3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e

Analysis

max time kernel
29s
max time network
28s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/11/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 8KB
Sample261101-2bs8bsdw4x
SHA256 3d1affb235b25ab8ccf927ec1656b17eb04a881ede001d25f247e4a3ee798d4e
MD5 68b370b7555a5453de2ee92b85954f3a
SHA1 973726570fc0ac35e881ff357797f883111e4d48
SHA512 74e141d711fabc660763330f98c37649ecb66eb1ef900af997ae58a3a6c035f67c6beabc720bde1bd9d42508aa42f54ee2885c605cbe2ebbf4d65b6768b83499
SSDEEP 96:9R19rtfRrcpMDQ9XZAT5/I7guG6qe3IEc4u9J9/k1cTHaFIDiSI1oR:99FNcpjF+ec6qe3D6PhkmTH7DC1m
TLSH
T16F025355260259E683B3DE468CF3E61CFBA09077225E594D306C92E6AF39B1BC35C41F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4328	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{71CC6596-3012-496B-84DD-5B0FD9819240}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\AI_Training_Home\logs\telemetry.jsonl	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4788	4328	powershell.exe	85
PID 4788 wrote to memory of 820	4788	csc.exe	86
PID 4328 wrote to memory of 1984	4328	powershell.exe	89
PID 1984 wrote to memory of 4016	1984	csc.exe	90
PID 4484 wrote to memory of 1444	4484	msedge.exe	101
PID 1444 wrote to memory of 3544	1444	msedge.exe	102
PID 1444 wrote to memory of 3604	1444	msedge.exe	103
PID 1444 wrote to memory of 2476	1444	msedge.exe	104
PID 1444 wrote to memory of 2476	1444	msedge.exe	104
PID 1444 wrote to memory of 2476	1444	msedge.exe	104
PID 1444 wrote to memory of 2084	1444	msedge.exe	105
PID 1444 wrote to memory of 2084	1444	msedge.exe	105
PID 1444 wrote to memory of 1944	1444	msedge.exe	107
PID 1444 wrote to memory of 3836	1444	msedge.exe	108
PID 1444 wrote to memory of 1944	1444	msedge.exe	107
PID 1444 wrote to memory of 1944	1444	msedge.exe	107
PID 1444 wrote to memory of 3836	1444	msedge.exe	108
PID 1444 wrote to memory of 3836	1444	msedge.exe	108
PID 1444 wrote to memory of 3680	1444	msedge.exe	109
PID 1444 wrote to memory of 4032	1444	msedge.exe	110
PID 1444 wrote to memory of 3680	1444	msedge.exe	109
PID 1444 wrote to memory of 3680	1444	msedge.exe	109
PID 1444 wrote to memory of 4032	1444	msedge.exe	110
PID 1444 wrote to memory of 4032	1444	msedge.exe	110
PID 1444 wrote to memory of 4168	1444	msedge.exe	113
PID 1444 wrote to memory of 4168	1444	msedge.exe	113
PID 1444 wrote to memory of 3612	1444	msedge.exe	115
PID 1444 wrote to memory of 3612	1444	msedge.exe	115
PID 1444 wrote to memory of 5300	1444	msedge.exe	116
PID 1444 wrote to memory of 5308	1444	msedge.exe	117
PID 1444 wrote to memory of 5300	1444	msedge.exe	116
PID 1444 wrote to memory of 5308	1444	msedge.exe	117
PID 1444 wrote to memory of 2400	1444	msedge.exe	119
PID 1444 wrote to memory of 5888	1444	msedge.exe	121
PID 1444 wrote to memory of 5888	1444	msedge.exe	121
PID 1444 wrote to memory of 5940	1444	msedge.exe	122
PID 1444 wrote to memory of 5940	1444	msedge.exe	122
PID 1444 wrote to memory of 5388	1444	msedge.exe	123
PID 1444 wrote to memory of 5392	1444	msedge.exe	124
PID 1444 wrote to memory of 5388	1444	msedge.exe	123
PID 1444 wrote to memory of 5392	1444	msedge.exe	124
PID 1444 wrote to memory of 6076	1444	msedge.exe	125
PID 1444 wrote to memory of 6076	1444	msedge.exe	125

