ardamax | 915ef27293e400c67ee19313700ddd96e0bd1b9becabd68d50b461d91cfe2941

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
Size

753KB
MD5

be703c6463c6abecf9b40ceb8767f965
SHA1

ff01b76ce1d089d9463fc49f0a504e79bad2887a
SHA256

915ef27293e400c67ee19313700ddd96e0bd1b9becabd68d50b461d91cfe2941
SHA512

9523ae8aedc59e561c13548b35ffceb23b7892cba4894daa6c17d660d58f36fc5a69e39c2e92c3713eb44e561c056e8cd6384952882b0d0fb861946177b750be
SSDEEP

12288:/uD68wSJOCJqQfHH6V23nJc2qq24Qy5Z9mm744L9Nd/FB77lwecB3zWuoPXGbdZT:QJOCJfHagJc51q9mmM4L9NdFB/lw1xxZ

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer upx

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002af84-12.dat	family_ardamax

Contacts a large (686) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 5 IoCs

pid	Process
4016	GEHI.exe
1756	utorrent18.exe
4928	GEHI.exe
4836	utorrent18.exe
2676	uTorrent.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Wine	uTorrent.exe

Loads dropped DLL 20 IoCs

pid	Process
3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
4016	GEHI.exe
4016	GEHI.exe
4016	GEHI.exe
1756	utorrent18.exe
1756	utorrent18.exe
1756	utorrent18.exe
4928	GEHI.exe
4928	GEHI.exe
4928	GEHI.exe
4836	utorrent18.exe
4836	utorrent18.exe
4836	utorrent18.exe
3372	DllHost.exe
3372	DllHost.exe
3372	DllHost.exe
2676	uTorrent.exe
2676	uTorrent.exe
2676	uTorrent.exe
1928	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GEHI Agent = "C:\\Windows\\SysWOW64\\28463\\GEHI.exe"	GEHI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\GEHI.001	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
File created	C:\Windows\SysWOW64\28463\GEHI.006	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
File created	C:\Windows\SysWOW64\28463\GEHI.007	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
File created	C:\Windows\SysWOW64\28463\GEHI.exe	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
File opened for modification	C:\Windows\SysWOW64\28463	GEHI.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002af86-26.dat	upx
behavioral2/memory/1756-38-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/4836-50-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/1756-49-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/4836-61-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/1756-66-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-65-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-71-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-72-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-578-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-610-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-651-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-678-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-702-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-721-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-785-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-825-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-850-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-888-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-916-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-961-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral2/memory/2676-984-0x0000000000400000-0x00000000004A5000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\uTorrent\uTorrent.exe	utorrent18.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1053070035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1053070035\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1148680544\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2098809818\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1053070035\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1148680544\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1148680544\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2098809818\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	4016	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GEHI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GEHI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utorrent18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894597792051440"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\Content Type	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	utorrent18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch\ = "uTorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\shell\open	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent	utorrent18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent\ = "uTorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Program Files (x86)\\uTorrent\\uTorrent.exe\" \"%1\""	uTorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3664858464-2411077738-2029630556-1000\{A36738B4-7161-4DB3-9DBF-FAB3457D68FA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent\OpenWithProgids\uTorrent	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch\OpenWithProgids	utorrent18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch\OpenWithProgids\uTorrent	utorrent18.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\Content Type = "application/x-magnet"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\shell\open	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe\shell\open\command	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe\shell\open	utorrent18.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Program Files (x86)\\uTorrent\\uTorrent.exe\" \"%1\""	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications\uTorrent.exe\shell	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Applications	utorrent18.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\shell	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\uTorrent\shell\open\command	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\ = "Magnet URI"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\URL Protocol	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\.torrent\OpenWithProgids	utorrent18.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Program Files (x86)\\uTorrent\\uTorrent.exe\" \"%1\""	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4016	GEHI.exe
Token: SeIncBasePriorityPrivilege	4016	GEHI.exe
Token: SeIncBasePriorityPrivilege	4016	GEHI.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2676	uTorrent.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2676	uTorrent.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4016	GEHI.exe
4016	GEHI.exe
4016	GEHI.exe
4016	GEHI.exe
4016	GEHI.exe
1756	utorrent18.exe
4836	utorrent18.exe
2676	uTorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4016	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	78
PID 3324 wrote to memory of 4016	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	78
PID 3324 wrote to memory of 4016	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	78
PID 3324 wrote to memory of 1756	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	81
PID 3324 wrote to memory of 1756	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	81
PID 3324 wrote to memory of 1756	3324	JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe	81
PID 2844 wrote to memory of 4928	2844	cmd.exe	82
PID 2844 wrote to memory of 4928	2844	cmd.exe	82
PID 2844 wrote to memory of 4928	2844	cmd.exe	82
PID 1756 wrote to memory of 4836	1756	utorrent18.exe	83
PID 1756 wrote to memory of 4836	1756	utorrent18.exe	83
PID 1756 wrote to memory of 4836	1756	utorrent18.exe	83
PID 1756 wrote to memory of 2676	1756	utorrent18.exe	85
PID 1756 wrote to memory of 2676	1756	utorrent18.exe	85
PID 1756 wrote to memory of 2676	1756	utorrent18.exe	85
PID 2676 wrote to memory of 4744	2676	uTorrent.exe	88
PID 2676 wrote to memory of 4744	2676	uTorrent.exe	88
PID 4744 wrote to memory of 3104	4744	msedge.exe	89
PID 4744 wrote to memory of 3104	4744	msedge.exe	89
PID 4744 wrote to memory of 3684	4744	msedge.exe	90
PID 4744 wrote to memory of 3684	4744	msedge.exe	90
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91
PID 4744 wrote to memory of 4944	4744	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be703c6463c6abecf9b40ceb8767f965.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\28463\GEHI.exe
  "C:\Windows\system32\28463\GEHI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 840
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\GEHI.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\utorrent18.exe
  "C:\Users\Admin\AppData\Local\Temp\utorrent18.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\utorrent18.exe
    "C:\Users\Admin\AppData\Local\Temp\utorrent18.exe" /PERFORMINSTALL 12741 "C:\Program Files (x86)\uTorrent"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4836
- - C:\Program Files (x86)\uTorrent\uTorrent.exe
    uTorrent.exe /NOINSTALL /BRINGTOFRONT
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffddf5cf208,0x7ffddf5cf214,0x7ffddf5cf220
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
        5⤵
        
