hxxp://f[.]pylrk[.]cc/i77AMHeTM1Z7892K/s

Resubmissions

05/10/2026, 20:04

261005-ytjj3ascle3

05/10/2026, 19:52

261005-ylqneasarh10

02/10/2026, 19:21

261002-x2r1qsxaqb3

02/10/2026, 16:26

261002-txwxcazzdv6

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://f.pylrk.cc/i77AMHeTM1Z7892K/s
Sample261002-txwxcazzdv

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4208	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{1438CED8-126B-4025-9744-EC82142E02D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe
5616	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4648	2456	msedge.exe	87
PID 2456 wrote to memory of 4208	2456	msedge.exe	88
PID 2456 wrote to memory of 860	2456	msedge.exe	89
PID 2456 wrote to memory of 4488	2456	msedge.exe	90
PID 2456 wrote to memory of 860	2456	msedge.exe	89
PID 2456 wrote to memory of 860	2456	msedge.exe	89
PID 2456 wrote to memory of 4488	2456	msedge.exe	90
PID 2456 wrote to memory of 3692	2456	msedge.exe	92
PID 2456 wrote to memory of 3692	2456	msedge.exe	92
PID 2456 wrote to memory of 856	2456	msedge.exe	93
PID 2456 wrote to memory of 3692	2456	msedge.exe	92
PID 2456 wrote to memory of 856	2456	msedge.exe	93
PID 2456 wrote to memory of 856	2456	msedge.exe	93
PID 2456 wrote to memory of 4804	2456	msedge.exe	94
PID 2456 wrote to memory of 4804	2456	msedge.exe	94
PID 2456 wrote to memory of 4804	2456	msedge.exe	94
PID 2456 wrote to memory of 4396	2456	msedge.exe	95
PID 2456 wrote to memory of 4396	2456	msedge.exe	95
PID 2456 wrote to memory of 4396	2456	msedge.exe	95
PID 2456 wrote to memory of 988	2456	msedge.exe	98
PID 2456 wrote to memory of 5080	2456	msedge.exe	99
PID 2456 wrote to memory of 988	2456	msedge.exe	98
PID 2456 wrote to memory of 5080	2456	msedge.exe	99
PID 2456 wrote to memory of 620	2456	msedge.exe	101
PID 2456 wrote to memory of 620	2456	msedge.exe	101
PID 2456 wrote to memory of 3904	2456	msedge.exe	100
PID 2456 wrote to memory of 620	2456	msedge.exe	101
PID 2456 wrote to memory of 3904	2456	msedge.exe	100
PID 2456 wrote to memory of 4776	2456	msedge.exe	103
PID 2456 wrote to memory of 4388	2456	msedge.exe	106
PID 5616 wrote to memory of 5720	5616	OpenWith.exe	121
PID 2456 wrote to memory of 5916	2456	msedge.exe	123
PID 2456 wrote to memory of 5924	2456	msedge.exe	124
PID 2456 wrote to memory of 5932	2456	msedge.exe	125
PID 2456 wrote to memory of 752	2456	msedge.exe	128
PID 2456 wrote to memory of 752	2456	msedge.exe	128
PID 2456 wrote to memory of 756	2456	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://f.pylrk.cc/i77AMHeTM1Z7892K/s
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7fff501cc188,0x7fff501cc194,0x7fff501cc1a0
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,13728211950396383244,5332323054135778937,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,16057684532452293053,2993820266924039023,262144 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,16936131806024489892,16232333412898025270,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17063090915668680061,17749004192995119692,2097152 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,325684279610504426,13895249182812328100,2097152 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,16358153250657065205,10367963068763422023,2097152 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4796735407745903171,12694898569104461191,2097152 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13380625110752113629,738917527970155978,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16095843614664328897,14818216443276309370,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,12488942158047406440,12800406533885233146,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5608,i,7400543846432245661,15073503013057804977,2097152 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18010218302221314572,2560528625871103396,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,10592812300002531701,16002193043148889605,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,10592812300002531701,16002193043148889605,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,6349523420325367521,16700326605471695849,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,6292649993987509184,17200046791697392921,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,11336032873287198740,5148681756213409520,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17564723669504685081,18038612325928240735,524288 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,11902830422341213069,2452411897880707803,262144 --field-trial-handle=2736,i,15367220054921688895,14562567587499665681,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\s
  2⤵
  PID:5720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2935f6d1-413d-44e7-aa87-e1b03cbaac6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2935f6d1-413d-44e7-aa87-e1b03cbaac6a.tmp
Size 8KB
SHA256 0ea5bec09646886f0eacb4bdc20a23c0eb80ce69253c09c66c29bd95ae74c446
MD5 bd8870c9232f86aa6b0e1818640f1004
SHA1 b33dd24507386fcc63305c1b659fd86d36d52fb2
SHA512 c9333c88b5ee23775d56332fc44cceadff1cbbe5dcb4e1d6b96e8b3b7d77457208ee61e0eebc939466bd0a9a9bc2d33d938569f9b953888ac20d8e0086886479
SSDEEP 192:LJONT6DphaqQmiUyfFoawGYX59eziC8px2F++2GkIIGq5LU6:lONT61d0aawGYX5E78pxa++2/VU6
TLSH
T1A4120A36A8B8AC770DE3A991F44735135FA5521BEB847F54D5EC1B1C01DF65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ae88c05-3326-43f0-9790-f92e0f7f0275.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ae88c05-3326-43f0-9790-f92e0f7f0275.tmp
Size 18KB
SHA256 35f1b0eb5fcee7e611d20438e68ed93aa3f844a26b9a9a16ee231588ad71ec87
MD5 5fee2f1f36db0c136cdd5d83aa777b66
SHA1 a49112862ea7ee2ca9e1330ba41dbfe8f1f2f2ce
SHA512 776c246b33ea9bbfb92db99e24e2c0e756ca08d81ce84358b7352fe08dd9ec3a0403c6be194ec0fb810eb28f3b294b085b6ffe2e6605e33951c20385c3479104
SSDEEP 384:BZcI8sNSjR5GDTeBGYX5E78pxa++2fVtgOIwZOy9oSoc:J8jeToGYu7WjlfVXs3SP
TLSH
T1A7828D369CB86D7B1CFBA581F5473A038FB8902BA7C4AF54D5ED1B1D01DB698130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51504566-ebb6-47dd-b6cf-059cf009a8d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\51504566-ebb6-47dd-b6cf-059cf009a8d6.tmp
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
MD5 b90ecf74a561822627982f1b8d4c4873
SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
TLSH
T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

