eafc538117a62faa7f036d2d36291bc79d9d54d52fd04826ac3d15ebe04e7214

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
Size 86KB
Sample260919-glrf9sca39
SHA256 eafc538117a62faa7f036d2d36291bc79d9d54d52fd04826ac3d15ebe04e7214
MD5 6e1596c0220810dadccc2a4f7f7a4652
SHA1 78d2b3e169261ca06045bd6c99641029106c19ff
SHA512 2227a72e8b9c9437ce2bbe936814b92e58879c5bc29eeb1bc84a02a5e5d7795e0f8bace67e8543fb4ab007bbe542ae8cc3e2eac2b29f45a6284073b782952699
SSDEEP 1536:fijuv00VDpJGtX85M9YoR0e37emJ4tSfwe61+n2r+1d1TFZ954lGT:fiKc0VDuqmYYe84cv61+4MN95/
TLSH
T13F83F231AC0AFCF7D26E05B08EC3DE2053144941624DBECE40E9FC9F6BED510E9A99A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	mediam.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	ya.exe

Executes dropped EXE 5 IoCs

pid	Process
3524	drsmartload195a.exe
5772	mc-110-12-0000336.exe
2164	mediam.exe
5820	my.exe
1096	ya.exe

Loads dropped DLL 2 IoCs

pid	Process
5772	mc-110-12-0000336.exe
5772	mc-110-12-0000336.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4320-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/5772-22-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/files/0x000700000002461f-21.dat	upx
behavioral1/memory/4320-55-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/5772-99-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/5772-261-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files (x86)\Common Files\Download\mc-110-12-0000336.exe	mc-110-12-0000336.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\edge_tracking_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\shopping.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Common Files\Download\mc-110-12-0000336.exe	mc-110-12-0000336.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1001494809\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1001494809\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\deny_etld1_domains.list	msedge.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\mdrive\mc-110-12-0000336.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\mc-110-12-0000336.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File created	C:\Windows\mdrive\mediam.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\mediam.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	\??\c:\windows\mdrive	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File created	C:\Windows\mdrive\run.bat	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File created	C:\Windows\mdrive\ya.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File created	C:\Windows\mdrive\drsmartload195a.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\drsmartload195a.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File created	C:\Windows\mdrive\my.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\my.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\run.bat	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
File opened for modification	C:\Windows\mdrive\ya.exe	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	my.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drsmartload195a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mc-110-12-0000336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mediam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134342708436973166"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F0A64FC0-096B-4C37-840F-E8425AFAAD16}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1416	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3524	drsmartload195a.exe
5820	my.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 5860	4320	jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe	88
PID 5860 wrote to memory of 3524	5860	cmd.exe	90
PID 5860 wrote to memory of 5772	5860	cmd.exe	91
PID 5860 wrote to memory of 2164	5860	cmd.exe	92
PID 5860 wrote to memory of 5820	5860	cmd.exe	93
PID 5860 wrote to memory of 1096	5860	cmd.exe	94
PID 2164 wrote to memory of 6056	2164	mediam.exe	96
PID 1096 wrote to memory of 3324	1096	ya.exe	98
PID 5464 wrote to memory of 5572	5464	explorer.exe	100
PID 2576 wrote to memory of 3152	2576	explorer.exe	102
PID 5572 wrote to memory of 6076	5572	msedge.exe	103
PID 3152 wrote to memory of 1416	3152	msedge.exe	104
PID 1416 wrote to memory of 800	1416	msedge.exe	105
PID 1416 wrote to memory of 1328	1416	msedge.exe	106
PID 1416 wrote to memory of 976	1416	msedge.exe	107
PID 1416 wrote to memory of 976	1416	msedge.exe	107
PID 1416 wrote to memory of 976	1416	msedge.exe	107
PID 1416 wrote to memory of 1748	1416	msedge.exe	108
PID 1416 wrote to memory of 1748	1416	msedge.exe	108
PID 1416 wrote to memory of 224	1416	msedge.exe	110
PID 1416 wrote to memory of 224	1416	msedge.exe	110
PID 1416 wrote to memory of 224	1416	msedge.exe	110
PID 1416 wrote to memory of 116	1416	msedge.exe	109
PID 1416 wrote to memory of 116	1416	msedge.exe	109
PID 1416 wrote to memory of 116	1416	msedge.exe	109
PID 1416 wrote to memory of 3432	1416	msedge.exe	111
PID 1416 wrote to memory of 3432	1416	msedge.exe	111
PID 1416 wrote to memory of 3432	1416	msedge.exe	111
PID 1416 wrote to memory of 3864	1416	msedge.exe	114
PID 1416 wrote to memory of 3864	1416	msedge.exe	114
PID 1416 wrote to memory of 3864	1416	msedge.exe	114
PID 1416 wrote to memory of 1824	1416	msedge.exe	115
PID 1416 wrote to memory of 1824	1416	msedge.exe	115
PID 1416 wrote to memory of 1824	1416	msedge.exe	115
PID 1416 wrote to memory of 2240	1416	msedge.exe	116
PID 1416 wrote to memory of 2240	1416	msedge.exe	116
PID 1416 wrote to memory of 1740	1416	msedge.exe	117
PID 1416 wrote to memory of 1740	1416	msedge.exe	117
PID 1416 wrote to memory of 1356	1416	msedge.exe	119
PID 1416 wrote to memory of 6128	1416	msedge.exe	122
PID 1416 wrote to memory of 6128	1416	msedge.exe	122
PID 1416 wrote to memory of 6128	1416	msedge.exe	122
PID 1416 wrote to memory of 4416	1416	msedge.exe	139
PID 1416 wrote to memory of 4220	1416	msedge.exe	140
PID 1416 wrote to memory of 4532	1416	msedge.exe	141
PID 1416 wrote to memory of 5568	1416	msedge.exe	142
PID 1416 wrote to memory of 5568	1416	msedge.exe	142
PID 1416 wrote to memory of 5212	1416	msedge.exe	143
PID 1416 wrote to memory of 5212	1416	msedge.exe	143
PID 1416 wrote to memory of 5212	1416	msedge.exe	143
PID 1416 wrote to memory of 2728	1416	msedge.exe	145
PID 1416 wrote to memory of 2728	1416	msedge.exe	145
PID 1416 wrote to memory of 3160	1416	msedge.exe	148
PID 1416 wrote to memory of 3160	1416	msedge.exe	148
PID 1416 wrote to memory of 3384	1416	msedge.exe	151
PID 1416 wrote to memory of 3384	1416	msedge.exe	151
PID 1416 wrote to memory of 3384	1416	msedge.exe	151
PID 1416 wrote to memory of 2804	1416	msedge.exe	152
PID 1416 wrote to memory of 2804	1416	msedge.exe	152
PID 1416 wrote to memory of 4304	1416	msedge.exe	156
PID 1416 wrote to memory of 3660	1416	msedge.exe	157
PID 1416 wrote to memory of 3660	1416	msedge.exe	157