        PID:3684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2420,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        5⤵
        
        PID:1480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4036,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
        5⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2448,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:9
        5⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4152,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4156,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
        5⤵
        
        PID:3492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
        5⤵
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5136,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
        5⤵
        
        PID:2592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
        5⤵
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5888,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        5⤵
        
        PID:1156
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
        5⤵
        
        PID:1484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6404,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6412,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
        5⤵
        
        PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6764,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6912,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7228,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
        5⤵
        
        PID:2404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7284,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7020,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=4704,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
        5⤵
        
        PID:3272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4896,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
        5⤵
        
        PID:2664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3916,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6860,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
        5⤵
        
        PID:3336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=5396,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6804,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
        5⤵
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=7008,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=4904,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
        5⤵
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=7244,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
        5⤵
        
        PID:2456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7272,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
        5⤵
        
        PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=7248,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
        5⤵
        
        PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
        5⤵
        
        PID:4916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=2324,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
        5⤵
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=6988,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
        5⤵
        
        PID:456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7000,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4396,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
        5⤵
        
        PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7148,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
        5⤵
        
        PID:4272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=5524,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
        5⤵
        
        PID:3624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=5560,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:3580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7160,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
        5⤵
        
        PID:3796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=7192,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
        5⤵
        
        PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6652,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=6192,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
        5⤵
        
        PID:3696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=7796,i,10924458255722330242,10226396686764753554,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
        5⤵
        
        PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dslreports.com/speedtest
      4⤵
      PID:1520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\28463\GEHI.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\28463\GEHI.exe
  C:\Windows\SysWOW64\28463\GEHI.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4928

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38994d8c-e6bb-42b8-8f9b-a4a43e54e2f8.tmp

Filesize
39KB

MD5
0b14bf4e87d9e890d9bf2ac625aff40e

SHA1
fd15512be064e1030ede228e91dca1cb2abe7bea

SHA256
5793197399afb7be60d1e31207b431537c32cf716498b75da216212a1964f35a

SHA512
b611a228348f935a59a9182d32b140fd7c8d25459cb5ba78cce3071574bf2666b48a3df21d310735f0e8751b2dfe754129d87c931ce459e83b5d935f679dd160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
2502fffc9101ec3d37edf5e3e15abccc

SHA1
f7d4cf6d5f266ec40a33798223d074a678c1315f

SHA256
d9d740ef72fcadcb0ffbec9765b88bb1667a58d9e884b47806dbe788f86fdd7b

SHA512
d3bf08ef52051fb15f68efaacdd3e73898c1cef2ebc315bd8a83867de80307a756e78284daff8b0c9025bd59664ac0e87e09822609821d33c3f041e793884df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a53b3cbb0cc185974876c4556f351bdf

