3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e

Analysis

max time kernel
24s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 8KB
Sample261101-2bs8bsdw4x
SHA256 3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e
MD5 68b370b7555a5453de2ee92b85954f3a
SHA1 973726570fc0ac35e881ff357797f883111e4d48
SHA512 74e141d711fabc660763330f98c37649ecb66eb1ef900af997ae58a3a6c035f67c6beabc720bde1bd9d42508aa42f54ee2885c605cbe2ebbf4d65b6768b83499
SSDEEP 96:9R19rtfRrcpMDQ9XZAT5/I7guG6qe3IEc4u9J9/k1cTHaFIDiSI1oR:99FNcpjF+ec6qe3D6PhkmTH7DC1m
TLSH
T16F025355260259E683B3DE468CF3E61CFBA09077225E594D306C92E6AF39B1BC35C41F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6A9CA287-6B8F-4C47-9446-4CEDB67E48B6}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\AI_Training_Home\logs\telemetry.jsonl	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	powershell.exe
3944	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 892	3944	powershell.exe	90
PID 892 wrote to memory of 2476	892	csc.exe	91
PID 3944 wrote to memory of 2088	3944	powershell.exe	97
PID 2088 wrote to memory of 364	2088	csc.exe	98
PID 1352 wrote to memory of 2488	1352	msedge.exe	105
PID 2488 wrote to memory of 3092	2488	msedge.exe	106
PID 2488 wrote to memory of 1616	2488	msedge.exe	109
PID 2488 wrote to memory of 2824	2488	msedge.exe	110
PID 2488 wrote to memory of 2824	2488	msedge.exe	110
PID 2488 wrote to memory of 2824	2488	msedge.exe	110
PID 2488 wrote to memory of 908	2488	msedge.exe	111
PID 2488 wrote to memory of 908	2488	msedge.exe	111
PID 2488 wrote to memory of 3600	2488	msedge.exe	117
PID 2488 wrote to memory of 3808	2488	msedge.exe	114
PID 2488 wrote to memory of 3600	2488	msedge.exe	117
PID 2488 wrote to memory of 3600	2488	msedge.exe	117
PID 2488 wrote to memory of 3808	2488	msedge.exe	114
PID 2488 wrote to memory of 3808	2488	msedge.exe	114
PID 2488 wrote to memory of 4860	2488	msedge.exe	115
PID 2488 wrote to memory of 840	2488	msedge.exe	116
PID 2488 wrote to memory of 4860	2488	msedge.exe	115
PID 2488 wrote to memory of 4860	2488	msedge.exe	115
PID 2488 wrote to memory of 840	2488	msedge.exe	116
PID 2488 wrote to memory of 840	2488	msedge.exe	116
PID 2488 wrote to memory of 364	2488	msedge.exe	118
PID 2488 wrote to memory of 364	2488	msedge.exe	118
PID 2488 wrote to memory of 5196	2488	msedge.exe	119
PID 2488 wrote to memory of 5196	2488	msedge.exe	119
PID 2488 wrote to memory of 5668	2488	msedge.exe	121
PID 2488 wrote to memory of 5676	2488	msedge.exe	122
PID 2488 wrote to memory of 5668	2488	msedge.exe	121
PID 2488 wrote to memory of 5676	2488	msedge.exe	122
PID 2488 wrote to memory of 5820	2488	msedge.exe	124
PID 2488 wrote to memory of 4840	2488	msedge.exe	125
PID 2488 wrote to memory of 4840	2488	msedge.exe	125
PID 2488 wrote to memory of 3168	2488	msedge.exe	126
PID 2488 wrote to memory of 3168	2488	msedge.exe	126
PID 2488 wrote to memory of 5488	2488	msedge.exe	127
PID 2488 wrote to memory of 5488	2488	msedge.exe	127
PID 2488 wrote to memory of 5580	2488	msedge.exe	128
PID 2488 wrote to memory of 5580	2488	msedge.exe	128
PID 2488 wrote to memory of 1964	2488	msedge.exe	129
PID 2488 wrote to memory of 1964	2488	msedge.exe	129