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ok533gkf\ok533gkf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA822.tmp" "c:\Users\Admin\AppData\Local\Temp\ok533gkf\CSC32D56B08E32945C49EF797A9EEFE3325.TMP"
    3⤵
    PID:820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t105hhz5\t105hhz5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB169.tmp" "c:\Users\Admin\AppData\Local\Temp\t105hhz5\CSC23CF9157871A4B81B81B2D72428765BC.TMP"
    3⤵
    PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7fffe7aac188,0x7fffe7aac194,0x7fffe7aac1a0
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,4565332158781117808,1325051609613270435,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,2029708499499095384,15242477872197247327,262144 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3251501359120628852,13357916394032589671,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6355338751573086095,6320205223002810879,2097152 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5305444263425937752,5926524914370594651,2097152 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15088768514975373248,3527794048845139378,2097152 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1602691387109207380,888716960127811276,2097152 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,52950427410441377,11496135038327065426,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,16334450216946312448,17506835092796861354,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12660097044394693647,14681357073570476476,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10152201944524905136,9296335424699373008,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7308944917750237187,7995470303397175511,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7308944917750237187,7995470303397175511,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12220985323018846781,12142755438372344158,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12950864392231738051,6732277330447541545,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,1881425256998561370,12605025401290959756,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,9673213069066300334,11791610433879271815,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,8171586737980061905,17783158206082930194,524288 --field-trial-handle=2248,i,5295431001361444603,15769011841981743830,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
    3⤵
    PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1dfcc00d-a18d-4d1e-b1a7-3f0ba4b02604.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1dfcc00d-a18d-4d1e-b1a7-3f0ba4b02604.tmp
Size 8KB
SHA256 37da52298de210f51d4277d5300d53c7cf157291ab9b7ee69ea05d7ff754b194
MD5 845bb18452b15a7aa05bd8f52d50dbc6
SHA1 f27995b864cb09f083370e187210008356807cc3
SHA512 9c10c2446d208210643503d758364998e0f45552efb849165d49d146aac157a4954171628cad148bdaeefdaa9e81628a2bcf90cf142ea6075fd7445251f5123e
SSDEEP 192:uONc6ILelQmiUy7PyW04Wys/1SgFRE7Rel0NITqLU6:uONc6y+syW04Wys0gXE1itwU6
TLSH
T1EB120931AC7DB86B5EE3A541B4433A179EA48227EB897F44D5DC2A1C01EF29C130FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a26d5948-6181-4b54-aafe-c0c29b5b5ecc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a26d5948-6181-4b54-aafe-c0c29b5b5ecc.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f349e7fa3f2d116df801eec298d7a36538858fa5536541a4e5a5e829551dfc24
MD5 bf24fed1a983cdec1a8fa7b5f52a20e2
SHA1 3a4be58385305e0c2ae36df109c56ea3fa8bb1b4
SHA512 4eb7ff8b9f16fc5befe6b12026cc83a3d85ed02629b3310a685b3e978bb6d51961d5446c9452931fd600891fd21b51203a1b4e6d1227e7674837b3629a5ce9eb
TLSH
T11CD02BC9D5843840C8233438117B4319314CDC40C803110658D8925188C2D830510860
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 793527cf075279f9c06b727aee62d70ea19bd6b5ad7439caec07bc18b4d35a36
MD5 9208456925785ea73b305f9e1813d1ab
SHA1 c2c9ba50cdd71cd0220812b1213d2ae0cdb608d6
SHA512 27759fd67fe8d40ae6ed58464cc270e57b2062af273342e4f9940eae10d9fe55aabdf88976d94aed560a0f7d227a2abb3a70d383bc3edcf8e8a1de18b17c26ae
TLSH
T10ED02BC9D5443440C4233438117B4319314CDC40C803100558D8925188C1D430510860
MD5 SHA1 SHA512 TLSH