0af6f10d-3c07-4e00-9602-86d95c1ba04c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0af6f10d-3c07-4e00-9602-86d95c1ba04c.tmp
Size 10KB
SHA256 4bfe6f95e173c17f88810e56b711f0da7ee3ad29a4b5e2f846723d010f46f054
MD5 e5738a76941d2748f71e44319932d8b2
SHA1 4797a6303d0e48bdfeee4e732948a33bbdbacdd0
SHA512 05343cf4145b5854942bfa9fa399fb4df8b07dd21166dabd2defd91d481780c296cb823f31844e05e5055ad357ba9d90cd1b842a42e79c4e936b1bd9628a6592
SSDEEP 192:sxZpR+n3/f7sNkIdpJHW6+WNGYg+VIHIg5/J:sxZp+3/f7sN9JHbG1n
TLSH
T1F322B7556E28A97B8CCBE20DBA157F53E6F9503261951E48AAFCC71C05E7ACE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ca3f696-20e8-4a58-8e21-d433283eaac3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ca3f696-20e8-4a58-8e21-d433283eaac3.tmp
Size 9KB
SHA256 a0f78d92b5df4007c85c55777961c05d3e1e2dd4b6029efd2db28223d991da79
MD5 5c015729e920649c6f9a47cd8f0ecec1
SHA1 a930852afc7de98888c01b2f42c6061bc0c8dd30
SHA512 8c5921980f75d62d81429e305291b263863ea7ccd90aabc884a8a47d65ca08543712157e6c88decc3d6ecaed1287e26b528dbe4ec7c998c0a3f4ac09a3ad38a2
SSDEEP 192:sxZpR+n3/f7sskIdpJHW6+WNGYgXVIHIg5VJ:sxZp+3/f7ss9JHbGGB
TLSH
T1C522C7516E38B57B8CCBD20DBB25BF53E6F9103261941E48AAFC861C05E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ddd3183-32fa-49d3-84f1-221ec1ef1861.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ddd3183-32fa-49d3-84f1-221ec1ef1861.tmp
Size 27KB
SHA256 8f83d95571fa48cca7cbe044061ef49e9b044c6787fd36d07da21985ded6892e
MD5 4d37e97760299fe1f738120e6bbf16f9
SHA1 c5ae74afe955c5a0743ca7192d4c01e74886898a
SHA512 573dc4976d8db71a491cdcf04a3bedaed67b6ca61934ded913da43e2bbc67c184af5cae1ac9a796bd49e8570669b3c51154a91634d28b19ae4ead33329230fa8
SSDEEP 768:rYichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz4roGgc:rYichfPWvPZplu1jan+LKgzDDc
TLSH
T11FC2F93B640CCA7E4FC01E5DDD1A6F9B7EA802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

