251e915a50a7bb5f046
SHA512 9db36c35778a241767b002be9c69347cff23da29cd520ba9324e76aa5ab5743a89c0f8532157ecb09e9454cf9c6c3f7154ac0d596de42a2f64dbed11de973448
TLSH
T17771C9F5A6C10894DFCAD370E2D21100F73B71E9F91F7ED28C941AF45907715A9D8206
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 41320db839e691b754eac07e3092f424b4824c9b9e2ed3ab4e01e85b98d47dab
MD5 a2846f19d272b6aff9a75f66f4e2d08f
SHA1 2e0a9326add2fade92a4a126f6a2209103c3c354
SHA512 90ac68ad3af3828522d8917ae905518204895ae5a49cc83843f654ed90df99f03165ccb6211b8e5380daaf69987e83246d203ad3dabefcbda03c8cae4a7168db
SSDEEP 3:MsEllllkEthXllkl2zEY3Yt:/M/xT02zZ
TLSH
T1884402486FC00805C9115030401183500378D8640511A743249904235C8E9801C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a37e7b6034b733cc76a95ec3910c61528c2de1a065b2b44b5cf770728ca542c9
MD5 66b62311f5cd5f99804f620a800dad49
SHA1 1436278eb2b52bb3b482ff3f88644acc1c387fdc
SHA512 125c312e27fe5851dedc0c55587716ab9945423af69d2b810791dfaf555c37a73fb4e234481581642594dab11bc4273076dc4e7e9e135b6cc23405de8befcfa1
SSDEEP 96:D2OFWZ3SBuOMzs3A3Zf7tc0fLSWujfrwlxQR:DVFWZ3SMOMgQ3Zf7tcuLSWUfrE6R
TLSH
T1F4B179F7C3D8862DC91116F4AB19AF1ECE2D1A14432C3D2788D8BF1BA3E2831E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 144e5a3a16e816c8a30712fe229f38a7ce54b021fcabd18f576661dccc4269fa
MD5 107c9afda891e2b803bb925687fd2bc3
SHA1 1ad771f9d7b29972e0104ed037d4e68e7afb2213
SHA512 90fb53fb37b2f4e146244e758bebd123969e3b0ea1f82fbbc0cf60c72f541157d5bceb0ac675928863022eae85adae90f93dedcfff41365b13d222acdda4afcd
SSDEEP 96:D2OFWZ3SBuOMzs3A3Zf7tc0f41CKWujfrwQ:DVFWZ3SMOMgQ3Zf7tcu41CKWUfrT
TLSH
T122B169F7C3D8862DC91116F4AB19AF1ECE2D1A14432C3D2788D8BF5BA3E2831E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 63489497ff6454f9206a42030e0c3cf5d8ee0ddc857f22d0c1c4ed9d41f0e771
MD5 85feaaffe2d993af2e7c0f520254bd90
SHA1 402bc46f765033fd4422f61e48566032aa257418
SHA512 daae58584be183e39cf99a9c6fb739d93c17ad543b684a0fc3a4e93315acd079ba8928afdffb029b18f63ab16869a6e4636688e26743fe08cb324de7343282b7
SSDEEP 192:sxZcRlyM/jK1Ml8vW9q/fisCAWpVLhSVSy/Idpp0HW6+WNOTgZnXYTyr7/dIgbOJ:sxZcrAwq/fisCAWvLhSVSRyHbwqXZpm
TLSH
T14162D812B634997BCCDBD20DFA457F63D6F9046292940E449AFC8A1C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b9aeccd1577cf477b37e08710b55d66de55312796389773fd4c0c3d1cf1f923f
MD5 a3eff6329aebb4f2ce2009d5550d4e45
SHA1 caa139ae92c03519a556eb72bdfaa6a0bf19bdbd
SHA512 6d02f7f744b3ef57c4867e09ce1deae49fbd715ac9cdc63a88a7c660345494fa0d526139a7b57a609c74accad9b987382fe1336fe34c9d8138d52478bbf5bb55
SSDEEP 192:sxZcRlyM/jK1Ml8Mkq/fis5phHVS1/Idp70HW6+WNKhu/YzNbyPIgrJ:sxZcrMq/fis5phHVS6YHbd/H9
TLSH
T19A42D811AA34A97BCCDBD209FA45BF53D6F9057292940E44A9FCCA1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4c72bfbfad9b53f52c6889db128cd495794e1de57243a77dd0052f6046149dd9
MD5 fbd06e170b9afc06225e64075769e3dd
SHA1 0d51af60f734e2d779c8701d91f923008f40bb37
SHA512 1e293d1b89ba51cc6a55623982f7dad6bc1720fd1879ea1197590f6df7546de8d750339a0a436c8d8e25ae9933964b799eac0824222db63732db6cf3024f9877
