021daebd377e591ae063256100a7bacc9b73409fc3c2148683ad1b6276ff66df

Analysis

user interaction
yes
max time kernel
133s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.ps1
Size 1KB
Sample261012-1bty7a1vbw
SHA256 021daebd377e591ae063256100a7bacc9b73409fc3c2148683ad1b6276ff66df
MD5 5bdecba9be2640a70f3981b8437c9fc6
SHA1 6193171ea8a143033ed49e8ab4c058166e666239
SHA512 ce5a1d985a6204c0475e3860f6ad5dc3f95cab23fc8afc1db30689ba74f18f2b85af895650a383e7edd559815bfafd161f9dcd1a2d4bdf023c75ea7d6870e655
TLSH
T17F31653F5C072936DBD3528FB24FA2182E2B942F544C9D80B5BC51107BA35B946725AE
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4576	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	4576	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2784	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{9BB13E99-9F8A-4A4B-AA2E-CF5EE2844B09}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5628	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2784	4576	powershell.exe	97
PID 2784 wrote to memory of 4128	2784	cmd.exe	99
PID 2784 wrote to memory of 3440	2784	cmd.exe	100
PID 3440 wrote to memory of 5628	3440	msedge.exe	102
PID 5628 wrote to memory of 1356	5628	msedge.exe	103
PID 5628 wrote to memory of 936	5628	msedge.exe	105
PID 5628 wrote to memory of 4372	5628	msedge.exe	106
PID 5628 wrote to memory of 4372	5628	msedge.exe	106
PID 5628 wrote to memory of 4372	5628	msedge.exe	106
PID 5628 wrote to memory of 5664	5628	msedge.exe	107
PID 5628 wrote to memory of 5664	5628	msedge.exe	107
PID 5628 wrote to memory of 3596	5628	msedge.exe	108
PID 5628 wrote to memory of 3324	5628	msedge.exe	109
PID 5628 wrote to memory of 3596	5628	msedge.exe	108
PID 5628 wrote to memory of 3596	5628	msedge.exe	108
PID 5628 wrote to memory of 3324	5628	msedge.exe	109
PID 5628 wrote to memory of 3324	5628	msedge.exe	109
PID 5628 wrote to memory of 4584	5628	msedge.exe	112
PID 5628 wrote to memory of 4660	5628	msedge.exe	113
PID 5628 wrote to memory of 4584	5628	msedge.exe	112
PID 5628 wrote to memory of 4660	5628	msedge.exe	113
PID 5628 wrote to memory of 4912	5628	msedge.exe	115
PID 5628 wrote to memory of 5504	5628	msedge.exe	128
PID 5628 wrote to memory of 2448	5628	msedge.exe	129
PID 5628 wrote to memory of 6064	5628	msedge.exe	130
PID 5628 wrote to memory of 4992	5628	msedge.exe	132
PID 5628 wrote to memory of 4992	5628	msedge.exe	132
PID 5628 wrote to memory of 2212	5628	msedge.exe	137
PID 5628 wrote to memory of 2212	5628	msedge.exe	137
PID 5628 wrote to memory of 552	5628	msedge.exe	138
PID 5628 wrote to memory of 552	5628	msedge.exe	138

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\onwx\setup.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\where.exe
    where winget
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.python.org/downloads/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.python.org/downloads/
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff9874fc188,0x7ff9874fc194,0x7ff9874fc1a0
        5⤵
        
        PID:1356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,16232013365992377735,10705086948361366785,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,15049383639120263886,3637427492732991016,262144 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,15601507475519887415,15660443738386538892,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
        5⤵
        
        PID:5664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,13048541162664771392,3637137761080245206,2097152 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,9597281425154338720,13228958156142875017,2097152 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12901478302167323340,18173713442558270264,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2690154498171428795,1834929784695003201,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:4660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,10576474459457562703,15357100549777901062,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        
        PID:3468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,10576474459457562703,15357100549777901062,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        
        PID:4912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,7160274676498277283,16674899177479780913,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,357810447179737664,16483161154476875099,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:8
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,11452133846168997393,12502156612651207515,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
        5⤵
        
        PID:6064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,18065121648448337574,10295144214930635723,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,4761387220213564613,10144492429245963949,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,918116802488868411,3807408833650529411,524288 --field-trial-handle=2376,i,2399837715537915490,3982810772470491313,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
        5⤵
        
        PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f9f5d53-2a00-4ba7-9451-620e3bf5e49f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f9f5d53-2a00-4ba7-9451-620e3bf5e49f.tmp
Size 26KB
SHA256 964eb7428ea7ca1f2e6f9766643d270e18c2d35d119834ca88dbdac2d9da3a8e
MD5 a1b6cd5dd9fd4a1be502f59cbc374c71
SHA1 6a6680ba9de7d5281665df5c9c622c0b2500f4e7
SHA512 cebb5b75b1e86ad7875857c5a6d8a97b8bce9d6a43f0a96f88658caa234394acd5b722eec390b26ba1c624a35006dd512b266344d4c8641846b91d93bcf5c25a
SSDEEP 384:nriFPZcIG3sNy8TUNTUlI4e5mguEzs/4zf8BR6aGCY50li4/uANEbEeUKgL/7Ize:GFHG3fwgsXxBjGulLJCbETz
TLSH
T121C25A32E8A4DABBADEB4FC5B74A7607DEF44123D68C9AC0D9D95D1D009719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f560f08-53e1-4909-a729-0522fc002004.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f560f08-53e1-4909-a729-0522fc002004.tmp
Size 25KB
SHA256 8fcd25225086be16eb6f67b36d1c08e7181ad1f17b578cd65b34f23a158836f2
MD5 2ba0c71b6ced38033996d91591bf287e
SHA1 637493d5b920a862754079bb4cfab0bc5bdcaf52
SHA512 e9de7776ceb10aee159eed376c28ddea858498ae273085f2392db36b2b7fc1ba8734cc5729e05a03e23d1ac8a1b1b5eb802e47807d6879d9a48280f632f257a0
SSDEEP 384:nriFiZcIa3sNy8TUNTUlI4K5mgu1zs/4zf8BR6aGCY5KlugL/7Iz8oG:GFQa3fwgoyxBjGIlj9
TLSH
T1EAC23A32E8A4DEBBACEB4BD5A74A7603DEF44163D58C9AC0D5D95D1D00972DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

