hxxps://yjmdrs[.]pw/slkr

Analysis

user interaction
yes
max time kernel
283s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://yjmdrs.pw/slkr
Sample260727-e87qnavyh1

Score

7^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2312	CopilotUpdate.exe
2080	CopilotUpdate.exe
5964	CopilotUpdate.exe
5316	CopilotUpdate.exe

Loads dropped DLL 4 IoCs

pid	Process
2312	CopilotUpdate.exe
2080	CopilotUpdate.exe
5964	CopilotUpdate.exe
5316	CopilotUpdate.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	CopilotUpdate.exe
File opened (read-only)	\??\V:	CopilotUpdate.exe
File opened (read-only)	\??\W:	CopilotUpdate.exe
File opened (read-only)	\??\X:	CopilotUpdate.exe
File opened (read-only)	\??\Y:	CopilotUpdate.exe
File opened (read-only)	\??\B:	CopilotUpdate.exe
File opened (read-only)	\??\H:	CopilotUpdate.exe
File opened (read-only)	\??\N:	CopilotUpdate.exe
File opened (read-only)	\??\Q:	CopilotUpdate.exe
File opened (read-only)	\??\R:	CopilotUpdate.exe
File opened (read-only)	\??\T:	CopilotUpdate.exe
File opened (read-only)	\??\U:	CopilotUpdate.exe
File opened (read-only)	\??\E:	ComputerDefaults.exe
File opened (read-only)	\??\E:	ComputerDefaults.exe
File opened (read-only)	\??\I:	CopilotUpdate.exe
File opened (read-only)	\??\M:	CopilotUpdate.exe
File opened (read-only)	\??\P:	CopilotUpdate.exe
File opened (read-only)	\??\G:	CopilotUpdate.exe
File opened (read-only)	\??\K:	CopilotUpdate.exe
File opened (read-only)	\??\L:	CopilotUpdate.exe
File opened (read-only)	\??\S:	CopilotUpdate.exe
File opened (read-only)	\??\Z:	CopilotUpdate.exe
File opened (read-only)	\??\E:	ComputerDefaults.exe
File opened (read-only)	\??\J:	CopilotUpdate.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
119	api.ipify.org
120	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
5764	tasklist.exe
5680	tasklist.exe
2240	tasklist.exe
5860	tasklist.exe
228	tasklist.exe
5648	tasklist.exe
368	tasklist.exe
4224	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2736	cmd.exe
3660	cmd.exe
4956	cmd.exe
5868	cmd.exe
5216	cmd.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5188	2080	WerFault.exe	144
6048	5964	WerFault.exe	157
4104	5316	WerFault.exe	165