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ndsa5rtm\ndsa5rtm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7347.tmp" "c:\Users\Admin\AppData\Local\Temp\ndsa5rtm\CSC7CDE1F4946854EB38C21F47A8C5A5CD3.TMP"
    3⤵
    PID:2476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i3u0ayut\i3u0ayut.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C40.tmp" "c:\Users\Admin\AppData\Local\Temp\i3u0ayut\CSC7E82EA1822274D54BC8ECC91BAB059E1.TMP"
    3⤵
    PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffadd85c188,0x7ffadd85c194,0x7ffadd85c1a0
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,10949747765893365986,16424923473692957089,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,12948668422416010857,12305599392728875812,262144 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,8955935925252738350,2252979892004077581,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16810212611218516379,14269492466132891224,2097152 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5826072382869180684,937507615965932918,2097152 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4440341743738172728,15940299203494999724,2097152 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,6558985342650557831,2837456032340477383,2097152 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,5358575010490294054,1673420161657362435,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12883305825703642577,1018896017269193523,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,14788559235191737505,3788360659683086869,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,6249238674525189834,1144184568497286817,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,18136173895131095362,368315407686796286,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,18136173895131095362,368315407686796286,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14815122928883384078,1453401151446801380,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5450293778745937327,328339948456278379,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,1655060967119022024,6537886432552877047,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,13455392928824625778,6223816198968797043,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,2545368146887646151,11509616735190889174,524288 --field-trial-handle=2320,i,14013269646222156626,18440094775925825645,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
    3⤵
    PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1168

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7850085e-3f28-4af1-a65f-73b939a4e56a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7850085e-3f28-4af1-a65f-73b939a4e56a.tmp
Size 8KB
SHA256 1a9e5647fa9e2abdd02c3ff65106ee0f2ab35f8419e755be79aba9f944bec2f4
MD5 eda6179654bd391ef3cbd3428d513e6c
SHA1 de538f63ad5bfd229b3367e9fe9efd77e91064de
SHA512 becf37a33bb4f0b2de35679bde4042b6cb8c63f06b7320af0d5452b520de553cb350f244f45fb83f086282cf9efd15627840073fe372f03a7a78ccf5d9f88ade
SSDEEP 192:SONB6JUgQmiUyznuo//oT5VeqUNxWdqkU6:SONB6+gouo//oT5Ve1WdU6
TLSH
T18B120735A878EC7B5DE3A590F08336138FA0406BDB85AF90D6DD6A2C06DE19C6307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c356450-66f7-4b88-a462-e763caa4c3e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c356450-66f7-4b88-a462-e763caa4c3e3.tmp
Size 18KB
SHA256 01754a27c78a3300375feab33a5575c1e25cbcd426070ac45264d4960b770bbd
MD5 4a1d6be8d62aa7ce71ac0e9bcee3ef33
SHA1 c132ef483ccb0545a7a5aceaf78d2517bfcf8985
SHA512 ef814a9db9c6fb9f088c8853206c86db7018c1be00cf4971f110875838e38372b15457f2d65e37a2e209e4acc28e8356a8d40c7a887431c7d7888145fb8193ed
SSDEEP 384:nRQkUSvIsNDUnTx6/b9m7uh//oT5VeRWdH7vBEMfIIl8:DIBa/AT/QWdH75EqLK
TLSH
T12F828D31AC79AD375DE3A150F14A3A13DF70806BDAD55F90D9DEAB2C02CE1982387D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e190e9a-e978-4c17-8d17-b2bfb5e4dcac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e190e9a-e978-4c17-8d17-b2bfb5e4dcac.tmp
Size 8KB
SHA256 f59a4eaaf9ead5d464ce134cd3c001b4e8c1367cdf5900944023c042275883fd
MD5 62cd67a5f7f732d538d90245e22a07d9
SHA1 7d82bded345f3498ab4791fdb22fdd7153bb6fd5
SHA512 8363533ceda5d86ab1eb5c92810a5cbe9da10ab90561a07af415146d10b7c32a0ee11b1f0fbee2c9c24366ed520677af39265ecfb808ee91003a67c16e1ff97f
SSDEEP 96:KqONkFQsjpfbUmjH5ih/cIPURHl8h4otop5haDRBKP4v+Y1xf//ojd2xyY5qsoTu:BONh6JUm0QmiUyanso//oTpBCWglU6
TLSH
T19702E839BC78ACBB9EE3AE45F0477B239FA4106B96915F84DAD86E2C01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4612b207-9361-4e33-884b-00d18a98fa8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4612b207-9361-4e33-884b-00d18a98fa8b.tmp
Size 105KB
SHA256 baa37fb90b22728e8621cb1e0cd8370d14339295fb597cb899c58908f1d9ea43
MD5 3cf096da5ebbeb243b3cc63b1ce61c42
SHA1 ca076b08c459cee4e3c214a706dff7f9e182cb83
SHA512 9947e993a1b05c95053c60c8e5a9c544169c0476f5ca113971ea72db5ce4a94442075b08a2a9e36d34e5f00f8b4a8b4233e22fa2a713e941c9d3b5cc8e620092
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T12EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