SHA1
b5a4ca66aeb47754d96066cfa8eda882deda5216

SHA256
214faeabf977636099613878cce8a01ab4012b0cd27cf85f21c85575d2a8374d

SHA512
c3efc6c6b49912a6fd5f0d83607a08973df087d9bb31c2166c1cc925deae032ca9b5db50a2f2a5df0527e6d9e2807fb17daa59830bf8e34a210765811d3c9780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0db76292d2af627a601cc5f2e5d132a4

SHA1
a2c6884758806193753c6e20477507dfe8b78442

SHA256
f7fbe78e55519c2893cac2fd28c31cad8d235c7c3841463fd8ed240cc7d06091

SHA512
14d407f36c8d1c89379adaaebf1e7c6c5098c5b30edcc7536c4063b55d9bf171bcde14af078611d5bd5f7425f4a8d240ed7d974ff444dfb91e27891da0f062a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fbb5.TMP

Filesize
3KB

MD5
2a96e2999f57086087fd7dfab061f67a

SHA1
cfab7eb4a0e0c686ec477c1c1ff541a6f189254f

SHA256
9bfd3ebb63388680d38c7a4fa25176692e7e15db47620307b843c6805035101f

SHA512
7dabd8dc2ef2a94889ca40149249a95c1f7b0771ee48ac0a38fa0924a5cf2da49caed3e272986849060a5efe2b710a50e3d0c01887604e26ccaa0492f62b516c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e9e227a5f8aa560352f1d65b48d7fece

SHA1
6b41b2587c4346c58fd5134c5d817231a47d7d09

SHA256
30820e30f536d8e93420ea049ab006aa7b33175e9ba94945f8fae0370dbd18c5

SHA512
8279b4547fb5b51051ae20b8d653c3b3aee3f1b8b9466cb90419433de7f4bededd16c8dd15a6361160d65b27e18a2a65aa44ccb1b58cc0f037c484fab4aed0c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
1e96d0be558963d7757971a9575918be

SHA1
e2c14af4c083e3a48eb572049f4513c5ef8aef4a

SHA256
9d38d39af1f7d8d63a3f544462951edc85d9c6534228bc97d61eaa5ae2168534

SHA512
f90ed768d23f7ae8a4d2e8f99e523e206545dc4ea41dd89b69050cc43ff4719df47d7c5ddc896bd984fed08434ee720a7e06e981823ed67d65a40b1ba3a58ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
5d06e5fb6750d099ce180d8539477fd0

SHA1
50be6d64d915118de43dcbc7267f2ac7abcd3f10

SHA256
2b1635433ef21aeff99e169402562303ba2c60a4f9c1e6850087765d0d18c73c

SHA512
3bc857007c0453063922e03e7c2975f2b7f50e80e316c53ddb7a2d05ab3e6b209af495bf567dfeb92cee4c51e51d6a40c9caf7690a5be45ff9edc8748e37d914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
cf95d2fea06b1b5910199fe5d20221cd

SHA1
ca6d96baac50a8e4297083f5f8d23f69dfae7204

SHA256
3ad5d990b1ffbebc8ea4ddb75858ef1c098363d01b55c7a63ab8e9e97b573f2d

SHA512
376d2517a1ef6ced473137119794f0f3256bc7f664b2a1195180bcc6bb1ddd876eb5ed8db9026ed1abf67f940ead8878c739f977a108e40eaafd5701f2024203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
a348dea193d1316a781c75adbf3fa360

SHA1
30c399458fe8ec81683dd6412b00d019b025ae07

SHA256
9438c3c70411539f88fb763892fd20113a272f43fb3ebe309a1fa66b579410cc

SHA512
7dfc063a5747da8a0266144ef6658137f69315855ef1f574d7cd854124366246a57ab27f81240e54092de2107db02381bb6ef22f01d2cb380a6cfc98b666d3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
8a051614c65e90c7fba17d1ea989c08d

SHA1
f5405b83810327834a39db345d25cd22e4b6be49

SHA256
ed9080a8af8cc4e380d5156cc2bd115426ffb4cdbc530e209ab9bb210dfc29cd

SHA512
025805b2fc427d6ef7e93ea218cf18d6705693aec6d9e71b4c3a85da2eb7cf7ffc1deaca4fc09a27e2e1ebb72aa0b64afa329df689a6a507c8c358ac2cb0c4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
3599fafb5eab8c9929737ad5d63a4338

SHA1
c5645c05606a7e4681fb616fa0e830e55642e844

SHA256
a85fc5ec15912dfcce5b849c1701da2805b21618aded9746e724e688df834601

SHA512
1db56e86f2ce9f1f09c53b20d17091f5c9cef70eeac122ae7fccfc56407d12219afa6be78327268a3ff72987ae3b5a7c8064adde6e8f806085f094edf6c0b5a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5895f2.TMP