724bda37-813e-4112-8511-a6b68d9ab2c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\724bda37-813e-4112-8511-a6b68d9ab2c7.tmp
Size 31KB
SHA256 76088592f2716b4fae4b5864258d4943a2720180729f9bbbfb72867a1fff9ff7
MD5 e30adcefc6950055592577d73c04f214
SHA1 c8455e43a978ec7e5c23b3b9284505fa4ea69907
SHA512 0701b43cb2163a9e8a5b46c4fa9b77d0398f738d61fa7974accb62c6b99f2c2588442031f07dd4a8dc51bbf943398ca307605e37f8e8871c1093f245666b534f
SSDEEP 384:nsiFPZcIrg3sNy8TUNTUlI4e5mguEzR/4zf8BR6aGCY52li4/uANEbEeUKgL/7Iy:XFH83fwgsyxBjGMlLJCbETz
TLSH
T1BDE2C5F198D79977D8AE4B87A37E2D0299FCD123B5885980B7D84D0DCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1a498295-bb3a-49e9-973d-252468f05b3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a498295-bb3a-49e9-973d-252468f05b3e.tmp
Size 12KB
SHA256 dad333cfdad809e9e35797ef86019648bb3879e9bf80e65a7c6506b7bd186ca7
MD5 4a5eaaf843ced912f02a318e64cc6b93
SHA1 1a4180f3e9fe1792cf50c610ab89e36b3d340eb3
SHA512 fbfb3bf1b2abcb52f3c18af184b8332d68ef29257a1888e5a52a2d2e454e66c0c5694f345ac5a1c1ecfd81fec3c6ff15a034dd0cdd652a74ada43eac2e8eea22
SSDEEP 192:sxZAROjm/fZsWOQZZNIN2hzodp72HW6+WN9nE/YbIQRwPYBXIg57ZJ:sxZAEm/fZsFOZNXKqHbC/FQcY9dD
TLSH
T1FC42DA15AE28697B8CC7E319FA557F53D3F92032A0941E44A6FC8A1C15EB6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a312678-50d6-4569-aa5b-9176dcaff4d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a312678-50d6-4569-aa5b-9176dcaff4d6.tmp
Size 32KB
SHA256 873c6d5d81ca6aa26e4312e106de70a9b59bf378d65177f23192964706065925
MD5 85bd58e73fbd8c6a2a3a24a9d1689d39
SHA1 af3cf8152f8b8ada3d0a7d07595ab7c426666b2b
SHA512 32ce724ae79697b48451bedd5782900f516a487ea0eabcb9d1b7d6a49bac6ab521d60ff09925480889670ce8494a658adf6e9d0b76ec29cbab04f6e71512346d
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVowLWLlMC7fnroG:0RyktjYEbvnWvDBltu1jaJwLWLywf0Li
TLSH
T14DE2FA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C77EA511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b57b611-5437-4a93-8535-1a1901bb58df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b57b611-5437-4a93-8535-1a1901bb58df.tmp
Size 12KB
SHA256 ed07d56cafacbd8ff3bbcdf29dc051a0c084a36dcd9af163fc3a409c41d57cab
MD5 bfa00f9a197ed98400dd42384bdea759
SHA1 79cff93db35d03eb9aefc427837c70cb1b5a175a
SHA512 da2c397b6f7ea322f3444bd3fe0d5b4b2aabffa3fb073f71f76dc55b252417597a5f62c708ba2dc4840b35a95131a3a3d54ad5fabab1ce34cbe40e98d7927af3
SSDEEP 192:sxZAROjm/fZsuOQZZNIN2hzodp72HW6+WN9nE/YbIQR8PYBXIgjZJ:sxZAEm/fZstOZNXKqHbC/FQIY9jD
TLSH
T1BE42CA15AE24697B8CC7E319FA557F53D3F92032A0941E44A6FC8A1C15EB6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8346fe99-82ca-43e5-98ec-cb1a5f3f885d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8346fe99-82ca-43e5-98ec-cb1a5f3f885d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a5325b9452e3cc8d7c3f8ff99235372c44d7aa6523bc57637e92c31277ff21ec
MD5 5b874bf604749b50be28a5edb85f899c
SHA1 3539c6378fd26513c768b5b9f030a818c1530adb
SHA512 dbd895f6bc083643c7433825539cf786ae727f6bdb7d101f026fb11f8616f2e26c1a0c4f17113642ece594d6c1f5c2d6c6ac8182105c1e85048c142fa517c334
TLSH
T169618389E4D148ABDBE45A3045F460C2B5347BB8D9B3DEE9085CECBC9742B5842678D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 33c227dfd9d7f73c14e59df5b30d1cd18ca133829516accca85d59bc1f9c0251
MD5 3b8c77e08cd8ab2892e49c8da1f013ed
SHA1 252b7844b84db3865f5eb9a4a9f1ef7fb7ae7ac6
SHA512 b7ffe5413835f9d7b9ebbfc55ed88773acdd8648b61014eefe04b5d0b65b8390ff142c0453bf52091a8d7c645fb17d4dcdb4d1775e7802095c9a543759942926
TLSH
T12D617289D4D148ABE7E85A7041F460D3B6387BB4D8B3EEEA085CDC7C9742B1842778C4
MD5 SHA1 SHA512 TLSH

Submit Download

3bfd990e-0029-4ca4-a31e-8d02912e3b82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3bfd990e-0029-4ca4-a31e-8d02912e3b82.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

25ccb1e5-91d5-4fbe-8871-ef4e1593ff86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\25ccb1e5-91d5-4fbe-8871-ef4e1593ff86.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

623b190f-5644-44f4-87dc-992e2d50d8e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\623b190f-5644-44f4-87dc-992e2d50d8e8.tmp
Size 3KB
SHA256 85ed79336d0d42db36c6671ba6da51e7a031b993edf89fc22b8a51db0bb33a10
MD5 56411c80c8c1f6f6a10206d7beed3351
SHA1 bd41dfff132c46dd6a05c5260740915e5356736d
SHA512 69b40f82b1d72a93370eb02cab192ff0207fde4299ffbaa5075797f3d2a48e0337c5fdd50090cc9c651c71a23202176ecdce76b9bf76732c6e9d52bf7961b3f2
TLSH
T11D619EF3C3E8892EC90295F4AB14AE2BCF5D0554531C3D9AC8E4AE5BA3E3471D28164F
MD5 SHA1 SHA512 TLSH