24bc1d0c-34b7-4986-9c23-8cb75c88f980.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24bc1d0c-34b7-4986-9c23-8cb75c88f980.tmp
Size 32KB
SHA256 5643c1dab7886f43a5eb129b67ab62836a31b7a653cbb27888fc6d7de560ebdf
MD5 98c7e9e4010b56441668ba41bcd7bd1c
SHA1 5f50dada168fc815aa676db0fe2d5e1592739458
SHA512 e93e8851cec41c64e0ab9b07d00a512d1582d43924ec9ac836daecf347c51c27dfa6b4bf8f4c3c0ff7e9d67fd73ddd8347c686e3602157ed8e72b181ff3f30e8
SSDEEP 768:AKKlmu37pLuLjYQWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVDbd/LlpPs/vror:AKKlmuxEjYQWvUYe0u1jaqbd/L/E/8fz
TLSH
T1CCE2EB7B780CCA7E4F804ADDDC1A7F9E6EA802CB9698C94047F9945C02C66EA51174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 102KB
SHA256 68507cd63ba31b475df24e72126efa6f876ed08070edf9bc061370fa6d6236a1
MD5 9508051a8da5e63b0edf77fed708dbe7
SHA1 10b32bfae836baa1864152846e198fdd31e55001
SHA512 b8401dcb41ef9b0f70d9d00342349dfbe6a2218c5cc88335abac5a62360d0f0d44fa2381d82042dd0718036312903e605429ca8b57012aa74a04b02ee724f5a6
SSDEEP 3072:AC7MlsaVxw3ki4EEx1cWGSiAvi1ItUkzYdJ+oTK:j4Wa8Uzhx1/PiAvi1ouW
TLSH
T1CAA312330FAE5186C5E66D5C5F47ACBAA0C23C35254A655E2818CE39BE56728EF41C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 247KB
SHA256 c209d08247c1d8b19f781882aa5f13d6c1182f0aaf8f50794cc2af975769e0a6
MD5 4c704f5edc63733c5711074ddc6613f8
SHA1 62ad38563492029fe2ef350fd4594469ed0892f2
SHA512 190ab5e9465b583e9f252950e7de6da867e145cdfce30ecfed3910d535cf7c5728a4d1f253b0a1cbeba6aa5bc9632213a1be969e9a2dfc5a8ea699a111344fc8
SSDEEP 6144:E72H7HHlxEJ4CUTb7e465ALScvZ7KawhP2P:E6nl2JPiakSUZ7p2o
TLSH
T1264423080EEB4997F21E86F7178CD2E43665A458B23D80E79F8E99BD9439C30C6DB507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 36KB
SHA256 d881a7861279ea1fcdf0b4030c1714c7ed4c2e1560990051bae800df70fbcb1b
MD5 ee35337a988f3d4ded861c1bfd1687de
SHA1 55496798b91d93c2ac45a55dc7c194056ce76b0a
SHA512 c2f60f6bc419ea5e13b33d0d7250de4379dca4d4c04684bb5480573fb936e6cbd956097d7ca53bb1bf79c9768a700f697651c36c6f950012680adfe9954fbe52
SSDEEP 768:SMGRvHUpv2pHlsrbt2EtaB5AddPks6en+5GfL:SMavH82pi2fAPkdWzfL
TLSH
T192F2E143563A60B7EB127A7F0F673D534498A1F9CC2B35426E3B660E879633CCE60158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 39KB
SHA256 9bac2d0c95117c1e92351897b0548cc184941c6b9edffce4510542d443e87ebe
MD5 1b209d91d43bfd6f0ecfa323b8e60d94
SHA1 b655acfb6b7cf3be4c131db396b37d85b6753170
SHA512 c986f8a844e6b60db3a8f124799c19b9e5c76362066742ccd8710da4ac6ba6dfe445b0e092524f165f5bdeca75e725a3564868d3f95ee03b2e63178963e5838f
SSDEEP 768:hUiw8NR6+YM+0eMTIXRPbDujqLq+i/UzvnIK0BjBP7KfgQn5hZ3ek4Uz:qV8NR6BMVes8RWj9xgvnIQ56k4Uz
TLSH
T13003F1F1AEA68E0A043A97239C6E20D46EF2FDC5E05FBA2F57895CD1098F3D0524D132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7008009-eafb-426d-9107-7012ba6b010c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c7008009-eafb-426d-9107-7012ba6b010c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