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6e1596c0220810dadccc2a4f7f7a4652.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\mdrive\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5860
- - \??\c:\windows\mdrive\drsmartload195a.exe
    c:\windows\mdrive\drsmartload195a.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3524
- - \??\c:\windows\mdrive\mc-110-12-0000336.exe
    c:\windows\mdrive\mc-110-12-0000336.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5772
- - \??\c:\windows\mdrive\mediam.exe
    c:\windows\mdrive\mediam.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" http://www.the-click.info/mediam.html
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
- - \??\c:\windows\mdrive\my.exe
    c:\windows\mdrive\my.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5820
- - \??\c:\windows\mdrive\ya.exe
    c:\windows\mdrive\ya.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" http://www.coolwow.net
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.the-click.info/mediam.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.the-click.info/mediam.html
    3⤵
    PID:6076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.coolwow.net/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.coolwow.net/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffadc5ac188,0x7ffadc5ac194,0x7ffadc5ac1a0
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,10037985578044117787,7196868623633060355,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
      4⤵
      System Time Discovery
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,8756507656781450863,16655271095772078994,262144 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,14367806899369582244,4641695810716025557,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16429286707690868204,2615531905202466412,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5105818775055274802,7264276234988574028,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,15699439597641694672,2906708798142483214,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5060,i,10168880665863548230,7214353518357053784,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4952,i,15555310598158930616,10255300934301781701,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,17861476675481813942,12980999769940632064,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,7891029957629714128,13138940252730595798,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14134275457698523362,11383463197199585282,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14134275457698523362,11383463197199585282,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6200,i,7219478582936433752,5670111013917779222,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12006331067988927018,16949785115111148278,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,5020644719099656922,2007350475658948282,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,15645940181361132293,11933325294862526615,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,10074259246520684891,17840693537640940046,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4940,i,17786916321392150000,5418862729015919874,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10913193766752494987,13873299030653902864,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,10661499452265117160,8484086288735811925,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=776,i,13025946540534469976,17988060873249483175,2097152 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3705844518104000683,6245127617121318434,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,13985468359995856512,18378197128103409245,262144 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,16350258114160330322,8809791678978104789,524288 --field-trial-handle=2312,i,2962282576278726644,14444334863992928921,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
      4⤵
      PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mc-110-12-0000336.exe