Submit Download

8f25c960-68bc-4443-b936-fd3a16561e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8f25c960-68bc-4443-b936-fd3a16561e61.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 162ffb390cb8a7c193fe7928f1489b3c451f65accae87a30c29905e7a095d00e
MD5 69623bf7f9aaabcf600c933bf0dcd58b
SHA1 dab9984f36904d58c261aa4cbcaf4557f80a51da
SHA512 955f1c6d7beabb4b16f6ee3f876c4c7c6bc2b70b685581fded1e02840968dc17fdb4c656f05181500c707257e9a08ac3d2dccd5a8dddf2a722a6e9ad97734d20
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXw3xY:OtfFvpopPxrB4RhfwhY
TLSH
T1DAB2351471BA021138FE790881B6872F464232B37259E63B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abf469af-845b-4c53-aa6d-a2866bade725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abf469af-845b-4c53-aa6d-a2866bade725.tmp
Size 12KB
SHA256 83f20edd0f5161af0b9b0a58bbd9e401642f2d0af8a859e4bc8e19ac6f650270
MD5 53baac26d0221437de664787d6fe17ae
SHA1 628cf99fa811251b17217c4de0c8d22b2da0b1c2
SHA512 b9cbac56714b8fb600b68a7ce54ec8427e9eac8a74f649ea23e87a37592e5a05e224f1ac6646c9e39e3a2c0df87b7e30c89bb0ca77a11d8d037a40873342f99c
SSDEEP 192:sxZAROjm/fZsWtQZZNIN2hzodp72HW6+WN9nE/YbIQCwPYBXIg5NUKJ:sxZAEm/fZsWOZNXKqHbC/FQjY9MG
TLSH
T1ED52DA15AE286A7B8CC7E319BB55BF53D3F9203260941E44A6FC8A1C15EB6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f41df581-4f86-4295-ba33-5d55fd79f5e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f41df581-4f86-4295-ba33-5d55fd79f5e2.tmp
Size 414B
SHA256 84b5aee9fdcb88715e0cfed5cab1396373648d9f8dafa45276f201896a4988ca
MD5 b10c9604e2ed569b7b8d33df419b1ffd
SHA1 28b1726cb1fdf31dc1f3b3fd29b89d6f9edfb7ee
SHA512 6c60a56e4e4ac5a3409c28c9cfa8af386aa806debbdd81dcdc2bb70868d95c21f93cc304490961eb5f6d8361436c832c9b5997981f6551b660cabc9f60cca959
TLSH
T1B7E02BF5C925AC3708FC175890940649FA4513473A81854F773D800D8FB1B765286C6C
MD5 SHA1 SHA512 TLSH

Submit Download

c4245edd-0ace-4a78-a8b4-f6094bcf0e14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4245edd-0ace-4a78-a8b4-f6094bcf0e14.tmp
Size 26KB
SHA256 eca5ac68b7493f7fa57a94a9062af27a6c2efc3096e1d0688f7ecce9b4acdfd8
MD5 3aaee1426c44328fbd77b3c0f22ad525
SHA1 f596a697749ca849c65c45894bcdf5341b2d996d
SHA512 4a9bb21c93b8649b728465227e8e56d8db78df89588e6984779ad6f98663227a2fbafe601b2b192fc2d2bd6bfae3a1ae7109f4e09c890b5ce14e7e86c272caa7
SSDEEP 384:n8iFPZcIG3sNy8TUNTUlI4e5mguEzs/4zf8BR6aGCY50li4/uANEbEeUKgL/7Ize:nFHG3fwgsXxBjGulLJCbETz
TLSH
T14DC25932E8A4DABBADEB4AC5B74A7607DEF84123D68C9AC0D9D95D1D00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b69abd85-3c3c-44e1-9373-a1ce9ae26d32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b69abd85-3c3c-44e1-9373-a1ce9ae26d32.tmp
Size 2KB
SHA256 96e9becb84067c67a6e2ba424a6c0d985d1ca1bc899b02b81236f454f286ca8e
MD5 133eca54e24e0711651de6045568e3a5
SHA1 8325f2bc6dbb92ce76a490f51006b1911d5c26cb
SHA512 6acf758b9ffb669ff4c8580b08565617d9d53acfa259282d157e4989af0a20c62632ef93e212c590ce9364a3484f205187c811ad6d5b9282b977b24b9b8d77f3
TLSH
T1354123E0483D1ED1C4BD0DBEB48B35EC94EC9722B8A4343D289CEDA89A7E51D210083F
MD5 SHA1 SHA512 TLSH