Filesize
469B

MD5
9cd1a36beccb21df162622af89a8614b

SHA1
76205e49b4c05910039ff29f02eb4ca641ae5a0b

SHA256
be6557b8fdf3c73a114d217899e54688664dff93cb984d2b31b0bf47c3d12a5f

SHA512
8dbaa9e79b972d8167ce6c6083df71d7f9d72dcdfd3517ac454a437bfcf9ffd4a7e113a2813f56e698cf7d11fbb6e19b9fc8666e86e814fc0361ae862dc055e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
46cbcd98b0383629cfcacbd887a8569e

SHA1
f476b4699954bde9652cdb8c7dd85601e316e857

SHA256
c3cfc4079d320d3cf4f3fd0d8b778814954f9ca4893bcd068b365858117b25d5

SHA512
4b78fdcf64477200c96c5c8cdc7c79907e8394a2332bf808365467c5887c9493fd8ea547e7f5326b569cf375a9d9fd2d103f8aeb9dc70a4da32ff1895474dd25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58970b.TMP

Filesize
3KB

MD5
47430e0e9ad4838b6b88191b7966810f

SHA1
8933b4ce19e396751f93687305d3d378c48e2e0f

SHA256
98c1f419b9efe0d2a9f4350442d90916bd07593d9ecde4706030d1502cfb90d2

SHA512
e3a4e44240a11ce2173acfe66f6b52bdae8fc9c97dfdca441700ab47b5c73a46b71405da95a2cc08c34507fddf4349923c33da57da244e45b5019b9898e6b65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
7aff9398923668af609c8ef792109f27

SHA1
baf0bb4f7b7191d66c0ea27ce1377744e225667a

SHA256
0a8dc5bb9b421e26faa8e139233520f770a0128a8a720ffdbc370c465ccab1aa

SHA512
36deb346e9bf6503ba5f9753c1ee82bf2312beec352eb7259f27a915b60c84a99c39ccdd0fd695460dc05aed53504e33010275e68d3e1989770bf782cf850d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
732a770cb0ae35d06000988365763f6a

SHA1
74efc91dd121abfa3e478f1081d159fe88d923df

SHA256
3f3bfc98f38826e3ddac0f55c4475930e07ba83d945edd3e398d8a83bc68fc72

SHA512
3cc2c52eaed0589bdf1dc01ac715a835b5c4af1ccc8fc5286161fa6df4f87e8c9e1fd66b8ae2fb20b94dcc1823df0cbcf62ddedc2fd2ea251a53579851012094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
27c9b041b889103a5440bc6fded4a46a

SHA1
5061453a5fca576bf2910a7c4e002bac564c0235

SHA256
a884e023beb7701df4131249b1227002089fd1b5a058b8be278a8224f9a3a4aa

SHA512
7dc107689a3d32afa3e488463eb7076127d86219b5fba249835f5131955baa3ff3d5e62a1090b431525faffaecc7c750159bab1eda23ba0b070bf4cf9f93a6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cd70367592ef4e3ae486f0c7065d2af6

SHA1
806535ed16d895b33d07e993fb5025263386372a

SHA256
d2739bb455c5edf5965c308f8446cbd1ff30d4bb85813618afba8d8cafad3e7e

SHA512
981023df95a376637dd09dd54965c6ff1721323a00fc9081014da80fc4c85cc0909af702e957272c0a342992d429503572f103b40a76bb867213f27ea4dbb6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
6c80f82648d01cafa238e0ef5aa34298

SHA1
9f033aa211943d926af7ff916547fe9467fdc7df

SHA256
b454228980b9547a643c51131220e8bac2b31f932b7e8da2962ea9edf66ad0d9

SHA512
8402e865c41dae36b5de4acc334f1fcda2a2e7e037cc1c1cc3329891c7517432a2df78218b4757114cdfa3f2a690761b127c98f085a7a56eddd098ea62914c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Temp\4dd714e4-f9f7-4e01-8f89-b0509cb4c766.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ae393fb-6c78-4e41-8d88-81e6e169b4cf.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\@5246.tmp

Filesize
4KB

MD5
25530555085337eb644b061f239aa9d4

SHA1
8d91e099aba5439d4bfa8bce464c94e3e1acf620

SHA256
3fb6b438ad1530abdd068bffb303fb8a4de51430e0e18ddb6b1a0469ffab8325

SHA512
b1f9de0c276533a5a7070aeb2b6415cc1c0bdd2baf5e0645c6ac5ba767cab0d76e5b4461800d89724992af2c863294ada3c1eb2e4516183fe2010c33d47d6a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4744_902271131\51334f95-e5af-4525-b1d7-63351709878d.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit
C:\Users\Admin\AppData\Local\Temp\utorrent18.exe