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CopilotUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.No.20260727075200.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.No.20260727075200.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.No.20260727075200.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CopilotUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CopilotUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CopilotUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
5240	timeout.exe
772	timeout.exe
1628	timeout.exe
5712	timeout.exe
5360	timeout.exe
5312	timeout.exe
5532	timeout.exe
6008	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4692	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296006759051121"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command	Vat.No.20260727075200.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{ECEE75DF-94DC-4019-8405-476C7FDF9FAE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command	Vat.No.20260727075200.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command	Vat.No.20260727075200.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open	Vat.No.20260727075200.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell	Vat.No.20260727075200.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open	Vat.No.20260727075200.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell	Vat.No.20260727075200.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a00000040010000904f1e8459ff164d8947e81bbffab36d02000000c0000000904f1e8459ff164d8947e81bbffab36d0b0000005000000030f125b7ef471a10a5f102608c9eebac0c00000050000000537def0c64fad111a2030000f81fedee0800000080000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 1e007180000000000000000000006abe817b2bce7646a29eeb907a5126c50000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell	Vat.No.20260727075200.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings	Vat.No.20260727075200.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open	Vat.No.20260727075200.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command	Vat.No.20260727075200.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open	Vat.No.20260727075200.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open	Vat.No.20260727075200.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell	Vat.No.20260727075200.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell	Vat.No.20260727075200.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings	Vat.No.20260727075200.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command\DelegateExecute	Vat.No.20260727075200.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2820	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2820	explorer.exe
2532	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	CopilotUpdate.exe
Token: SeIncBasePriorityPrivilege	2312	CopilotUpdate.exe
Token: SeLoadDriverPrivilege	2312	CopilotUpdate.exe
Token: SeTakeOwnershipPrivilege	2312	CopilotUpdate.exe
Token: SeTcbPrivilege	2312	CopilotUpdate.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	228	tasklist.exe
Token: SeDebugPrivilege	2312	CopilotUpdate.exe
Token: SeCreateTokenPrivilege	2312	CopilotUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	2312	CopilotUpdate.exe
Token: SeLockMemoryPrivilege	2312	CopilotUpdate.exe
Token: SeIncreaseQuotaPrivilege	2312	CopilotUpdate.exe
Token: SeMachineAccountPrivilege	2312	CopilotUpdate.exe
Token: SeTcbPrivilege	2312	CopilotUpdate.exe
Token: SeSecurityPrivilege	2312	CopilotUpdate.exe
Token: SeTakeOwnershipPrivilege	2312	CopilotUpdate.exe
Token: SeLoadDriverPrivilege	2312	CopilotUpdate.exe
Token: SeSystemProfilePrivilege	2312	CopilotUpdate.exe
Token: SeSystemtimePrivilege	2312	CopilotUpdate.exe
Token: SeProfSingleProcessPrivilege	2312	CopilotUpdate.exe
Token: SeIncBasePriorityPrivilege	2312	CopilotUpdate.exe
Token: SeCreatePagefilePrivilege	2312	CopilotUpdate.exe
Token: SeCreatePermanentPrivilege	2312	CopilotUpdate.exe
Token: SeBackupPrivilege	2312	CopilotUpdate.exe
Token: SeRestorePrivilege	2312	CopilotUpdate.exe
Token: SeShutdownPrivilege	2312	CopilotUpdate.exe
Token: SeDebugPrivilege	2312	CopilotUpdate.exe
Token: SeAuditPrivilege	2312	CopilotUpdate.exe
Token: SeSystemEnvironmentPrivilege	2312	CopilotUpdate.exe
Token: SeChangeNotifyPrivilege	2312	CopilotUpdate.exe
Token: SeRemoteShutdownPrivilege	2312	CopilotUpdate.exe
Token: SeUndockPrivilege	2312	CopilotUpdate.exe
Token: SeSyncAgentPrivilege	2312	CopilotUpdate.exe
Token: SeEnableDelegationPrivilege	2312	CopilotUpdate.exe
Token: SeManageVolumePrivilege	2312	CopilotUpdate.exe
Token: SeImpersonatePrivilege	2312	CopilotUpdate.exe
Token: SeCreateGlobalPrivilege	2312	CopilotUpdate.exe
Token: 31	2312	CopilotUpdate.exe
Token: 32	2312	CopilotUpdate.exe
Token: 33	2312	CopilotUpdate.exe
Token: 34	2312	CopilotUpdate.exe
Token: 35	2312	CopilotUpdate.exe
Token: SeDebugPrivilege	5648	tasklist.exe
Token: SeDebugPrivilege	368	tasklist.exe
Token: SeShutdownPrivilege	5948	rundll32.exe
Token: SeCreatePagefilePrivilege	5948	rundll32.exe
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeDebugPrivilege	5764	tasklist.exe
Token: SeSecurityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe
Token: SeIncBasePriorityPrivilege	2532	mmc.exe
Token: 33	2532	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
2820	explorer.exe
2820	explorer.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3076	Vat.No.20260727075200.EXE
2312	CopilotUpdate.exe
2312	CopilotUpdate.exe
2080	CopilotUpdate.exe
5840	Vat.No.20260727075200.EXE
5964	CopilotUpdate.exe
5140	Vat.No.20260727075200.EXE
5316	CopilotUpdate.exe
2532	mmc.exe
2532	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 2008	952	msedge.exe	85
PID 952 wrote to memory of 1156	952	msedge.exe	86
PID 952 wrote to memory of 860	952	msedge.exe	87
PID 952 wrote to memory of 1156	952	msedge.exe	86
PID 952 wrote to memory of 1156	952	msedge.exe	86
PID 952 wrote to memory of 764	952	msedge.exe	88
PID 952 wrote to memory of 764	952	msedge.exe	88
PID 952 wrote to memory of 1656	952	msedge.exe	89
PID 952 wrote to memory of 1532	952	msedge.exe	90
PID 952 wrote to memory of 1656	952	msedge.exe	89
PID 952 wrote to memory of 1656	952	msedge.exe	89
PID 952 wrote to memory of 1532	952	msedge.exe	90
PID 952 wrote to memory of 1532	952	msedge.exe	90
PID 952 wrote to memory of 2208	952	msedge.exe	92
PID 952 wrote to memory of 368	952	msedge.exe	93
PID 952 wrote to memory of 2208	952	msedge.exe	92
PID 952 wrote to memory of 2208	952	msedge.exe	92
PID 952 wrote to memory of 368	952	msedge.exe	93
PID 952 wrote to memory of 368	952	msedge.exe	93
PID 952 wrote to memory of 4564	952	msedge.exe	98
PID 952 wrote to memory of 4564	952	msedge.exe	98
PID 952 wrote to memory of 3440	952	msedge.exe	99
PID 952 wrote to memory of 3440	952	msedge.exe	99
PID 952 wrote to memory of 3996	952	msedge.exe	101
PID 952 wrote to memory of 4364	952	msedge.exe	102
PID 952 wrote to memory of 4364	952	msedge.exe	102
PID 952 wrote to memory of 4364	952	msedge.exe	102
PID 952 wrote to memory of 1044	952	msedge.exe	111
PID 952 wrote to memory of 1044	952	msedge.exe	111
PID 952 wrote to memory of 1044	952	msedge.exe	111
PID 952 wrote to memory of 4556	952	msedge.exe	112
PID 952 wrote to memory of 1792	952	msedge.exe	113
PID 952 wrote to memory of 4556	952	msedge.exe	112
PID 952 wrote to memory of 1792	952	msedge.exe	113
PID 952 wrote to memory of 1792	952	msedge.exe	113
PID 952 wrote to memory of 3544	952	msedge.exe	114
PID 952 wrote to memory of 4976	952	msedge.exe	118
PID 952 wrote to memory of 3396	952	msedge.exe	119
PID 952 wrote to memory of 3292	952	msedge.exe	120
PID 3076 wrote to memory of 2736	3076	Vat.No.20260727075200.EXE	127
PID 2736 wrote to memory of 1944	2736	cmd.exe	129
PID 1944 wrote to memory of 2312	1944	ComputerDefaults.exe	130
PID 2312 wrote to memory of 4692	2312	CopilotUpdate.exe	131
PID 952 wrote to memory of 1140	952	msedge.exe	133
PID 952 wrote to memory of 1140	952	msedge.exe	133
PID 2312 wrote to memory of 3660	2312	CopilotUpdate.exe	136
PID 3660 wrote to memory of 4956	3660	cmd.exe	138
PID 4956 wrote to memory of 228	4956	cmd.exe	139
PID 4956 wrote to memory of 2388	4956	cmd.exe	140
PID 4956 wrote to memory of 1628	4956	cmd.exe	142
PID 4956 wrote to memory of 5648	4956	cmd.exe	149
PID 4956 wrote to memory of 5656	4956	cmd.exe	150
PID 4956 wrote to memory of 5712	4956	cmd.exe	151
PID 952 wrote to memory of 5764	952	msedge.exe	152
PID 952 wrote to memory of 5764	952	msedge.exe	152
PID 5840 wrote to memory of 5868	5840	Vat.No.20260727075200.EXE	154
PID 5868 wrote to memory of 5916	5868	cmd.exe	156
PID 5916 wrote to memory of 5964	5916	ComputerDefaults.exe	157
PID 5140 wrote to memory of 5216	5140	Vat.No.20260727075200.EXE	162
PID 5216 wrote to memory of 5264	5216	cmd.exe	164
PID 5264 wrote to memory of 5316	5264	ComputerDefaults.exe	165
PID 952 wrote to memory of 5204	952	msedge.exe	166
PID 4956 wrote to memory of 368	4956	cmd.exe	168
PID 4956 wrote to memory of 4656	4956	cmd.exe	169