Submit Download

fb47200e-341a-4427-bc29-a4f67172676e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb47200e-341a-4427-bc29-a4f67172676e.tmp
Size 25KB
SHA256 f73792b084defaa85a7a0666cfd3195947d9fc0d91f130124bde568d5e9eeced
MD5 324b98eb17e25745a98d5031aba9b7b8
SHA1 f550ac050a7831836d423f090f09f5503e01c3c8
SHA512 a3f858b933007d1b592dbe5233db55b78ce681a8f1b4bc4e6544e7de4a406190796d28b7008e19333b1b2ae43f234722adf4f79b500f5c21177682c081ab004b
SSDEEP 384:nQiFiZcI63sNh8TUNTUlIm25mg5in4zf8BR6aGCY89sa+VYHigL/7IzSoS:rFQ63YwgSJJBjGQ9hgGf9
TLSH
T1F1C24A36EC98D9BBECEB4FD6AB4A7A07DEE41167819C89C0DAD45D4D00932DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcd04606-e7bf-4cf3-99e8-d80aacee59c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fcd04606-e7bf-4cf3-99e8-d80aacee59c8.tmp
Size 26KB
SHA256 8a1a10b648fe1ead1d68e5c9ddf4eaa9e2fd2b8283090accd5af692d0c1a97a8
MD5 350cb5f202128453a481e1927de4ac2c
SHA1 b7268d2026fa1e9415d622831e77b06bcc314531
SHA512 6dc071cd24fb15d3a40ee803c0c9ef46f5cee72ab9a04acd0f2301f4e32700db1e8be16409f4afb199d7ecb3d5abb79cb29625a91eea81656eba7b58fd2cefde
SSDEEP 384:nHiFiZcI63sNW8TUNTUlIm25mgqOgc4zf8BR6aGCY5Klsa+VYHigL/7IzSoS:CFQ63vwgSFiBjGIlhgGf9
TLSH
T101C24A32E894DABBECEB4BD5A74A7607DDF44163D58C9AC0DAC85D5D00972DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 239474b230767c358dd802f1f1cf5df5f4634a902ee62cca87f490cfc0886b87
MD5 7cc861c968c5e43a0abfd05f142fb7ea
SHA1 d83202797d1df2ae2c4d3fb5ff6f9be7aafa67a5
SHA512 01568b01268eeb1af90edbc62e83f0664d2b0d38bd9fb159e60c558bc275fe934d36acf00950b0442e2f1095f2e8f316e44e2cdcef5f8833c21e6ecd2acbd863
TLSH
T1D7410759A6FD1108B3B76E4AABF2A96D447B78772E06D1AD00010E4F0666B40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sacfutwt.sqq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sacfutwt.sqq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

find_python.bat

Path C:\Users\Admin\AppData\Local\onwx\find_python.bat
Size 2KB
SHA256 ce3bfffc80b04f3395d64aca824b9caecb190bb9f776a49ea7576326c46f21d7
MD5 a3aae5d2640d2b3288746e5a8c477ce8
SHA1 80087945ecfa6b8eec16faa1447939e351060015
SHA512 26eed50fe9f0d9273a46897465b3b91fe246dafd59037f39e651baa2619e0b328fde6a403ce624d6ab7e840199fc3411781685042612041cc641a95dbaf4da69
TLSH
T17851317F25009275917543EC778D0711A3C342FB5266AEFC343A84996F0D82782F7AB6
MD5 SHA1 SHA512 TLSH

Submit Download

setup.bat

Path C:\Users\Admin\AppData\Local\onwx\setup.bat
Size 2KB
SHA256 1be3def855abe879e94c5c2cabe47069b062077ce12a72d861a72a04281886d5
MD5 5559db41c11fb8b8fff7e3458bd7bc67
SHA1 f77e4f5b62171e4bcd9b6ac5d8181825338d7969
SHA512 d9cb1e1ceb5bf6a64a78b475965e0749a087fc22baaf1cf7c977c5d60d14e79c5c241c014e010a06b0ec18bb6f5ec6fb19b3871f077967f77b17d6bda2cf7f7f
TLSH
T19541641DA516E3F5AA714323532F65E8CB51C1772324C89C39ABC00C3D9E1B39DA7692
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4576-47-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download

memory/4576-46-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download

memory/4576-1-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download

memory/4576-12-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download

memory/4576-11-0x0000026D1FBE0000-0x0000026D20108000-memory.dmp

Download

memory/4576-10-0x0000026D1F4E0000-0x0000026D1F6A2000-memory.dmp

Download

memory/4576-57-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download

memory/4576-9-0x0000026D1E3F0000-0x0000026D1E412000-memory.dmp

Download

memory/4576-0-0x0000026D1E490000-0x0000026D1E4A0000-memory.dmp

Download