Path C:\Program Files (x86)\Common Files\Download\mc-110-12-0000336.exe
Size 42KB
SHA256 eb052b6b7af91dbcf69b6d99222c5d8d09762fb1ed52d09a5c835cb428d0d633
MD5 d0698b791219e28fa7a26a32504d1f7f
SHA1 3bd9472525e709fb9d51691365c595a7773d9964
SHA512 f906221a08c49e6e73b8205681287a3e3fb132c2478a26acd2887e07192d956578a4458383273ff26289db6ebbc43a30246b93a6786d0f8b535d8b6aaf0781d5
SSDEEP 768:Lce52r5Qg2I4UqTCr5F2SasveIue2M5MZFCvrAgTug9NGjw48LZZ3XWqxmC9Dqwn:552r5QgHVXF2eeIL2KvrAgTug9NGjwFH
TLSH
T10B13927B52222C3B09A341FD70B4BB4EF6E2C101EB43825589FA1BD7A3C5E629D7651C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1001494809\manifest.json
Size 118B
SHA256 a5e0ef69ef1cf1ca9e3b6d53a0caaf6a711b0e5b71c9199c220c5cf176cec760
MD5 e742e590b22754841dd779e3439c16c3
SHA1 ec775f58ce04e2a7693fc5c64c790fc237135bec
SHA512 3730a73c5a21bb5d4e035b2d17813b4968cbfbf068bdbd2e87a748694607b5140e5f029da990aefad5b9676e14961dc7ae892811a2d203a0a731442fd0ab02cf
TLSH
T18CB092B00C1AA03B22C09320ECA166C283F80229E8022B1A088036481F8817881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1416_1160925895\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\edge_checkout_page_validator.js
Size 1021KB
SHA256 4bd84a271e6aeee39cc614bb6fa9e60ad465f61b6a305f9f69b995f9af910219
MD5 84017bbd252b4e3da14c6c6f7966da0c
SHA1 619a6e18fddfe2003aa3799e48a30d4e4d1be2ba
SHA512 719563802aa0f7154333295cad12e0184c2da0108bcd5e009e0828326094e9d49fe16b1fd5de874ce583896c32a85659d554d1816670ba17bc07b4f7a97f657d
SSDEEP 24576:j142AzAtsJvGxkVKA8nG8O4cELKXnhw5BD6Nc6U2y8enpBtSLVzhEiJsfaWZPS6Z:j142AzA+JvGxkVKA8nG8O4cELKXnhw57
TLSH
T174252B80E1E2253466D74CB960B7D2C4B5DC04587399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1416_324814621\manifest.json
Size 146B
SHA256 7e765ccd9f7f89bc111ef17d12194e83940dace4320e67bd582211969f117da1
MD5 ec88e92109abcf84de7911dd22725ce2
SHA1 b8a7b83f5ec59289282350824653b73712e89896
SHA512 b8f7e86d56f579a0b2b2c7b852e9322fa0424954f308587734ed2e5e8e3f7c8c38b7ecc42a92871885a9fb53695572ac687d5b92d67a9f6a87a3d29980c3ab13
TLSH
T174C02B33CC31AC300D3007E408F08601EB34134FF500B0163730008D0B3C470D0206D0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f888b41012b52f4eca4615a5eeef44d706335f0a661778e191c57f2dc568fcce
MD5 bc4397f06d418bc7cc1600164d9af763
SHA1 37181256364b4db46997175c37c90d3ee5b4bf63
SHA512 2fe09ac71a62c4a48ceebcc6f3c47a72c7a744c8b41261569b30869a3e648974efa67528721f07e7987f9a43c516b1d555aabc4f87132a5acca8f2f36477e2ad
TLSH
T120F0F9B9C925EC3B08FD5B1960A40A46F75513572A81888B3B3D820D8FF1A3B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 90d37ea9b0f61f0eec9bfdd8f62da82259b06315d5e2e69e737abc16b7129432
MD5 39bc62c3303625559f4153d822dc7955
SHA1 1f6f19e8ea9aa734dfcab68078d9b4b39d9c6156
SHA512 32ef640fd8e14a0afd8fad518c3177942ccdfb3df0f9e53335d9554c8ee111dd977890189dbb0713926f2a257473ca95f2d4da15366ecea4209050de8c8a9843
TLSH
T1CB31B1F7C3E4866E890196F0A614AE1BCE1D0954432C3D5AC4D4AF1B93E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 02f47ab491340d19f4674f5f846851314d499e316e0e51177983340bbdbc0d12
MD5 de6f3f827cf79ac785f6fe6022d690ac
SHA1 d6d7a8cff17e4d616b1bbe28d577bb3ccd939611
SHA512 2c326e0cd123799f97d0ba06a6f6f1ea43887189bbb933723af0bc5f77b79f61c7b56dfd536b628ba7dd997dbd84197835ad09371792cef65fbf07271f0dd05f
SSDEEP 192:sxZi7JRZjVd/f1lsNQZZNIN3Exuzodp8lmH4iqhq6+WNGYbIaFYsK+M8Ig5+0J:sxZULr/fzsNOZNTTbH8lGFwYdlgY4
TLSH