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yjmdrs.pw/slkr
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,2929724855577131867,8205783826833488272,262144 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2917800694639569676,11019949566440795783,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - System Time Discovery
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,9266718967765969516,14721018492372133359,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,13209301512781832731,1943406885724540706,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14093761046169390130,6964087481962758048,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,13765186172633450112,5124492802532331832,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14123936286974044621,17437158887686024142,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,10733222936926197981,4653375824108217547,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14532247074196130417,5329777389215681874,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12242530081228629506,14540391717689719982,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12242530081228629506,14540391717689719982,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5944,i,17864486016858197854,18013415198055248742,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4372,i,9508457424610001061,12659771221901462368,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10440402261692167577,8155187852266489676,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6060,i,9193432671998658579,12854674815119133021,2097152 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,6822508474082085741,4183494538711254839,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=716,i,17352024435423708830,7574276915662260299,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7910310543897320286,11496959834105302054,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15137476542327764685,15453509715759536639,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,7158489448269965460,5222707145151292482,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,16066655621392691193,1280212653315720392,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,8901584335127632308,16967333579595089842,262144 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,3199348813764930296,4739425361338247363,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12994459476770128660,9022202505809845537,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8804651899593357559,10292025224248741607,524288 --field-trial-handle=2684,i,15841744199555782096,6457087188350228357,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4588