Submit Download

22502b19-eafa-4a8c-b14d-6160ebb980e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22502b19-eafa-4a8c-b14d-6160ebb980e7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54f5a0ed-c6a1-48b4-b822-f09a1ab51ace.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54f5a0ed-c6a1-48b4-b822-f09a1ab51ace.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

55c406f5-d800-49d7-b62d-ec5b9df9ba59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55c406f5-d800-49d7-b62d-ec5b9df9ba59.tmp
Size 11KB
SHA256 3b57f7219e634d798410e244a27509189c3bbd8b8a3ec9ebe52364f0988cbc1e
MD5 9bba76bfd4648861cd770f1c054e5282
SHA1 6c3a2216493a238b2e473ce3361062948fe47413
SHA512 d51491738574e69179e490caad65603fcef208e25df83d763d2d9c10df1e316ebb7cf50b76f2a9942c25a5c45cb22d54dc3e2ecced13e50ac56dec48803c808a
SSDEEP 192:sxZeRlas/ffsuU5VvYPrEdpmIHW6+WNB7H/Y/Qr1oIg4J:sxZeus/ffsuAykfHbp/ac
TLSH
T19032FA55AE2C693B9CC7D25DBA25BF43D3F9103294C51E48E6FC8A1C05EA6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e8e082a-9c3b-48c1-827d-9fefdf8b240f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e8e082a-9c3b-48c1-827d-9fefdf8b240f.tmp
Size 32KB
SHA256 c2b4f3d6b93523a844effe1873d77517f06bb63b23e87863a43f4bd941414e52
MD5 5ddea2a61e8eaa8dedf19362eb575d67
SHA1 40bffe449c1eecd2fa7455f041dd7849d634388a
SHA512 cf3599ca1e0b865021a25b445ea6416ad77a7fc7aec4bbb8142a13c9d9c4211165ab322c9b284721f28a40efde2661853fc1c91b6ba14c74a57565150aeaf535
SSDEEP 768:M2mtKuM7pLuLj4IWvEgCc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxU3V3Llztc7HrS:M2mtKuwEj4IWvEgCcu1jasU3V3L9O7U9
TLSH
T19AE2FA7B780CCF7E4FC00A9DDD2A7F9F6DA8028B6698894047F9945C02C67EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 102KB
SHA256 68507cd63ba31b475df24e72126efa6f876ed08070edf9bc061370fa6d6236a1
MD5 9508051a8da5e63b0edf77fed708dbe7
SHA1 10b32bfae836baa1864152846e198fdd31e55001
SHA512 b8401dcb41ef9b0f70d9d00342349dfbe6a2218c5cc88335abac5a62360d0f0d44fa2381d82042dd0718036312903e605429ca8b57012aa74a04b02ee724f5a6
SSDEEP 3072:AC7MlsaVxw3ki4EEx1cWGSiAvi1ItUkzYdJ+oTK:j4Wa8Uzhx1/PiAvi1ouW
TLSH
T1CAA312330FAE5186C5E66D5C5F47ACBAA0C23C35254A655E2818CE39BE56728EF41C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 247KB
SHA256 c209d08247c1d8b19f781882aa5f13d6c1182f0aaf8f50794cc2af975769e0a6
MD5 4c704f5edc63733c5711074ddc6613f8
SHA1 62ad38563492029fe2ef350fd4594469ed0892f2
SHA512 190ab5e9465b583e9f252950e7de6da867e145cdfce30ecfed3910d535cf7c5728a4d1f253b0a1cbeba6aa5bc9632213a1be969e9a2dfc5a8ea699a111344fc8
SSDEEP 6144:E72H7HHlxEJ4CUTb7e465ALScvZ7KawhP2P:E6nl2JPiakSUZ7p2o
TLSH
T1264423080EEB4997F21E86F7178CD2E43665A458B23D80E79F8E99BD9439C30C6DB507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 36KB
SHA256 d881a7861279ea1fcdf0b4030c1714c7ed4c2e1560990051bae800df70fbcb1b
MD5 ee35337a988f3d4ded861c1bfd1687de
SHA1 55496798b91d93c2ac45a55dc7c194056ce76b0a
SHA512 c2f60f6bc419ea5e13b33d0d7250de4379dca4d4c04684bb5480573fb936e6cbd956097d7ca53bb1bf79c9768a700f697651c36c6f950012680adfe9954fbe52
SSDEEP 768:SMGRvHUpv2pHlsrbt2EtaB5AddPks6en+5GfL:SMavH82pi2fAPkdWzfL
TLSH
T192F2E143563A60B7EB127A7F0F673D534498A1F9CC2B35426E3B660E879633CCE60158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 39KB
SHA256 9bac2d0c95117c1e92351897b0548cc184941c6b9edffce4510542d443e87ebe