Filesize
260KB

MD5
eaa865631b18d6c8ec5b34082f41c91a

SHA1
da61b82e4697b80b8049aeb25a425e3e1577b3bc

SHA256
c0eb079b449c83adda85567816ce7c45582cdc985b05f84335253fe0d5208e20

SHA512
d92e60737132dd58c54b031db15ea01a560942b80253589ac4dbb41fdc3c7eb277989c822bd26b10c0faffe0eeb0a378f0c9d08d53a6965003f61740040de6be

Download Submit
C:\Users\Admin\Desktop\µTorrent.lnk

Filesize
1023B

MD5
567bf2553b78c013ea40ffb65911a539

SHA1
0e7369b99d78e7ccf81c990dd5b996523d9d47bd

SHA256
822699dab76de6576375009fc8e2943d44ad0d6b38946e828f3712b3a870de47

SHA512
7cea6d0904df1801680cc34d24f643fbd226f3cd703366b5def31d18d071ea896b2455c7a799da2d4d384590b2e739abf37be9837356e9c004bc53a4c49cc311

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
d63cc8679a63448db1c64252e14e4ab5

SHA1
10b3a9ac4bc16e8ac1cd05e50b4d540fa3ef223e

SHA256
29b3646a556879a4a48e4f2f81e09179c34ac2051ed3e4f4c28e293092470d3d

SHA512
cb1911e1a77fb9be560aa4fd8bbef65e181b6d4438d65657501dbcd8dbf488ba01738a7222f35f8d4317e8df8c6f307d9e3623d6e3e45753e138b80fb68ff768

Download Submit
C:\Windows\SysWOW64\28463\GEHI.001

Filesize
404B

MD5
67c70d5fb64b96214b1bf37c81423967

SHA1
fdb90c709de360ee5819b0df5e4f60c8de1479e2

SHA256
daa163165777ea44d18b01bf52c7ae758b1f93be192294a565f22c3129fbdbe1

SHA512
e5459ebeed5a5c234fec4f739eea44e27f48448cde7f17e8266a25131d28b8ef098ecc390411831306e8be85323f3e5cf6fcf8891ae2bc258da6c4afa651acf2

Download Submit
C:\Windows\SysWOW64\28463\GEHI.006

Filesize
8KB

MD5
81e20f4361cf8f5a57812871c24d945e

SHA1
5d7877d6959ab26599b05795a71633f00c37a3da

SHA256
e6e8b4a29dccb3531f58c75b754caf7f26afe3e7043239305fd0ae7ab2f7571d

SHA512
69b1d75ab7123054bf98cf3a0f2cc7a0749cda8d85ebdef85be7d89f1454154ce29070907b934727a6c5276ff430e94810b87a5634d25d8529df9ee36fd20818

Download Submit
C:\Windows\SysWOW64\28463\GEHI.007

Filesize
5KB

MD5
e9fbdcc2f5fb657fa519b3f5c69fc52d

SHA1
c49cca77b46a59d620711de7564d43e5dafcd2b5

SHA256
cc440cfc4ce1a1ff503cc9e8937c59aae64bfce4daa3e7dc757220a25cadc2e4

SHA512
913759967e16b99d8ea66433e5dc99d5ddbf737be6784306e67c2b23a525b7a578fcae1028221d3209abc452ff30508eb750c62113c3868a7af36b544e525fb1

Download Submit
C:\Windows\SysWOW64\28463\GEHI.exe

Filesize
473KB

MD5
97d8ad45f48b4b28a93aab94699b7168

SHA1
8b69b7fd7c008b95d12386f6da415097e72151de

SHA256
661df22a66b2062b233eb0bd9665de924cfe0ac9c6ba29e20ffef24f817f9331

SHA512
3351eac970bab391de410fcf1937da75d2e4722b808f10332f487ddfe469544e32e7d4ed0e5bdc19bd5f472cffcc55ca1498c95945b4e9c4ceff6ff5cc521c8a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1053070035\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1148680544\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2098809818\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
memory/1756-66-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1756-38-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1756-49-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1756-46-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2676-651-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-785-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-721-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-610-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-702-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-984-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-961-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-71-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-578-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-678-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-825-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-850-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-72-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-65-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-888-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2676-916-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/4016-24-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/4016-47-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/4836-61-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/4836-50-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download