\??\E:\Vat.No.20260727075200.EXE
"E:\Vat.No.20260727075200.EXE"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\ProgramData\{08CD488B-9F62-4AFD-88E8-803F78014405}v24.69.69125.7257\packages\CopilotUpdate.exe
      "CopilotUpdate.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\E69B952CF58AC2CCCCD.BAT
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3660
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\E69B952CF58AC2CCCCD.BAT
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1628
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5648
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:368
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5360
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5764
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5532
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6008
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5240
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq CopilotUpdate.exe"
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "CopilotUpdate.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:3296

C:\ProgramData\{08CD488B-9F62-4AFD-88E8-803F78014405}v24.69.69125.7257\packages\CopilotUpdate.exe
C:\ProgramData\{08CD488B-9F62-4AFD-88E8-803F78014405}v24.69.69125.7257\packages\CopilotUpdate.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 580
  2⤵
  - Program crash
  PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2080 -ip 2080
1⤵
PID:5164

\??\E:\Vat.No.20260727075200.EXE
"E:\Vat.No.20260727075200.EXE"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\ProgramData\{21284465-4F8B-4ADB-9649-E300FFD3E7FF}v25.21.12772.8239\packages\CopilotUpdate.exe
      "CopilotUpdate.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 400
        5⤵
        Program crash
        
        PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5964 -ip 5964
1⤵
PID:6028

\??\E:\Vat.No.20260727075200.EXE
"E:\Vat.No.20260727075200.EXE"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\ProgramData\{CF534066-95C0-4BE9-AF86-C4A78914985F}v55.34.46243.3482\packages\CopilotUpdate.exe
      "CopilotUpdate.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 608
        5⤵
        Program crash
        
        PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5316 -ip 5316
1⤵
PID:372

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\System32\appwiz.cpl",
1⤵
PID:5864
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\appwiz.cpl",
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5948

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2820

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5224

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2532

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CopilotUpdate.exe

Path C:\ProgramData\{08CD488B-9F62-4AFD-88E8-803F78014405}v24.69.69125.7257\packages\CopilotUpdate.exe
Size 3.5MB
SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
MD5 cae7e1192eb824214833bb1e8ac092b8
SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
TLSH
T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFCore8.dll

Path C:\ProgramData\{08CD488B-9F62-4AFD-88E8-803F78014405}v24.69.69125.7257\packages\PDFCore8.dll
Size 5.5MB
SHA256 484dab2b6355b164af6bc205163fa7b38fde2ef16d0d7f7b739c032d1c4af2f7
MD5 2fa88cc68da1a6d005de5d435eea8af2
SHA1 52bb8f70050b956f239cd5aa6bc8cbcff4d8d670
SHA512 51db41d8dd6ae7de2eb1d9e35da2f2bfa09a71d01c38153e6efd7667a3414175a03d67a1772032997e14512818eea8d6fe0eda59c1957bef227379e3c2b76c59
SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL0/aC+gsMjLqWaG0T:iJHT4P39fa/oSqFm
TLSH
T16746CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