244c90a2-2a5c-4d94-8324-88f07519de26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\244c90a2-2a5c-4d94-8324-88f07519de26.tmp
Size 10KB
SHA256 13a29eb35b48019600ce6e674d7649d41b0758f11a5b1ab9f0deba7724fe7f1b
MD5 bbc86cd70a815dc8b647441eb9cb0a9c
SHA1 2b03db8e1fef9089a61a65a0bf623f418ba74afa
SHA512 0bf6405b3ecd81f62032fd427c5c9a181323c60abd703357b2676e532601d8ea027a6b7c0d29852e438d697b83324b02edb1b8bad3df5585ea69a8db253718d3
SSDEEP 192:sxZpR+n3/f7sNkIdpLHW6+WNGYgMVIHIg5/J:sxZp+3/f7sN9LHbGbn
TLSH
T15222B7566E28A97B8CCBE20DBA157F53E6F9503251941E48AAFCC71C05E7ADE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76999e43-dad1-47b0-ad8c-26705e90a8d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76999e43-dad1-47b0-ad8c-26705e90a8d7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7f4788568b9d3bcdb2dca03c60818db5a683d74e1faec644d1a2d267ef0c0f24
MD5 d21628b9bbab325a555f50d4c29846ff
SHA1 578a35770187e237b4f0787116641955af5d59aa
SHA512 8c98aee07db7632bb3e1f45d35a380a36aa45a6430ae6a73b553c3e179366a5438aa8b89f1414d9dd4d7206b277211d587dbab66f420baade90d1209ab17a6ca
TLSH
T18361A04D92AC9575FB68013F77D600EBF33089E04CCFDE529DA4D83A98467249A482CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 764cae30d5fbd5ab0b9cc726648d97d0ce4bb7edd5e683aae1595afd7fb2e488
MD5 bf0b4f5221810f731f6fbd29daccf47a
SHA1 9d434b81ba42495c54ae7c236bd9c5a3f6fe9887
SHA512 e7371fdd25cf2d79745c15979499749e59a694b2b9c2f70bb57708cbc0239d9417788ce4d26ec219aa4b00020919efeccc4f7a0792d377dca0e8e91cddfb739c
TLSH
T17E61A04D92AC9575FB68003F77D600EBF33089E04CCFDE429CA8C83A98467159A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