T16C42E819AE28697B8CC7D21DFA55BF53D3F9103290951E44AAFC8B2C05EBADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21e177166df001803a55ecf2f826bc03218955a5e973df78d573db0c19a46ced
MD5 9c1ede686d37c2fd22aee31a2879609f
SHA1 e1b08bc3b83871521ea7b7e175e4eb22a4de9c03
SHA512 0e16e3e42e09a32dcd1ed83099e30ff82e8fbb11dcae6526b61ee7e65c87a70f36e14de77bdbf0f68ef117118a6319ad7298f3fd584ada98aa05fd7f0fb0b2f5
SSDEEP 192:sxZi7JRZjVd/f1lsJQZZNIN3Exuzodp8lmH4iqh26+WNGYbIxFYsK+M8Ig5+HJ:sxZULr/fzsJOZNTTbH8JGFHYdlgYp
TLSH
T12B42E819AE28697B8CC7E219F755BF53D3F9103290951E44AAFC8B1C05EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca142e86d89026ac01a2ee1232d2b847b1dc19353940d9bac081823957daaa98
MD5 6d9579c606aed767123736c2fc0a39d1
SHA1 c639b4e43892d0556be25338765c60505e24789a
SHA512 f9f1ec0b7130623b95426f727e32438078b84bb12db8c83ce86b99ff8f0d1854cc71d1374e0886a7dc8bcb37b72f9ccf4508cb1489200539d0662069d1f46652
SSDEEP 192:sxZi7JRZjVd/f1lsGQZZNIN3Exuzodp8lmH4iqhq6+WNGYbIaFYsK+M8Igj0J:sxZULr/fzsGOZNTTbH8lGFwYdlgj4
TLSH
T15C42E715AE28A97B8CC7D21DFA55BF53D3F9103290951E44AAFC8B1C14EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0829b2434ff067fb7611865eb3ecc72e5a747c01f6ee7cd946ca6824ee01f816
MD5 1ea1654647df13a294cdf50a2dc4c07d
SHA1 58b22c070b8a24cbda0ab5fb57e310f474d3ae3b
SHA512 01554fdcb058c3970d09c1a5e5c1abe6f544d76f723161a4706374dde2c14c2f45befb4483b5177d675718b8aef0936c76c98d60a3ce32fe88df6fc7c84fc6a1
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXwLWLlMC7fnroc:0RyktjYEbvnWvDBltu1ja6wLWLywf0L4
TLSH
T129E2EB3F780CCB7E4FC04E9DED6A7E8B6DA801CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b2d5363b1997c96c1e00be4fbc5774ce5114c4a527135e50810bc4c1abec1c8e
MD5 1a69b02dbc1ebe43685514c1bb084442
SHA1 e4b5907efbde441e1c27bc377d82d87e4622465a
SHA512 19dbe6a48435feb7ef6a1d37409ecba59630487ac4aedd60e26865486b3fa1fbaf0d49bd73f2ee0273c52f11b9f5d09d4c3a96c7a51132bd5d8c20032f230f20
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXO136:OtfFvpopPxrB4RhfOV6
TLSH
T13CB2321571BA021138FE790881B5972F064232B37258E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d5a15c8b942afd901b1d06bd22497eab28d58f7cd524b649fcea5cbf345ca2fc
MD5 4bcc7fe4336768125e3f7c7ca921c2da
SHA1 f0778ca32ac072991a3344db446dddf867222ed6
SHA512 0e73a99c7a06b6aa311b62203e192a89366c2cd2b4071242846be31b29051f47ad0e7887f421f07ca3041d817a01acfb069cd18874108e0397b5c307a2513b35
SSDEEP 384:nNiFiZcIbPsNs8TUNTUlI4g5mgY0x2K2fLBgaw4QRsiQi7O6R2Feozh7UygL/7IL:EFQbpwgIIxKBbw4msi7TRWY4
TLSH
T146C24A76E8A4DEBBECEA8A95B70A7A07EEF04153C58C5AC4D5D95E1D00CB2DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0644015585f71f6548f2001c6ea0bac1a2e4801300c21b13f07a30b154a75ce5
MD5 5c075eafe67e8c9be89d544d361ed32b
SHA1 ce2b1bc6488fda1d9cdf5ac7f1fa227529f03992
SHA512 454c340136c9ec9523d69322afdb78f8d5910309106281bf06fdcad050aef85ef6a14947fef3a24e0ba1fef4fe76b5aecd4edf3033086479f24fca5ed2a52244
SSDEEP 384:n7iFiZcI63sNO8TUNTUlIm25mg5znK2fLBgaw4QRPhsa+VYrgL/7Izaom:WFQ63XwgSI3Bbw4mPhhgXh
TLSH
T1A9C24B36EC98DABBECEB8FD5AB4A7A07DEF00163809C5AC4DAD55D0D008719D1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 99ce02221ee6f3c5029c549482c776c8fccd0f9a6bca69e9380ebacae1885604
MD5 ba5d0a00806f5939fcf491a521ee8245
SHA1 07cf3e1e495f6cd9bd2b7df783e1802aaf5dee11
SHA512 4aa578189c0d2985f1365b04bf2ce77596bfbe56e4cae71df20ae7243a969c6e6bceeea87ec826ef0b298a4252748d4219d823ad60353cd42152dee8c1f7f1cd
SSDEEP 384:nKiFiZcI63sNs8TUNTUlI425mgIMAK2fLBgaw4QRsiXisa+VYrgL/7Izaom:BFQ63pwgsckBbw4mjihgXh
TLSH