MD5 1b209d91d43bfd6f0ecfa323b8e60d94
SHA1 b655acfb6b7cf3be4c131db396b37d85b6753170
SHA512 c986f8a844e6b60db3a8f124799c19b9e5c76362066742ccd8710da4ac6ba6dfe445b0e092524f165f5bdeca75e725a3564868d3f95ee03b2e63178963e5838f
SSDEEP 768:hUiw8NR6+YM+0eMTIXRPbDujqLq+i/UzvnIK0BjBP7KfgQn5hZ3ek4Uz:qV8NR6BMVes8RWj9xgvnIQ56k4Uz
TLSH
T13003F1F1AEA68E0A043A97239C6E20D46EF2FDC5E05FBA2F57895CD1098F3D0524D132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 34KB
SHA256 73f0f054aa75a6bc0d4fe323f6f54666fb6ff8ec001a5fe6de59d172b0427be1
MD5 0409e165440382ca67b02d27dbba41f2
SHA1 4a6617be0976d0dbc4f904a41afe85f74ebd89fd
SHA512 22b216202769123bb5db95872c50ff94f5d10d8043685e61b66585f17b7bac32da0b5ff3e9fdbe9b9ffdf29ec6f8f43ecc32e782b7dd1270c52d09374b54b85e
SSDEEP 768:jh3SdIhNhnmNGjSAAlJNBtzl1sW55O4IuPcO:9Sqh7m83ALRIuUO
TLSH
T157F2F21B816E6782C501037E0FDB0D86D04B3A8B1790E66985F4DDAF77B66141A73BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ea26274-bbbb-46ea-b58d-2cfaf6b55c56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9ea26274-bbbb-46ea-b58d-2cfaf6b55c56.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4487935e-33fe-435a-9aa2-0f76bdb7d6a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4487935e-33fe-435a-9aa2-0f76bdb7d6a4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f742eff5-881e-400d-8f70-c3d30d2c75f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f742eff5-881e-400d-8f70-c3d30d2c75f3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\709a50cf-b4c5-4fdc-99a1-851086e9f2ef\index-dir\temp-index
Size 816B
SHA256 27bc77d260bb8e602e8208511060eee06acd35e44464b442c3615402bf77ec12
MD5 ab7a6b8374b680f19eef13f7cfbaf232
SHA1 006f53b98772ac44f6ba61d8e96b309b5a75f17c
SHA512 fadcba1ea3c2710ca571aa3d0f968c3f1bece21a40619e0997339d9a6baf18a8ceea7977da4e9c39ee501615c5885a5fae14722eee6882b53d1ba3bd0bfa47b7
TLSH
T17701415B4D526E0BEC140471783CB4C8A33D02CC8341679FA0FEE02AACE2BA4ED40608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\709a50cf-b4c5-4fdc-99a1-851086e9f2ef\index-dir\the-real-index
Size 816B
SHA256 497946cfd6a9d4c6700be5ecc1470b2e3ab50d7e49bba61fdabe8f577c037578
MD5 9c76af3b924c2675b6332fb2d472bf8e
SHA1 344265da119a5ce6ad85c75ecb45a503e20c3268
SHA512 47188c6f496124b1f141c1170423f8ea53cbf64270899860adee73b314b491448e78cc03fedda519635f245e466b60c471409509e0917e1ba469132893ad3de2
TLSH
T1BC01269602638F47FC4402B1A93CA694713651045344A75FE3D7605BDC917D8ED42F98
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 161B
SHA256 cadf93bea0fdb1ae58a04232478ea52a462be3dd03da89e68966b3e8680bf273
MD5 1cfb6585a29b17296fbeb3f05f993606
SHA1 61323f702390207f8e8e0d4ce85c3793e1532bf9
SHA512 cd34bdcb319ddfa5cb0e92379348b3efce4d45196ace499791d1a675f84c4b69d96e2fe480b676be3d69ea48a88446b13a4ed22008045561044f8806021f7782
TLSH
T162C08CB36DEB2A01EA4A8AD1892650AE82673C9C8A589D89407E448310611763261CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 7a3e3fe0d77e73e0795b195b13344aa2ef5ea28d1036bb1b363435d0b8ee6262
MD5 09d2f4c147e7c38eb07bee5d8cb3fa25
SHA1 3f834f5a54aaff104496a6d7d9b2282d7bca91b7
SHA512 35064f0eff98fc3e02f1ee44d141e297eee5c0dc47432330c61b1c629bbd350e10b5232d4bbb4d843941af2fc9c8eb42bdcd51f8d426518bfe3944a460dc880d
TLSH
T1D1F027B71EF72420FAAF97D1683150DA40E57C1989819C8E102BFA9711B23A9B68DC63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 386B