98eb5a86-bfea-46d0-8270-506a5c91dc43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\98eb5a86-bfea-46d0-8270-506a5c91dc43.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d619f10e-09b1-4f28-bfba-a53826309401.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d619f10e-09b1-4f28-bfba-a53826309401.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29d96025-bf36-4f4f-895a-9cfbc17d13f1\index-dir\temp-index
Size 1KB
SHA256 940fbce025113857a424472b0a03f780bc32b913baf56e9a5f069330efe233c9
MD5 e4b9c4a9b6c94e17d7395bf3d2203d65
SHA1 44cfeb6245686f1f714e26af0ff59975ed93816f
SHA512 8e1cc7ec9f667f8482e3b8b5738ed481cdd032baadad4cae6c5cbc8d571c5429b8efae412f0b4d5d56715d540542a528dea36df837deaa4c5967aa65a78af1a9
TLSH
T18D2161434E821E67FDA86679647D18867330D3CC03506E5F22FDA13ADD92B80AD81494
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29d96025-bf36-4f4f-895a-9cfbc17d13f1\index-dir\the-real-index
Size 1KB
SHA256 3ef610fb39bdeb6277d87c391505cfc0c6e77848740fa61c5c3f1153180deb2e
MD5 aed1c035b9debe306bbf0a53110d022d
SHA1 6e18e6fd79b8614d1190b954134286c9c3212fc2
SHA512 0690d28d44b4f718386f8bd12a53a0b608985b54f4a7eb8e431f8497dcccc1c9567e7825909d3f7ed3ab2893ffe84e465e1efc5c87f5233a04c7f85e65f033df
TLSH
T1612184A201A31B67FC40237649AD68933334D64843443B0F63E7A03AEC82B80ACC6EE0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 161B
SHA256 f1d9ca1744f495c798bdac22cc76429f5300397ff00abd414083d3f718726bc6
MD5 8ee48e2e0207ee22b72632a9dbd945a3
SHA1 674774a04a6a3f9e1b092b61d5143459a88a3eb3
SHA512 6d648e1bdd36fbed62a650dab768666a7f348af19b951c4c7244ad32e4e0cc838436667cab4cc4c08ca2b73884eded41203d987970e1838a6c9332b368c37b29
TLSH
T1B2C080771CE52501EB4E82D995215499C3967DCC4A559D89542F45C370601501412C12
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 20a9269d311c4d48bc82954aca02671dae9c23e25a2fc1c6414dcc297376ecfa
MD5 478e7c583ae1f6695c43ef8e7ec54964
SHA1 c4d211ad03fa1c7ecec07d06b6292484f3a8fecc
SHA512 df1aa001cfe0ea53e4539116ffd3cb15e940ea49333e22304606eaf5fe20cedcee49627a32bfb856402013ffc90762879f3a90400bcbec5366598ea3b76fdf75
TLSH
T13FF0273A3EF36400FE6FA3D6647128A40191FC49D915ED8E582F75DB20B3759A419C26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 386B
SHA256 4ad990f9b992d196c7d0c1c64dc69adcd09077fab51a8f35e3b24bf51a7491ad
MD5 27636eff5c27d0a363d88746afbec5f0
SHA1 c7d44c5cdce6bdaec26c6cd6416ac78a8b7eb957
SHA512 ae9b1b9770ade77f8229c9743d4c5ea48b46206fe35d566c036217e250250555a0dadd8f34801728cc0f748ceea48610fb7a7e39193d2da4783a6fda63952d8a
TLSH
T130E068773EF73500F9EF93CE687164648295BC88C518AD4E582F49D731A13452849C23