566d6c25-23ed-466e-ae1f-b66876083508.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\566d6c25-23ed-466e-ae1f-b66876083508.tmp
Size 27KB
SHA256 6e04cc97277b1676426a6ea896a76a43ab7d10ce2ae7f465c3e7f04eafd58bf9
MD5 a561e656a9451442183289a93800ef25
SHA1 e87019cddd95db16c580650de30a4ed1be5d8ca4
SHA512 ee270685aaf812037dc57b4ee66fcc2405f5074255bea1b466d3954c168e33d7bcae7031de3f7c5188e90ba27681bd77c1c882ec219da482fbadc06b0e06f089
SSDEEP 384:KiFHZcI8JsN/8TUNTUlIlS9a2zil4ve+CndHeRedoOObjI9G6w7gt:BFv6Gwgz2PWfEko29MI
TLSH
T1FDD229F258E74976D9AE5703F7BE2D124EBCD063B6842A40B3D89A0CCD961BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 429de9f95058febf3fa3a523097f474486c5fbf4c95b2816b7078a9a53c8fe4a
MD5 dc7a6fc480a3790dbc0b13aadd1071b9
SHA1 cc6f207e57a31e86e4cd3fc07b531dd1bf27c887
SHA512 330ddb7ceae6e3cdffc416df962d06eaf18e3a8d1ab58f1ca88f59312933500d5cf39d80fff9a803b5b563f19b23ff43948e5bfbff9fe9f5842c6c4e7ffc10a2
TLSH
T10FE020D95EC9D25F93207487455CC34CD2B0379FA3C4A9451714C4C97001564FBF19D8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 203195d858407e59613343eae96e91457d3c6f8e53fe07b6c658fa7b4dbee55d
MD5 f7cee1ea0e2654b32926ab80b9879676
SHA1 2d79aac997ce5085319135ded10ed383c6958b5c
SHA512 afc75005d9e95cb0fcc90c98d42243d5711325c52c70eeedd147a552221a8f1cb235bac57c59b1188db5dcec4114bf74ec9a8b5babbbbb565075867bddaa69f8
TLSH
T1B041E9F002A35B41DF3416B190F01B40367683DDF9737E184192997D3A3AF63452647C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 621663a00011633742135b3ab72a99c5efd4a299222e6b312402e0058ae58aaf
MD5 acd22feae211145012cd282a7459f82e
SHA1 50df78ff619e1a610cfa180e58432a0addd695a5
SHA512 7f29fb609cfaa2bed594925e7958c580227e60a3422774ecf65f58cce7b4e1cec9c1231c2e602c2dd407760104d025f94e2350422c8e2843e82cc9102a319392
TLSH
T1AF2199F783E5956ECA1552F09A14AE1BCE5D0511831C3D2989D4BF1BA3E3462E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 55fe4a0cbd04d7878de731c471cad7f81013ff2610b7fd8b900ddf14de27d5b5
MD5 88583cab8d6cd38c146b853a8b0477ea
SHA1 6255798e957ac5e375795d1530a325c6306cfe60
SHA512 7ca1bf8bfdcb0fb25694be0b24fb2310c6dcaeaede7d5229620873de493f004eff9d1b8ee2601ff8a375f3fe93a1a467b57e274099b88e163ac7ec393bdb52ef
SSDEEP 192:sxZARqk4/fAsnH3CIdpoYHW6+WN3NSG/Y9IVDRv+MIgrJ:sxZAX4/fAsnHbJHboG/t1p9
TLSH
T10522A7566F28A97B8CC7D219BB55BF13E6F6103291D05E58A6FCD60C04E6ADD230B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bebaecafdc0e3c974cc753b03355f32e96a37075e54dd703ef0853aab98b9903
MD5 1c42299bec126a7e17828e71891afcdb
SHA1 2dfe4d152e200f3a87d60198ebcb8552de66e189
SHA512 ab45c5d87ed1449b23c408d095ab7683019f18de0ea4b506f3564f19d97650efba124a001a14b30481b4b14ef9ba53e8bf0775c15cec4a7dbdce6bcb1202f7ca
SSDEEP 192:sxZARq94/fAsWHdCIdpoYHW6+WN3PHSO4XY9IWeRv+MIg5dQoqJ:sxZAK4/fAsWH1JHbfyO4XO8pzrm
TLSH
T15C3297566F38A57B8CCBD219BB55BF53D6FA503292901E58A6FC860C04E67DD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7f7e77d0798b564819453d76672cf08856a7eff019da60b23900516a175a22b6
MD5 4369254945b03e1c0d6db360e5b5b1d6
SHA1 8f218e452da32987d4fc0a3049678836e2dd45f1
SHA512 79a3ad796ff50bf82858a5ebe54e4d2868333e026cc500d44c6de54e54d2163a30b6817a684f105eae50895c93019fba936d24dc11ab5e13957eb455e8033945