SHA256 81dd1c5392e5275d87f34e312fb1e8f292962133f48538bb493e307a16df01f4
MD5 46b9d0570e09b4887f39c0d4a0e8c429
SHA1 4204b4bd33dfb21446af3f3c0f15b889b45b469f
SHA512 7afb4eb22faaca4fc96ac69659e76128b5f9632869366ff3f14a390b538f6999eaf2ea8603bbb94c78489ad3068eb70684bf98832f244d801da02151068255db
TLSH
T16FE061771DDB3910F8D793D55C3540EE40D53C19C5485C4E503A95D311713AD7585C93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 259B
SHA256 4c14a43fe692f930df985b65ce1ac50dc86475882980f76e839e69bff44f2271
MD5 ac61bc72ee05a9d205f60fd87664885e
SHA1 1f74583b5f4c2d60f505f7a6ec4f08c2e55af47d
SHA512 65c82604f56a4064972875cbd04d5982b93cfaa8bd74021252bfb8187758fe2ff4205a999f2a71df61234c94820c80f48a6391387013aaa0c1eb11d1102c1635
TLSH
T16CD02E736EEB3A10F94A93D8983140AA82A7384DC1846D4A903F50C321623B82294CA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 affc1bd9ecc4b1110dc99df97331c253fa0a708731c2e0b6304030351bc90804
MD5 89ed7ced509123d282be11bf87a2d860
SHA1 b1ee5c9336133baa53d2a8f9970dc50d7e7d479c
SHA512 04ff323c010dd8faa8c6842d318291e99c0a8f26d3b4bfd9325e299e75a8ad0cbe8ea44cc216fe3eae2c5ec8278986f6315a7178f43bb2e167173d016e17e8fe
SSDEEP 48:K+zivjZtRkhtYPIY7kKXBPxkrD0y4ZD5y1RIdKigwny5aIPK3qMnz:KUsYKxy6uR6KigqqaQK3q0z
TLSH
T1B3910E5132FB0601397E280891759B6F464232A73039F73F3FBD55A25A66E0C1EBD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adde9019-1a25-4f50-a17a-fb7aac050975.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adde9019-1a25-4f50-a17a-fb7aac050975.tmp
Size 18KB
SHA256 c7d4517247c7acfbc766957eb7285c69dd005aee3c55e915e4b819839b4e3129
MD5 d5ba0694401f07bfbb05a3869ca1dd56
SHA1 a321a2ee83f60094a95740371a2d2d8b2ee7e186
SHA512 5b0d78148c7631437dedfae1c9d80b2fa5f9d7c32219fcd660e149afd59cee05b1d8fadf5de06739bf83c4b13517679942583a9cb123b91db6e9dedb2ac99c1f
SSDEEP 384:nbQkUSv0sNZk9T+3YhmP04Wys0gXE1i8wH7vBETWIIlA:V0C6kWWgX8wH75ESLm
TLSH
T1F3826C31AC7D6C274EE3A601E1073A17EEB4D11BD6D92B50D9DDAB2C01DF29C234BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3b8ff4f-dd3f-4fdb-bc83-7ee90309b6f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3b8ff4f-dd3f-4fdb-bc83-7ee90309b6f8.tmp
Size 8KB
SHA256 144b155aef216ed49db2b520027e2c34925068e8f3329c2b6d58a663f61d2b0b
MD5 aefb68d68042e331a4a6e31719c4671e
SHA1 a4e56cea42be71b74f6f21641caa865cf1042618
SHA512 82a1eb2427623af5fb9090db1c5ff151edbb34f6fb562fabf7bc0f55682148871d463a63168325e6d69ac3fa3aca2d889223b288f92bd09731e73c00f2712312
SSDEEP 192:vONl6ILecQmiUy3PvW04Wys/1SgFg57zKaU6:vONl6yFYvW04Wys0g4OaU6
TLSH
T1C5020A34AC7D78BB8EF3AE45F4473B179FA4112BA5952F44DAD81A1C01DB68C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01c60613-9aa7-43f4-8243-dec9ebf0a14b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\01c60613-9aa7-43f4-8243-dec9ebf0a14b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 50083c9aa0da0cf0e42af01d48d9f06a47ce21e71fc99d3bb8eaa8665e13086b
MD5 57fd54989be929cc6ef5784d71860890
SHA1 089a4c2d89b8f73821a05c938977e4e2f371effa
SHA512 1314faca7e461320955e70e50ca57d212349c1814b64c5d44aaaf36f0cdfae803b4fd50aa677200ecc1d5e727d6a6408af261946645d823aeae0dc61d38d6a13
TLSH
T1E741F79CB6E91148B7776E5AABF3A86D487FBD372E06D46E40110D4E0672B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