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 259B
SHA256 da44232555362aa790082a2c1bb8810c78f5ddd5206c671070b35db53594d663
MD5 a7b7fe4a5902bbbcded49ab41dc23791
SHA1 8c314e0781a5a106b8ca1201f772fda62df2b15d
SHA512 f763f7f16068a96b13aa177e66636a542085a73d483993e38570c2760563eab0ce611bd07db8aaa00c2f6b4cd43706758f725d76f4d397215ec33840eca038eb
TLSH
T14CD02E7B3EF73600FA8FA3CDA97048A88396BC8CC524AD8E582F48C331A12401419C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6d278bdae62863dd7ed9502f99e5c8c144a4f03f310d63ced6624494f350ecb2
MD5 b0d10d94a0a43cd311d1787f336e2e1c
SHA1 a2dc015e737258858d5a029a363baee52ef16e3e
SHA512 b809f62c86ec107390baab61a7bd6a3331ad1b51e0efab18a30efb49b2922d24fd87952fc64619d8b0cc07b902e323d2ab395e07df18c1d70ccc8a97cac87409
SSDEEP 96:KcmEKbKWu9yKmInYBOSYe+xHy3sJqxKR4J4xNQIPq+SCMIKR+6:SDVXxrv
TLSH
T1E7B1794170BB02013A7D298846B9966A564272F33018B9BF7FBC94F25D2EE141DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7a71a44-4e0c-4887-a2eb-f4713714dd3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7a71a44-4e0c-4887-a2eb-f4713714dd3a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d9e016f9-110f-4d47-a913-f9ce8369ec33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9e016f9-110f-4d47-a913-f9ce8369ec33.tmp
Size 11KB
SHA256 e09898d46537a7adeeaa03135db8e92bf39051e45adf5a4a29c19025b6b13825
MD5 d8c4d9e207fff9d99869feecc441f0c7
SHA1 aa001d257de6736a7030f14941dc451e2b2d0714
SHA512 ec4ad4173768214728fa3a75708e331753636e1cb0b09c2e0298e3e5b3cb5ef29f903b6768a34dbd9f0dd41bfb34f4ab521b2e40bb2165819298345981f3605d
SSDEEP 192:sxZIRQxv/fcszUDxYPQdpmtHW6+WNBVq/Y365KN+HIg4J:sxZIAv/fcszhA+Hbq/XUqc
TLSH
T1EE32FA52AE2C693B8CC7D259BA25BF03D2F9103295D51E98F6FC891C05EAACD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fae0db46-7a0c-467a-98a2-baf404064b50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fae0db46-7a0c-467a-98a2-baf404064b50.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2843d7d-bcca-4537-87dc-3c217d339254.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2843d7d-bcca-4537-87dc-3c217d339254.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2b03dad97b49cc7d5fde3b050f7b009a7ab333732c5b01fe66f9fa98ba0e5831
MD5 130863438f00ed24ea2af653106df32e
SHA1 5689aff4a68837cb3d143716753c26cb9034b440
SHA512 14f4e27dc086addf4b27505bc9bf5e144b7760b2abd861f27e73d85abbac405c3c952d865a5b3cc3265213774912031ea68d27e95cc5da9db11c87eb9b332f04
TLSH
T1E141575CAAEA1148B377BF1AAFF6A46D487A7D772E06D15D10010E4F0663B00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