SSDEEP 192:sxZARqj4/fAsWmdCIdpSYHW6+WN3ESJZY9Ifpg+MIg5d2oqJ:sxZAE4/fAsWm1LHblJZmpzRm
TLSH
T1D832B8566E38957B8CCBD219BB557F53E6FA503291901E48AAFCC60C05E7ADD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cc5908a092e18d7424f24e7c2a1f4c44aca1f73f19a85783216504212cacf563
MD5 325ef9e194c4b8f479bf4b35e11c8188
SHA1 3aaa8f295aa978256417d814d502c89efc77d200
SHA512 622c7ba59ef67b631592cc91ca4fd346deb29f758f1ba28eaa01027846e94b66940e6aedb6289a9f8d3e36488d632691fe48f7abb658d8a3962846fad31bed3b
SSDEEP 192:sxZARq94/fAsWmdCIdpoYHW6+WN3PHSO4XY9IW5nv+MIg5d2oqJ:sxZAK4/fAsWm1JHbfyO4XO5pzRm
TLSH
T1A932A7566E38957B8CCBD209BB657F53E6FA503292901E58A6FCC60C05E7BDD230B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 294574c4e9aa3fccb789b848e3ffb9e039aae9a6f263448fdb218d9cc888b848
MD5 4fb533f9d746818384ccd0bae18819c6
SHA1 237d0e1b93ec393e8b358365543ba4a6180b9b0a
SHA512 f89eb47e7a856921ef3908c5d5d1ba6581773d23cba4c2d53167ed78bab2b4dc8e66b51b33297ed58d7bcbc273b44c3ab665d09f17b7998997dc3a44d9cde327
SSDEEP 768:wwyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7rrokbqR:wwyvIZwWvu+Q+u1jamFLeR7Yk8
TLSH
T1E8C2E93B240CCB7E5F801A9D9D5A6F9B3EA802CB57588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 574c4e700af1670975bad947a6083657a1b31c652d789cfc57240a1818dbb39b
MD5 0f253cf7c4de3aef76383d5d5c0e9d94
SHA1 4e0bbe61435bce2df85d6c540022c7a44392402e
SHA512 82e4ae974e12488e566f53d9dfe5803866d09bca722f821178fa135efcc9bc6f3357d73cd6e8a0356be36f3311bf309711cca20a290bdb2282d267382b65a4a8
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFaY:mTXjiVoZFf7Xe76B9hB53ulFafg
TLSH
T175911446B13A02D339BF685DA3A189368E4131637A14E96F7FB900A58F27E121DFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8945598-5945-49a6-bf57-c76b2a0ace31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d8945598-5945-49a6-bf57-c76b2a0ace31.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 79d801b9457d325e61477b7b13642ae2fc08aeecee860b573249aa0e39161a5b
MD5 6e4111c67be76340e8f69c2df3e8fe9c
SHA1 2545a66b15892771aad79f332796ff96174fb408
SHA512 0595fc18b842d9acd09d1c1e009ca68ec7b1e065650ab5325ffde12ea1bff8beb40e8294e53451d7646389ef381f2056a9648ac70f552bf18909f0270bfbdf22
SSDEEP 384:nZcIhsNaU59a2ziYDve+CndHeReUoOObjI9G6w7gt:Ph129WfEzo29MI
TLSH
T199927C32AD385D779AA7A512F4C639135EF89173E7D92F84A1ECEF0D02DA5AC030A419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a772391bac7229cc6a45a059eeab4ccc0952af4ee78863082125e940c8691a8
MD5 118881ed2d2e2fe761d4571354de3d4f
SHA1 326888cbda3d322fb3578d8e5b60962aaa98693c
SHA512 30a4778d09b4679d3ec84bfcc4dae59b5c2c2aecdd8663443ff0ae6f7d13351e543d89c3fc0a6355d29995660a25af55143945ce64d478cfab9f00eed1761636
SSDEEP 384:KiFuZcI8FsN/8TUNTUlIlS9a2zigi4ve+CndHeReLoOObjI9G6w7gt:BFM6Gwgz2n1WfEYo29MI
TLSH
T12FD229F258E74976D9AE5703F7BE2D124EBCD063B6842A40B3D89A0CCD960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 56d165a9345d6747196cba5a3022611581c3624268d01099102849f27569b262
MD5 abe00f5b296418dc9dbb2074b5685e6c
SHA1 89bae932a89705a2e9ac3e95a0a40663f40c867b
SHA512 33adbc25255fc31fe50d90145d1d103ddcd0c31417145fe88966022a43af39084b0a1f2c18b63e16746c1792fdefae8a17bc2f6eb121d68badcc7be6b62bd033
SSDEEP 384:nZcIpsNaU59a2ziiDve+CndHeReUoOObjI9G6w7gt:Pp12PWfEzo29MI