08f7e77b-b918-436c-aa2f-631763b9fab7.tmp

Path C:\Users\Admin\AppData\Local\Temp\08f7e77b-b918-436c-aa2f-631763b9fab7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

956910c9-8d1e-4215-8dfd-6a6e38c28ec9.tmp

Path C:\Users\Admin\AppData\Local\Temp\956910c9-8d1e-4215-8dfd-6a6e38c28ec9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RESA822.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA822.tmp
Size 1KB
SHA256 b89d7338551c51f6f35daba31d9bc619754a54c8116e731ff5f63755e30538c3
MD5 3923e7ca348ba05f7fbd654ab32cdf0e
SHA1 3591297aae1e41c3462f5c7d706f30a2cbf30a34
SHA512 aa912ca3dada0c804e36882054b9f0268333e713c6db566a39bc20726720b783f54eafadb7be793ecd0347e7b69ebb748849704096089f91770537f03c3074a3
TLSH
T11E21AB0593E94B1EF0774731A9FA076FA278FD55EFA2676B8540422C2C91144EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESB169.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB169.tmp
Size 1KB
SHA256 94d2a9fc22e0f6182cd37abdf58e1dfee97145ddbee34369f85052519aac7c0c
MD5 e0472ddf25f1fc8524fa991db9212abd
SHA1 bc19c3b2250c7164f09047438b0b46ab2dfe7de7
SHA512 c8232993113eef2b5f838d26c1998e005718ba3f8decda4af02974e079ebf6692a35c5bbb2119239a5a58917d6c6e3e5ad1273f1b27b12c5da2fd774f54ee900
TLSH
T17021AB0583E98B1EF0B7573269F6132FA274FD94EFA1A35B8540422C2C51604EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f0dtnrkp.wp2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f0dtnrkp.wp2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ae9c4e49-fab5-43bd-a6f9-002bb3f352dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\ae9c4e49-fab5-43bd-a6f9-002bb3f352dc.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ok533gkf.dll