T1B4C24A36E894DABBECEA8BD5BB4A7607DEF04253C58C5AC4DAD95D0D008B1DD0707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e30222716c60901ed1f5ebe370ba37ce025f31d6ca29cf596ea2292f78b6f2e6
MD5 53dbeb04d0509408ba6ba158bc8b9f86
SHA1 296ba5fbfafebfb8a10aa478882be37d8d8a7de0
SHA512 9ad9ec6358e5abafa2bc4ba17502dce6c15659b393eb948e153ea6592091f70ee7409a2230a171867f0a68cfcb6d1bc6295f5286dce978a6530357401cb8d31f
SSDEEP 384:nTiFiZcINsNs8TUNTUlI4g5mgY0x2K2fLBgaw4QRsiTi7O6R2Feozh7UygL/7Izf:+FQNpwgIIxKBbw4m/i7TRWY4
TLSH
T15EC24A76E8A4DEBBECEA8A95A70A7A07EEF04153C58C5AC4D5D95E1D00CB2DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.18.1\typosquatting_list.pb
Size 1.4MB
SHA256 f68ebf4f35df006cbd1c9074fec6a8fbc51a55eb056513705c9298eeb7a1ed2e
MD5 9c02e27f8bcff0a9a7d34d95f0db301e
SHA1 199a0696caa2a5399769ccce2d8855c86727f029
SHA512 39a238ac2d68857406d3fffe8d87162a109b5fb32aa010ca8dedf2ba58e9537e067ea4f16ffa225c1c85c8457cbfda2e2c3a774fdb76eefe35e03bc4094e3d09
SSDEEP 12288:8UIKHjzcldcJ9KDIyDSlypFtZPxzSsDDCVJNz:vUcJ9ODSlCFt3Sn
TLSH
T10C65B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c5071cc-131d-467d-b9ca-bee1fac3f0fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8c5071cc-131d-467d-b9ca-bee1fac3f0fd.tmp
Size 2KB
SHA256 65cc2d978775e60c4341a58150a4c2267eb10ecceb43b2af6ec732bda3b3682c
MD5 011d35f570a8e2769967c34922a22272
SHA1 8a95c800b72ef1f32d8a62da8589b60f2ed846a4
SHA512 d43ef473322e95de1c75513dffc43b2e5cb9fc8b7bb9896131b9b9f941b248c8bd3ddcc0bf3b6c9604f7076b8da00082c74d60e5a961acae3ae59e6b5f3c51e9
TLSH
T149512DE04C395AD1D4BD0E7EB09B35EC94ECD722B8A0347D3858E9989A7E61D344083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8c5c716f6b49be26aa5a86dd08b8b30473edad175d376c83a6be8c78bb61b43c
MD5 6acda5e02e6f357d2f60aeef2c263045
SHA1 f2c5e4df18fa4563fbce76017323387067087771
SHA512 c0dfbbbdd8fa6c0811ef1ffb1cca2df0fa7edbf4eb398e258993f48ba90c0a5c6a0b3b3e7b7269695cd5c04dbe424cdb9184891894e89a066e210bfbe2cff824
TLSH
T1E25130E04C3C5AD1D4BD0E7EB49B35EC94EC9721B8A4347D7858E9989A7E61D2040C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 12016e1865509a8dc3aecbdcef953b6f457b07dc5b8718ea37c041105571b486
MD5 747a71cd0767f6215ce2e5bb2b10752c
SHA1 842e49cfa2be74ff9e9fb3d00e42dd310a0d27a8
SHA512 38e7b51dc7980921e61fcf831312db24c2c11d54d7c356b3f3a53402549e18453dca76ec9da90bd204bae7ad1fb9a79be749c24d92a1df1acc2865ce4ac13c25
TLSH
T1B65130E04C395AD1D5FD0E7EB09B35EC94ECD722B8A434793858E9988A7E61D304483F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 208028bea545847f669a85b6740790de86e724eefa3d0200bc9cd3024d7e80f0
MD5 6a46b3394fef9edae49bc81c050619f2
SHA1 c988f515c870880dbcf7770a14e782d32324cec3
SHA512 6f58fc47e35353ea20fb8ee68a0c1ee28e3c5a356fe13ee383b7d2faea0986bd6cbee51efdd39ec4669cda55368f706d0eae648700644e63478ab7430c2eac5d
TLSH
T1DE412B9CB6ED1108B3B36E5AABF3A96D587EBD732F16854D10110E4F0A22A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA072.tmp\System.dll
Size 10KB
SHA256 18024b3cefe128951a52ff51acd8e39daf1adc5877ccd7bc63dd205f297a76d2
MD5 02184a0759753164c0df464de83ce3df
SHA1 cdecd95d93d215897d5b5b1d3ed823f6fc591eee
SHA512 306bbd1705c0a42d61406e72c6fabe8b133a479ce1502d4436cc1b823cff82afad13b75138c31f8841af056c4e8c923c8ddfe40817049fc40351b45fc6f7a79e
SSDEEP 192:MOycJo/rJVCmIDNLU0dq5RD00lspbub76GL:i/QQ0d0RD0USq/6G
TLSH
T136224C50426042F3DD54823C09A739272BB87B249FA48EC38F9364516E199FABCBD329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drsmartload195a.exe