aa6b5739-1a95-47dd-adca-2994312805b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\aa6b5739-1a95-47dd-adca-2994312805b7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5afb83eb-546a-4b14-aebb-23346abde275.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5afb83eb-546a-4b14-aebb-23346abde275.tmp
Size 1KB
SHA256 272d5f59c5e73f4af05e868dd8d830760af353c29c17704070dfc3e7021e6ad6
MD5 cf73932582ac9c61074eb644f858cf80
SHA1 d8d993aef1a13ec8efdb64b2d7a5c56995b9dd32
SHA512 9b3137fa054882c6c2265de7fead98462ddddcbc542bfd6b498ebc61fd7841a99e0a6d64df93f85358047e2fc7c59d663826384ba7099fcbaa255893710acd1e
TLSH
T1AB219CF3C3E4866E8D1156F0AA24AE2BCE2D0905425C3C1A89D4EF5B97F3476E10254F
MD5 SHA1 SHA512 TLSH

Submit Download

5dc2f1e4-8002-436d-bf7f-88b7f9f05ff5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dc2f1e4-8002-436d-bf7f-88b7f9f05ff5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f7fc9c79-4f05-4cd0-8446-6b00131272a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f7fc9c79-4f05-4cd0-8446-6b00131272a1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 40b53459f318fa7cb7027ee9ccedfd625fc5cdf263553acda2c372c7cbcbdc44
MD5 6a46d9837f108fee103d0bcf3f986e2d
SHA1 75a5dc423d3fd5ab6317bf7e23bc141d17ab13e0
SHA512 7277de3c00b04b8a8b6bf1574fb247b41b52f75862c71f04acbb1ed3fd3bf2d1081f1d38d12f73612dfa4b831fa2f5732c345adaadfe21ebd7522be609485350
SSDEEP 192:sxZpR+n3/f7sLkIdpJHW6+WNGYgXVIHIgrJ:sxZp+3/f7sL9JHbGG9
TLSH
T1B622B7526E38B57B8CCBD20DBA25BF53E6F9503261941E58EAFC861C05E6ADE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 26e6b105860c6fa4f5bd8db2c0fad183fe845c7352e3b308171c521e73093984
MD5 06d83657c3e50c7e0d8959e7d495e89d
SHA1 138991d998bd9c4c68b4063fc817f1ff845e0bc0
SHA512 67c3b0b421e6a54122ee03f27b029112c7e66e092de76376babd06dd6201c8cba9d7a53fa04c6156531e11bb736dbf01d852392f206615f7af2bd67f46e43663
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLL5LILVLpLzL3LLLkbL3LSLPISLBLkj:KgHyKoUW6KgKPK0owKFu6J
TLSH
T1E391A51675BB1351387D2A8C44AA875F429170B33518E97BBFBD41A1CE6EE005CFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e21df567-dc37-4a2c-9bf0-dee1caf1db82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e21df567-dc37-4a2c-9bf0-dee1caf1db82.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fc73e53-a461-443f-b34b-63c9b1dd8427.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6fc73e53-a461-443f-b34b-63c9b1dd8427.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ba742aa6-db55-48cd-86ae-7add42ea4620.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba742aa6-db55-48cd-86ae-7add42ea4620.tmp
Size 21KB
SHA256 02cbc528dc82f2d2ebbcb8fbb3db1ffd1f5a94cb42ce85e30fad077acb2c54de
MD5 d06b7bfc844ea8575e49fa2acab19f07
SHA1 0337a1f94cb3426f8d01cfc647e89370e88509a3
SHA512 5a00c6c8070aa9b85381b2e58bade8ab16c3bb1b878d94f2d0911f96e074ff0a63790cb9b9857bf898c73ee92652295e531dedbcfd6f78e32f9c4dcf9588fb5c