TLSH
T14D928C32AD385D779AA7A512F4C639135EF891B3D7D92F84A1ECEF0D02DB5AC030A419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bfae1a70785779166529dde63dc3cf94fd1648978f282be25d449dec60fac945
MD5 49e09efb4eed2081866942ca61fd58dd
SHA1 ee38173be2ec4ae2024c3b9002e31ee993bb608e
SHA512 e0d420cb6388ffe2de5238ebf0815bf827b71774c261643f5ac8e082d53c2ade0c7734fd26da1b872ed96ccb877f88f49f00cdc668433271d7e11bc05a0cd525
SSDEEP 384:KiFPZcI8esNw8TUNTUlIlS9a2zio4ve+CndHeReCoOObjI9G6w7gt:BFH1nwgz2mWfEBo29MI
TLSH
T1DFD229F258E74976D9AE5743F7BE2D124EBCD063B6842A40B3D89A0CCD960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6d4a780de1b051feb1b9d08952b4efdc740f4e9ce1910690e4fc9956f1201b8f
MD5 82dfb55c0bb63338fe938fa354694210
SHA1 847b74c008925e02ddd2a86be0d2d71b3657dbad
SHA512 5059ab14f4a119905749051c674b6ce4e0bde3b783726de97f49a4bd37c9100beb3951570e020e42eb0655a3c2deb981cc3576d69a12eab7ed43544dfee078d1
SSDEEP 384:jZcIPsNaUS9a2zilDve+CndHeReUoOObjI9G6w7gt:7PU2QWfEzo29MI
TLSH
T189928C32AD385D779AA7A512F4C639135EF89077D7C92F84A1ECEF0D02DB5AC030A419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 32a1f2a94381e3ee1fc26eb8add77d78f187f509a6be0c98324c4e8ab8231cd3
MD5 ffd5a923e25112b751a1a7ba1fe4e04b
SHA1 212307e0fb71e34a3ac45fe736b534d731fa3926
SHA512 144eced1315d36c4a1b201aa7869398f35b691a94e88e545d986351f16e8145b5183c398975728dac4d0b4a9ac261774d9d546f9fb9d7dd52fff8eb027c8292c
SSDEEP 192:JONii6v+YLNQmiUykpZh+CGp+Fdes9odus2PU6:JONii6vz/PZh+CndHe9cU6
TLSH
T1BE02E9356D382C6B9FF2AE45F5873A135FA82177EA922F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f13efb24ed6743b27f114cecc9e59bcc27d4b105571014fae426608cbc32976
MD5 3541ee5e031d432588955caa043ab45c
SHA1 4815218e09bda28109f037b15d80e2636c88ffa8
SHA512 890ae5b62b6a6bdf6f8dab74eeff3cf8b3ad46abc4700a6bb9a2c5bd83cf7a00e3b335aceaf678527c537cc98ac8e7c290bf9bdd8909e34dcabf1ae099e269a0
SSDEEP 192:2ON46v+YLcQmiUy6pth+CGp+Fdes9omOQNtCHpqJU6:2ON46vzQjth+CndHeReaoU6
TLSH
T18F122C35AD785C6B5FE2A541F48735135EA89273EAC63F80E5EC6F0C02DF6AC134A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4ecd0fd-6dab-4c5f-bfff-d3b489904b40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4ecd0fd-6dab-4c5f-bfff-d3b489904b40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69b75dd3da6f39dcedf1e78f792e5f9083047d2db07a22405fa4753685c05369
MD5 082800757c82942a1a957b7bd16bb673
SHA1 c6f8f2b452306aa4f620be29efb9df21fdb97751
SHA512 300a19b6485bab661df4e29bb0b14b311b1b83b19fb9def4646ebe990da502f73841cd3bd6ffdfb96f7ecdb2efe91801352d9fc24de8097ded925b29a9a3f079
TLSH
T11D412758A7E90148B7B76E1AABF7A86E447BB8772E07C54D10110E4F0A33B40D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 ac85fff756b847e98daf63d731df5394870f292d3720a76fe1171991b1af8080
MD5 64768c402ac3073cca21efba0cbf0114
SHA1 c32c115f266b0399be80c757de6b06771f4343cb
SHA512 353dc2ad4c9c1aa0ff78d440e83e71fa0293f095b23c344e53f4dc230e9d3f56aec338ec468e8f46e30051d8b6e8fba438c2e6f3cccd29bd209486328867fa71
SSDEEP 192:bCVrbbSoT+PRH1lVCsPSEKl1lcNl85HWmeudhxrqKYwQtjqwwq4F32GgFhc:wcPRH1lVC0MqNl8529lJwQt2w8F32Hhc
TLSH
T1C643A4A6B808D606DD0A1D769FE6D6EC6331BD16CE2B421338C2B73F9AB70C01D55545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E69B952CF58AC2CCCCD.BAT