SSDEEP 192:sxZcRlyM/jK1Ml8M9q/fisCphHVS1/Idp70HW6+WNKhu/YzNbyPIg5cJ:sxZcr1q/fisCphHVS6YHbd/Hy
TLSH
T10152C811BA34697BCCDBD209FA45BB53D6F9047292940D44A9FC8A1C04E7BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f02fdd0adc9b90381266ea7f051b22a2b31521bc426e278b4c4bb433c14f6979
MD5 0ea821e404f7b667825a009f3cd86967
SHA1 075c6d1e49fa0367eca9410d715fa7e743e432db
SHA512 d627dd1a84695f108c280540e6abf1f2ae9488a2e899502192845e372f19a103588b39b7dc8293415fb772af0e02e3ddcea65ee48ddcbfec24eb5601e6b5980b
SSDEEP 768:aRW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjRroI/iNYy:aRW7kf0Wvqidau1jaa5LA3jquy
TLSH
T1E9D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8e7c3ceec8fe06f2c91f4575f3e33295a26f0e3c3f06c020b131f2b1ed7c464f
MD5 86f30e0afa1db1caa1e6de4ed4a2a8d0
SHA1 2808802ad3fa48a4db003da34dda537b834f4f0c
SHA512 8a94a8578f744bbc7390fd65e5f4b3d44c493ff6ce3338c62c1d51e8fc67b93744871bb47af17b154e284dc5409cc81490db68c55c80089f8eea99a98c801fa7
SSDEEP 96:KIbCKcXfGKAIG8pUtJvPv693CJrZ6KDPr76/JhqTmaj26oww+6AplYa+KQLYU+l:s69fAaj26owwdApKaaLYU6
TLSH
T1D2915112707B46413CBE291893A5CA264F8276933818A8FF3BB804625DA6E550DFEDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af14f2e8-8f71-4ae7-a7cf-a1b2a55c85ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\af14f2e8-8f71-4ae7-a7cf-a1b2a55c85ab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 51d2538efdf8256e868542cb7458f0a35330e8c4cade0d1289960f9606888699
MD5 726b125a07b7b9ad2eff6f0a7d3ef838
SHA1 8bf7376be7e6bdf9bccaf019d13055f6b376e066
SHA512 b2eccaffd441f3dacc4229a1cd926e18444e4d2a386ba04fc5214dc750abfcb27b9e70968798bf1b45a0d0a9bb9a47e76932a2ccf42df6abce1c568762ee6967
SSDEEP 384:giFZZcIgsN38TUNTUlIlzahbkt+2xd5ml+2PRk0hev5ASBmA/kF09THvG+HBbsDu:7FxggwgMy+Ggle0CmS4F09D+gDGI
TLSH
T143E27DF188D74CB6D4AD9BC7A73DAD021ABCC127B4885918B3E4662DEC4B4BFD316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b0d0220361f66b37afaceeb6584b96336f2e3ac741f51e11d92d259e91988de2
MD5 d5de1dd5857d1c9f43ca0d47a3bbb537
SHA1 c7d984c3e26c15caab9924da499d9ce23f50dac0
SHA512 8dec88004c2a381407b763aadf8ac9f884ca0ea070436a42071a29542c0f2c761fd76886bd9ccf3e3ae0aa514c8ec87756c4d8ed3df557d1150a210daf23d3e7
SSDEEP 384:uZcIhsNYWahbgL+2xd5ml+2PRkiU+HBbsD4GoL:MhVm+GgleiUgDGI
TLSH
T12F828DB29C749C7B69B6E145F88736034FBC8067ABC86F54E5ECB71C049A6A8131F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 053e5d62e6b9efc9f8bdbf78a8131253e07d2e9890ee81a3e6d59df477b33c4d
MD5 11c77368632ed37ab6e64e90bede82a8
SHA1 fe20b6a263f57fcd655984a84062b01fc5129f51
SHA512 349a847be02dae046c78842bb6effb834a35e288af6fd249dfd16aea2f0f04279885eaccf956a0334f7f9ba7667c2dc23c3e99b9e302c9961cd2d056345fbed4
SSDEEP 192:MONC64BAQmiUy+1BW5GBPKZX+FdGumWaDWTU6:MONC6eAFDW+d5mzMU6
TLSH
T1FC02FA34AC787C7B9EB2BE45F5863B175FD8112BE6942F44EAE82B1C009765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7245a7867eaff5d9b1226f0468ccd588b621f29034e9cc630b809faf5d1e63a
MD5 04ad2a91aca7d60f98f9f9222057320a
SHA1 a7549a5b9eba0ad0e27a4f84008aeab84269624d