SSDEEP 384:GiFnZcI+SsNq8TUNTUlIlyR5GDTeBGYX5E78pxa++25VtgOIwZOy9oSoc:tFPTHwgmeToGYu7Wjl5VXs3SP
TLSH
T175A26C338CA89D7B6DFB9A85F54A36038FB4416BD6C4EB94E2ED5A1D00DB1D8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c79ba5de-d2c5-447a-a25e-e2671625071e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c79ba5de-d2c5-447a-a25e-e2671625071e.tmp
Size 18KB
SHA256 e635faf5892d903166e5803f9025e2aa2ee6a31f1cdd09f0dd8490de20a34509
MD5 b8974293c92ad7c9381b251bda192ca8
SHA1 846f5f47fcc39d780187acc8254afa3886db2232
SHA512 36e9ebf6c943c297ba7717eef765312267415980a2af66ac84ece725798186b9668dcad6886560e80e79440367d3f3d00b35e5aa8732e34a794c142553b7ce08
SSDEEP 384:yZcI8sNSyR5GDTeBGYX5E78pxa++2fVtgOIwZOy9oSoc:A8+eToGYu7WjlfVXs3SP
TLSH
T127828D369CB86D7B1CFBA581F5473A038FB8902BA7C4AF54D5ED1B1D01DA698130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee28c57c-2259-4337-929e-11c38c4377b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee28c57c-2259-4337-929e-11c38c4377b1.tmp
Size 8KB
SHA256 e5f89c6d1b42d8733259737f3cbbbdca22f8ec12db4bd086e246a5dcee8b937a
MD5 7e04505c1ed156477e2a35158bb76076
SHA1 2223846c4ad1bc83a3e68eeb7d1f393af678e4d7
SHA512 7513f742074529e7e676a3554eee9021aa1fd7395c89d5611501fad925d154dcb5604f3faa19fd3a21e13e0dafb9f75e8bcd55430988a9b260784ea11ca7df7c
SSDEEP 192:LJONAh6DphmqQmiUyRoq8wGYX59eziC8jkk7YwxU6:lONAh619hRwGYX5E78b1U6
TLSH
T11002E939E8787C7B4DE7AE45F54B2B139FE8212BAA906B84D6E81B1D00D764C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef7621d9-f322-4169-a8e5-a3ae0410bddb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef7621d9-f322-4169-a8e5-a3ae0410bddb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9056c5c7b2ae0279f759847f8e620e0d876335daa3594f23a5579cf2eb56bf32
MD5 a78cdcc58cbb82189694f497df57b342
SHA1 7a29712fef8b423e846b8dcd37fd5f9db5d2625a
SHA512 266359cf6d013b257d7ecbf599b3f49d36e5f634779a37247291b1856e4ca511c56e3610691c97a37f8dc3157a49f246e1573c37ff3bb03e84409e22e5fa754e
TLSH
T142410799A6ED1048B3B7AE5BABF6B86D447F7D372F0AD49D10110E4F4622A00C972773
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qsidhmnr.gzf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qsidhmnr.gzf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

s.crdownload

Path C:\Users\Admin\Downloads\s.crdownload
Size 443B
SHA256 c2f5532f3209dce0bd30ead47a2616a74ce8170324ef68dfd59acac3f5f1da34
MD5 9c43855a8f86bfc665c509fffbe117ed
SHA1 96f4cffb3f37a759d61376cea4ac77f1a953b00e
SHA512 645a64d35b287505d6eb730e24c011df23835d5f0ae9948b30457113427379988e112cbe01c48505960c6b2d714244ca9fbda6a60a831c582b70ba7fedb00bd3
TLSH
T181F05457D639FD7179CC4D1CF45819442EC741EB58E53D64D1C2BE0E757C19811B0310
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3268-303-0x0000017965240000-0x0000017965262000-memory.dmp

Download

memory/3268-311-0x0000017965740000-0x0000017965784000-memory.dmp

Download

memory/3268-312-0x0000017965810000-0x0000017965886000-memory.dmp

Download