Path C:\Users\Admin\AppData\Local\Temp\E69B952CF58AC2CCCCD.BAT
Size 862B
SHA256 6f9f360c71b1afb306dae8bbbcec15b700db969609b4526d544480f8bcf76507
MD5 a50b45c3fd8a2c1e18cc2c52d1166f0b
SHA1 9e1b6aaa642c57befde4ae9f72e84ec15cfe9cd0
SHA512 1687dff903122d9fd597f020aff8124be6769cd880810c9ab9e49c8d6b9d312e61a85c0fa5ffb3f0f314f1c39c4375731fe9de308d282d89fa9de592a6f7ca93
TLSH
T12D11598F920B686C07F482B778414E465BD9D087F73BA1A87004DB046B9A94F94C976C
MD5 SHA1 SHA512 TLSH

Submit Download

20260727075219.zip.crdownload

Path C:\Users\Admin\Downloads\20260727075219.zip.crdownload
Size 4.4MB
SHA256 4dde71b7852793d98ffea13745f2dbd703d61031c29d526489383bd07c6c624e
MD5 d6536d5e7fd64e9bd4e5b3e58ea6e388
SHA1 57528ba9bd75090805dc5d8c2baeb5942b9013ad
SHA512 ae2fd7fde7970deb98e0a6f6f27154089aec4ef1b0350f38accdd5738351612d1f56b9142bfb70ab53ce160cabb95803ecb47a626f508452b46a9b5e797d4aaa
SSDEEP 98304:8pZZXh92KduxoEhHdEg7At4xFsweTuNnoaeq+wVBBYJM:8BXh5wxphHdFU4xF+Tu6bq+4OJM
TLSH
T13C2633A2E9F1AF2EB79D5F33FCC2875003D526F1511621C6AD254B3601DC7229AEE42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-391-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-390-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-386-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-387-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-388-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-389-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-380-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-382-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-381-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/404-392-0x000001659C160000-0x000001659C161000-memory.dmp

Download

memory/2312-259-0x00000000031F0000-0x0000000003248000-memory.dmp

Download

memory/2312-255-0x00000000031F0000-0x0000000003248000-memory.dmp

Download

memory/2312-258-0x00000000031F0000-0x0000000003248000-memory.dmp

Download

memory/2312-257-0x00000000031F0000-0x0000000003248000-memory.dmp

Download

memory/2312-254-0x00000000031F0000-0x0000000003248000-memory.dmp

Download

memory/2532-373-0x000000001FE00000-0x0000000020328000-memory.dmp

Download