Path C:\Windows\mdrive\drsmartload195a.exe
Size 24KB
SHA256 dce80599775931eb9ce50da69e275a19577f0ad2d55adc1b4f8bd528199a8612
MD5 94c9a9661dd5475fc6ef6f015f00d913
SHA1 3ce3b84141e156701804d8999eb215b10846e8f1
SHA512 773acefa4bdd28beb79acedf8bf729ec8d3bc447742ab148d44f912cfe5b75f2c1d1f9a62f6f7783f859e8d882d517608338f88c8ab13efe300138718eb8f11a
SSDEEP 192:rV9iQs1NEf3swkgLtVcY1Vcvm8L3m/m3XxhgT6y5iVxD94zI:rzfgNEagLtVcY7cDL2/GXkuymD94zI
TLSH
T1E6B22466FA149039F1448A722C26469A848B3C710A71DD2BFB4D3B5E2B733D395F1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mediam.exe

Path C:\Windows\mdrive\mediam.exe
Size 3KB
SHA256 3dad36f050af7ff6013b955e89ab38e2b1922927d57b3d98d78a4d17dc6fb8dd
MD5 86602795657c661d292bf6501bbec531
SHA1 84cc5334aecc0b75d94b7d9958521a32f8f30506
SHA512 7567f7e7587d4cfc239d0621f4d75b41b030c82cdbe3f1eb63f55d0690c2a5f91e12ddbfa992a26841b01dd55ab86fbf40dd9aa016df8983ee8bd727e6af593e
TLSH
T14E61DA4B43A61DE2E0C8967E13A5C9B1F17F4D3802FA88431F940643B474560594BF83
MD5 SHA1 SHA512 TLSH