Path C:\Users\Admin\AppData\Local\Temp\ok533gkf\ok533gkf.dll
Size 3KB
SHA256 66963a081b0d0ca2b4e091e8a7c1fbe9824ac2dfdfab350c2fe1bd222fc1643b
MD5 923be4bc97ac84c7b6fe2b6197f6b5d4
SHA1 5c9c9b174f618fb9e84077eae0356516fe7175ed
SHA512 abed1337c584e2cb3091e600c067d93a318022a633b012ffe1d56f9cc92086069b55ec414423775775c8c39bc25c2e22756e1eec313d64df0df53da77e07b292
TLSH
T11E51EF0A63E84A6BE4770730ADF3071633B8FC509B73672E5880435CACA53645E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1444_1829372723\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1444_750706170\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

t105hhz5.dll

Path C:\Users\Admin\AppData\Local\Temp\t105hhz5\t105hhz5.dll
Size 3KB
SHA256 713d98e20663567a42e71da8b630c2cbeeef6aa952be83775d5bcdcc5577c071
MD5 4be7e27794f14b75a7eb92ef0a6d95a0
SHA1 17d6b87c0e141244258c75ea5700315ff41a7171
SHA512 8a66401379f537ff44c742e77d9be93d6fe6cc09e6f1b604346b5e52227ba2c9c29ba5a501730b3f15645064ceb3aba61ea2ce6ab6a85ad916dae490e9624573
TLSH
T174711102E3EC4A27E4BB0B386AF743177770F9549A63D72E1AA0025DAC957244E31BB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC32D56B08E32945C49EF797A9EEFE3325.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ok533gkf\CSC32D56B08E32945C49EF797A9EEFE3325.TMP
Size 652B
SHA256 a53e514495761aa2374264d90354785e12c13f574061fc6cdff71a72dadbb26b
MD5 311bfd75069319d917e19826b8058d4a
SHA1 a851bc81d42a1f94c03699d2935749d697f27b35
SHA512 d4df2e5a2b3599447ffe0263287d0c18e40b24dd8612dfee7e896627b8e1252402e08b0214c7cbe6a4cb0f5b1e996ea8da6f21961f9a23960854f2f1fbb1102f
TLSH
T182F05E0963F8020EF0F34B30BDF643A3A1A8BC66DE32A7ED1440035D28645149A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ok533gkf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ok533gkf\ok533gkf.0.cs
Size 294B
SHA256 b5d0fcca86ff4449f03ef8624dacc40ad5f1e6b900c2ca519772f93dc3694181
MD5 748010e752204505825732ffcf45a986
SHA1 3eaa66dedc30d61218c5aa99a39dcb98c0d0a549
SHA512 d4ac75d73e0bb52c8b76909601cc61653049bfec7d2916a8324d2881677b5b60a4eb33d69d3945f9b02e8d37a15b8b91e868ce16fd173701f8452d188e12650b
TLSH
T1D3E0C2186AA39AF08423891A4C8BE5FDB61BA43622792900BAE50321EF5B00A5139A59
MD5 SHA1 SHA512 TLSH