225d5d17-9d80-49c9-b4c8-2f6c1d7ad67f.tmp

Path C:\Users\Admin\AppData\Local\Temp\225d5d17-9d80-49c9-b4c8-2f6c1d7ad67f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4f5080b3-ff04-42b3-9ed6-3073c0325fa7.tmp

Path C:\Users\Admin\AppData\Local\Temp\4f5080b3-ff04-42b3-9ed6-3073c0325fa7.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES7347.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7347.tmp
Size 1KB
SHA256 fd1943f474b6c775112ad3b221f1ef83a6f6b1f70ac676c8a9d619381e94e57f
MD5 337c7fe57c3dfc908f7f9a94d388b8f7
SHA1 66d342534aa01b77815413b4e76abe0c6f8fa31f
SHA512 3557bfe38bc99e12fe07e390b744d0430078d9232504db066405fa2dfca27a0337b66b976f018e2ad4f6db9371ed720477ee407ea496c69dff468788e69fbe42
TLSH
T1D921C90153E9471EF0771732A9F6032FA228FD94AF66979B850042282C51104EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES7C40.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7C40.tmp
Size 1KB
SHA256 27ee598de4f040e0b16e0bc94a782aff7b99b6985f750271356cbcd7e3a37662
MD5 3a2bcea6e5c3e68c407accabde0fefc6
SHA1 60c301b4017d41a006da6a7b3af2e23181b89df4
SHA512 252ce059c12e0011c7a030d713c997073e1325227d0e14a1852a8cd4ea9d42941272eee6f9d865e87a3cb1d52f06135f0b39a0c82fe9444e5ed1bac3f5adcd15
TLSH
T10E21EB0283E84B1EF0B3073169FA032FA236FDA5EFA2975F8540522C2C41100EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rxxnogo1.j0j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxxnogo1.j0j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

i3u0ayut.dll

Path C:\Users\Admin\AppData\Local\Temp\i3u0ayut\i3u0ayut.dll
Size 3KB
SHA256 88e7062c03ee9ceb7ca310a6cb95113058b1ce00af75d9b5f18ff7f6757f10d4
MD5 f21c8674ef8e1cf89bd3e3820258ee41
SHA1 4fde04fd76c6674c137278847c475ecb3d12931e
SHA512 437b51c5b809d88eb96ed21491bbc838eab825801fc95aec6367775ce4554b548baa55f48d6bff0bb584b2363db7aa7fc3cc8c087a537d73180d078a83263221
TLSH
T1FD711F12A3EC4767E4BB0B386AF743177770F9549A63972E1AA0025CBCA53600E61BB1
MD5 SHA1 SHA512 TLSH

Submit Download

ndsa5rtm.dll

Path C:\Users\Admin\AppData\Local\Temp\ndsa5rtm\ndsa5rtm.dll
Size 3KB
SHA256 b47201a88077e3dc50db1c4c076d5d9604715f328e1a52a5c9f68671529c4407
MD5 db5007eb22a34a78f667dc7c376e86b9
SHA1 768962569a572d1211fbc368aa3bc24f0b10bb75
SHA512 e71e93cad15a23eab99e6864ad5963379be75aa2d239b3c1938e9f2456e34df4e8c2236d982e37b1dcdabe810f5523364aceee843c3e958e3991311f476a5a80
TLSH
T113519B0A67E8466BE4770B34ADF3472637B8FC509F72575E5880421CAC653649E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1401264174\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

464c3032-9316-482a-a629-eb3bde8628a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1567681942\464c3032-9316-482a-a629-eb3bde8628a2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1567681942\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7E82EA1822274D54BC8ECC91BAB059E1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\i3u0ayut\CSC7E82EA1822274D54BC8ECC91BAB059E1.TMP
Size 652B
SHA256 89800393a1d0700cc5d1afe6de7b76252106db7a3ace21f02e2f93917be825ac
MD5 54b63991d08bd28acc1ad57b86487604
SHA1 0dbebecc001eb7550b80660af1aec362c5a05b6c
SHA512 6999ec2ff3981a319c1bd0ff95cdcb9cef3b3d70357086988d6f2d5f18f45c84c73082daa7ebc1fbc0bcd02137772c7e83a8771aa87856ce822d4eef9b51a322
TLSH
T1B9F0820A63F8430EF1F34B30BDF6436791AABC66DE3297ED5440131D2C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

i3u0ayut.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\i3u0ayut\i3u0ayut.0.cs
Size 616B
SHA256 dffb65c7f9467b927a5d08eacce3cbdd373c8d7e8fc48e9b38b555124d6c1c5d
MD5 d7675460728df6de8e54d9b09acec342
SHA1 be91a4122f76b6e94878dd43ca18f4d33da6241d
SHA512 ad984ae56a13dd8e600e951ebe1c3aa8ce187b2bae54423486b869d5e073fb47b6c3786a5f353794e8ef7dc9b11ed6e41745ae48509545537a2c41a07a03c162
TLSH
T1FDF0F95456428561C8F2D71D5578D9D6F136E1A923E9A707727D07E0DF6F008427053F
MD5 SHA1 SHA512 TLSH