Submit Download

my.exe

Path C:\Windows\mdrive\my.exe
Size 5KB
SHA256 17caf85516795b65bb0f18057a283ee2f2b13e734cae1bbd60f976f48b9b6936
MD5 5734cde270f40e39f3de199eb900c0a2
SHA1 f3d0ee24ed5456539d56beaef11ecd6f464b4453
SHA512 bf6af40a1f48b301d8db688bf76505aab56fe7666959d5d3c37cf2bfbaeb33e3110d02be47a1abd0be82799d5616f21729cb731b1d17336136e82cc8c63a05c8
SSDEEP 48:y+EPswWt/6IOp9Z7xcsJ6W80w50OFk1mAX/W31X6XX+D+BFQcOUC3wULEYF0GIP9:nmXWZ6LLX++0Shso+aBZsLEYVY18SN
TLSH
T100C1E812F354A851F0950A32ADBBCBF99971BC208E65934B76C07F5F3C30260A949FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ya.exe

Path C:\Windows\mdrive\ya.exe
Size 3KB
SHA256 516467ff97a2d3c208c72ddf16d0184b3ba914bdbfae933828f4aa79c7174c48
MD5 8a6cc1e3afbe403dbf32ec97a1ca6e31
SHA1 ce32c35673a92acb35534032600e838c2fa3db16
SHA512 ffa36e5aaa5fcc0b0e732ec761e94328b4b9f37f1507d0be8babe897a1605a892844d96ba31187495315873dc027a92b92d6f1c91959895155930b3daa2626af
TLSH
T1CC61DA5B43572EE1E1985D7E03A5CAA1F57B4C3842F284C32F72021374BC5246956F02
MD5 SHA1 SHA512 TLSH

Submit Download

drsmartload1.exe

Path C:\drsmartload1.exe
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

run.bat

Path C:\windows\mdrive\run.bat
Size 190B
SHA256 b6d4449ea4e84274ca9a050b15f926a43c7f9da8ca4b37fc6753397f3a920841
MD5 74047bc67581577cee65c2ff0b66cc15
SHA1 ccae7763a0b63a6b8029c7a6810b23a404bf9420
SHA512 c732e2060dcbfc5185cb05af920fa30e2099a1818dba7e119b9cf939d2260478d2e4399e0be644a369d4fee1a26f3619ba0ad75749c5a656d0a6b30479dfd5ec
TLSH
T1B8C002C9C882C994C8318C1D2F4B3700A852F5994BDA6D591F4641BA79CBECBF206CE0
MD5 SHA1 SHA512 TLSH

Submit Download

mc-110-12-0000336.exe

Path \??\c:\windows\mdrive\mc-110-12-0000336.exe
Size 28KB
SHA256 6309857dd94cebe219be0661daaeb7eaa98ea9d49f1beca875e5b486909e2330
MD5 a4f0fc5160643b381e1788640ac23970
SHA1 9aeb958c639219f00c63327202f4b2107b2c22bf
SHA512 c6bf15009637a8605b83f7d4e164e72ed95bc8e77c86a0c308865d7f5558deb73b23be67838a070aeeef1d0bafcf08fc12e4e2fd6e88823155744e4be42c01b7
SSDEEP 384:rq5uukxExcRyM5wIVZBsfm21lRNCmKthB1xV7ovQoUTSro2ySI4Kb3jK5iN0:rqOExnM5fLs17vKzTo+upy/ub
TLSH
T181D2E153F5919DCBD8084330277EDB05259EBB2A0A65DB165FB2971F28136C0E47C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-210-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1096-48-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2164-38-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4320-55-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/5772-22-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5772-23-0x000000000043B000-0x000000000043C000-memory.dmp

Download

memory/5772-261-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5772-99-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5820-209-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5820-41-0x0000000000400000-0x0000000000406000-memory.dmp

Download