Submit Download

ok533gkf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ok533gkf\ok533gkf.cmdline
Size 369B
SHA256 2d31388aed160f1e65d627a6ace2b6d5d50478fb1757a4357386db853c0c60c6
MD5 30cd21aa0953e6b6bbcf72b32d90b733
SHA1 58312efb70cadeae25aeab2852bf604a015662a9
SHA512 9f9e3e8e364182465e97e1bab08af7c8957fcfeef75214245aa7d2d1d12f8ccfd3bedaa9ca729a8ecb6c4cccc259c61618b9d203d2de2fde9f85e38d2232aa1f
TLSH
T150E0682F4246C77D01EA10472269C8AC92720A432AC03F94A2404C0DD29B0003FD1761
MD5 SHA1 SHA512 TLSH

Submit Download

CSC23CF9157871A4B81B81B2D72428765BC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\t105hhz5\CSC23CF9157871A4B81B81B2D72428765BC.TMP
Size 652B
SHA256 0c7e3e1ef593fb5fe65308d4e591595e46b86fad0f3d239ab83656dae7a3ea2f
MD5 88458cc464731bd563d26ef4e0873069
SHA1 cad47162d205deecba498fccfc29b5958d8fb3c2
SHA512 f85574263dd5c02b750e29ac2e68b82e241ba9ade92819a382894535c6f69de66a6f738572f78805efc49ef43d1748113b6a8712123ba4a2a8d994c12ece17b3
TLSH
T1ACF05E1A63F8020EF4F35B70BDF64367D5A8BC64DE3293ED1481031D2864A248962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

t105hhz5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\t105hhz5\t105hhz5.0.cs
Size 616B
SHA256 dffb65c7f9467b927a5d08eacce3cbdd373c8d7e8fc48e9b38b555124d6c1c5d
MD5 d7675460728df6de8e54d9b09acec342
SHA1 be91a4122f76b6e94878dd43ca18f4d33da6241d
SHA512 ad984ae56a13dd8e600e951ebe1c3aa8ce187b2bae54423486b869d5e073fb47b6c3786a5f353794e8ef7dc9b11ed6e41745ae48509545537a2c41a07a03c162
TLSH
T1FDF0F95456428561C8F2D71D5578D9D6F136E1A923E9A707727D07E0DF6F008427053F
MD5 SHA1 SHA512 TLSH

Submit Download

t105hhz5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\t105hhz5\t105hhz5.cmdline
Size 369B
SHA256 6b384f72dda23bea2aeb21399059556dbee5223cc5012d9348645ac60b18ff33
MD5 480c1a6226cea62546f54d8eb5705f2a
SHA1 5a565f36aab234853dd02968f13dc56e21846aee
SHA512 0311b6ad2324947c5545264fc5ae40d76fae1d51b3fdb582d15826f62e5b3b0e8779734a62ed12e4a8f6375f63f65ab8feffd2aa4e6fb7b4e5caab2101df0f2d
TLSH
T16BE0C02E6287CA7D51FD10072169C6ACE2721B8339C07F985960940DD027000A7F1F51
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4328-48-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-33-0x000001B3E9900000-0x000001B3E990A000-memory.dmp

Download

memory/4328-156-0x00007FF455BC0000-0x00007FF455BD0000-memory.dmp

Download

memory/4328-47-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-46-0x000001B3E9D10000-0x000001B3E9D18000-memory.dmp

Download

memory/4328-0-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-123-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-49-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-32-0x00007FF455BC0000-0x00007FF455BD0000-memory.dmp

Download

memory/4328-24-0x000001B3D0F40000-0x000001B3D0F50000-memory.dmp

Download

memory/4328-23-0x000001B3E9900000-0x000001B3E9924000-memory.dmp

Download

memory/4328-22-0x000001B3E9900000-0x000001B3E992A000-memory.dmp

Download

memory/4328-21-0x000001B3E98B0000-0x000001B3E98B8000-memory.dmp

Download

memory/4328-8-0x000001B3E93E0000-0x000001B3E9402000-memory.dmp

Download