SHA512 84b832c8231de16c83a504a4062f48be373e1d07458ea947a7da66221ba5fc2fc9fe15c87ed0b95185a8b5701c66b0f6da6b7f921c4883d08eead9992a9d4b37
SSDEEP 384:JZcIQsNYzahbDY+2xd5ml+2PRkiU+HBbsD4GoL:BQ2Y+GgleiUgDGI
TLSH
T126829EB29C749C7B69B6E145F88736074FB88057A7CC2F54E5ECBB1C049A6E8131F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 06af315360aa40ee0cb2d0ae625f1d15200bab81dff3697be41c40d2ef5a8939
MD5 a2805cefb1ef1211d42cddb667949ef3
SHA1 a9c73405e9d45a7f7975e00093104b84beb144e2
SHA512 0eebd4bfe5060a530809a48baf6169689365a20d3950f58acd7f4432cd7d8be5395b8f0336776942e2b0ccaa771af049d9de57f9dbfecae595687e63e94470d9
SSDEEP 384:giFTZcIRsNI8TUNTUlIlzahbDH+2xd5ml+2PRkrU+HBbsD4GoL:7FLRFwgMH+GglerUgDGI
TLSH
T17DC23BF248E7887AE9AE9743E77E2D034EBCC057B5846A50B3D8661CCC561BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b804c19db5e2ad839b7f26da48625fa61e1d6f2dc1ed1406fe7bb3fc9fa946ce
MD5 3dd6d3d7381e288f5e9d6cb1f98ee9b7
SHA1 1176c3026ba6c98d411fcad8e653bf020381f9ad
SHA512 5389763683a1f42bcc63319d55e293dea8d89c611063a88936d4fc8fa6560cdb742f8849f1069ab5e5f54bca9f77618709db52688157d10ed4801d66c2fcc60c
SSDEEP 384:QZcIQsNYnahbDY+2xd5ml+2PRkiU+HBbsD4GoL:uQyY+GgleiUgDGI
TLSH
T1A2828EB29C749C7B69B6E145F88736074FB88057A7C82F54E5DCBB1C049A6A8131F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 65f0121602ee1acb4587ba3d6e9fe802480a02f81967820278327b2068820099
MD5 53743850de8cc6d5f12565418884e5a2
SHA1 cce51fe74ed2ff4ad7eaeeddb4b7ee6ecafb1841
SHA512 db398299b50d6f02d6840dfb84e2a00515a8ee3aa2481812be206f2ecb55a42e7a84b0225eca0079ff7695cf5b9f199b7ea2e15f6d9a3d71358c95b63ded617c
SSDEEP 384:giFPZcIRsNI8TUNTUlIlzahbWH+2xd5ml+2PRkFU+HBbsD4GoL:7FHRFwgM4+GgleFUgDGI
TLSH
T198C23BF248E7887AE9AE9743E77E2D034EBCC057B5846A50B3D8661CCC561BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 247c2bacc6fe63150c341aa25b24988a1d0c0db6a0919a5edb8fc96da25273a9
MD5 db452bf841166c2d3a19815f34503a28
SHA1 f4cb63a4455b919b46830255a5b30b4a4ecb598b
SHA512 fdc0ca44063943b2468b594c2e59877d13ec70e97647ad2d602c67b5f68199a2b123bebb22245223a70e2e5f727858e70665492e5912900e87a2c314e5c8878e
SSDEEP 192:HONR64B0QmiUy7Bn5GBPKZX+FdGumHqK+2PRk1WwkqGU6:HONR6eE8n+d5ml+2PRk5UU6
TLSH
T1EB121C356C746C2B5DA2B541F48736035FE9412BEAC86F54E6DC6B1C01EF65C230E816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f6eb601-2293-428f-b96e-afd46f9c8c8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f6eb601-2293-428f-b96e-afd46f9c8c8e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c41e1ca0434d25a03f55552a988b86ded8787e647eabeee5f5ac912962f35603
MD5 6bdd636aa45aed0787b03cd0f77b057a
SHA1 4ebbfa51558f6d481051509ccb73a7aea6c8583b
SHA512 769ad01541cf2141034f33ea70ab028a1eb75e0b662a01b147087025fed40a89bc1431791b8c06979954e17405919804be41c94fa589de391bf10b28026a7072
TLSH
T129411A48BAEA1158B3777E5A9BF7B56D447FB9362E06D49E10110D4F0623B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qjieyfhc.hur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjieyfhc.hur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