Submit Download

i3u0ayut.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\i3u0ayut\i3u0ayut.cmdline
Size 369B
SHA256 dab4aaa1bb096aa6e7f9650ebedcbea801a0563395bcf3cd50ca62f18b7284ce
MD5 92047dde41d5201444028966c310dd2d
SHA1 4dad0d7aef8a88dc2881a57ddbaf8fe5f3d25486
SHA512 6ae7d161f006f34b6224558fe4f846e2f0b0a6943fc925ad46b2dd533ad1965eb37a53cad7d79683e386a2ca46fa861a39f69197a97b7f89c37b36f9eb5e1d6f
TLSH
T175E0C63A4347C2FD21EE5E0B326AC5ACC673878329903F889062843DF02F0102FD2B89
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7CDE1F4946854EB38C21F47A8C5A5CD3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ndsa5rtm\CSC7CDE1F4946854EB38C21F47A8C5A5CD3.TMP
Size 652B
SHA256 7b7ab40493770187d5965a8395ac6ee5eadb49f01dabd043082c2f26053b22b1
MD5 5051117da752d045df68c8b432e20f83
SHA1 9b442686cf207775e1bf432d07aeaccceef1e748
SHA512 ed9bedca6ee1b381957ca53efbfe7bed5da83d377eb3f2d7f0c8e0c37edf530fe38f496223df533bbe1cddd17fe39328fdaf540396754597e0eac601537a08f5
TLSH
T17EF03A0963F8121EF0F34B30BDF683A791A8BC65DE3293ED1440431D2C64610C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ndsa5rtm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ndsa5rtm\ndsa5rtm.0.cs
Size 294B
SHA256 b5d0fcca86ff4449f03ef8624dacc40ad5f1e6b900c2ca519772f93dc3694181
MD5 748010e752204505825732ffcf45a986
SHA1 3eaa66dedc30d61218c5aa99a39dcb98c0d0a549
SHA512 d4ac75d73e0bb52c8b76909601cc61653049bfec7d2916a8324d2881677b5b60a4eb33d69d3945f9b02e8d37a15b8b91e868ce16fd173701f8452d188e12650b
TLSH
T1D3E0C2186AA39AF08423891A4C8BE5FDB61BA43622792900BAE50321EF5B00A5139A59
MD5 SHA1 SHA512 TLSH

Submit Download

ndsa5rtm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ndsa5rtm\ndsa5rtm.cmdline
Size 369B
SHA256 0cdd2a8dd6c2c7488d9741137508485724ed97c14f015dc5352b83d513601b4c
MD5 afd5fce8211dbe23515dd4de228be8fa
SHA1 43146de41c8fb87902f578de1db931f33fdd6df0
SHA512 0560885b317150d65166ba04dd834c08b3a39a0a54283b1694ade3282066656472b340a096b0cf31b6336277b34a1bb2aec3ccd685ed4603e1963f2cf4a15865
TLSH
T12AE06F3F4286C27D8DFD100B2A6AC6AC827327932D813FC49060840DE22708C3BD2782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3944-39-0x00000249BBB20000-0x00000249BBB28000-memory.dmp

Download

memory/3944-24-0x00000249BBB20000-0x00000249BBB4A000-memory.dmp

Download

memory/3944-23-0x00000249BB790000-0x00000249BB798000-memory.dmp

Download

memory/3944-1-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-25-0x00000249BBB20000-0x00000249BBB44000-memory.dmp

Download

memory/3944-26-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-317-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-41-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-40-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-10-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-70-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download

memory/3944-69-0x00000249BBAF0000-0x00000249BBB01000-memory.dmp

Download

memory/3944-9-0x00000249BB5C0000-0x00000249BB5E2000-memory.dmp

Download

memory/3944-0-0x00000249A0EA0000-0x00000249A0EB0000-memory.dmp

Download