defendnot-loader.exe

Path C:\Users\Public\defendnot-loader.exe
Size 592KB
SHA256 8c3c38781a6e6eb9112b5debfeceaa3c0e9fd20dabf45f3b441ef9926575ba3a
MD5 e547f448b7c0db8f2a5455ad7d70c9d4
SHA1 db10e1083fea3709a1940c662cfe196c149fb640
SHA512 6eaab3b79bb670273643670a8e29831f203b31bd229ab69f3ac085433bc616bfdf0285b146a98d3c16b87fd4ef274976535036ceb3db0541cfc59457dcedec8b
SSDEEP 12288:ZDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBkW:ZDddddddddoChjhw7CYh0lhSMXlnsx
TLSH
T1C9D49D26B7E940F9D1ABC27889930A16EB737C4643616ACF03E44A675F236D05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SumatraPDF-settings.txt

Path \Device\HarddiskVolume5\SumatraPDF-settings.txt
Size 2KB
SHA256 d2af5ac5b4ca35d5a26e9ec49ed2b229a0a9ce58dbaf1084bbd128e96c23de03
MD5 616e80f89463fed244506d9b24beea8f
SHA1 27a65d177ab8054f3663e3c6c61284e6c5c5a59f
SHA512 0e8537e6a7416168d6fde66bf0cd46c5994cfc7b0d878908b3fb24027dfa07c1e4d7f973f48e997c8028260b43995b9170089e3b8d7f5e6f38492adb15dcc4e5
TLSH
T1A141D02C355B603CC926775DAEB7E0334EE2386071DB7998B9EE581C3450D6C819DD0E
MD5 SHA1 SHA512 TLSH

Submit Download

SumatraPDF-settings.txt

Path \Device\HarddiskVolume5\SumatraPDF-settings.txt
Size 2KB
SHA256 fd7bf33b9ba01a92bcce0f8a6e364f17821fcd187ae823f83b3c8a60db8834d3
MD5 8e669f735c7d21897acba5de81722e94
SHA1 4009f4e06b8006259702e29502afef9b4a836c3b
SHA512 21397c219f47cc64f8f4b699c68f2916e78aebb71fc2c9dbb410fc0b37680c9a41721bb8ad370129a10ddadfcc87181e358af45956c303f3a985ff7848699bc8
TLSH
T10741FE2C355B603CCA26375DAEB7E0334EE238A061DB7998B9EE581C3450D6C819ED0E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-328-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-327-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-316-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-335-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-318-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-317-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-320-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-322-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-323-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-311-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-324-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-325-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-319-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-326-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-321-0x0000000002230000-0x0000000002291000-memory.dmp

Download

memory/2464-310-0x0000000000A60000-0x0000000000A64000-memory.dmp

Download

memory/3180-401-0x00000213A4890000-0x00000213A48B2000-memory.dmp

Download