6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe
Size 168KB
Sample260924-2mtcgaytev
SHA256 6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54
MD5 bd5a413f762f543c67257e2c66abdd03
SHA1 7eaa1ac9b9d00348009d5e3f950ac759c5fec97e
SHA512 8eab8f7e588939c50d73c0413877b3896b40037b80a32fd46d56d390df99a8e472a703764f0aec88f942ccea1e6aaceb82ccb455af462942c4cd36ca0a733661
SSDEEP 3072:vNOexEGdszZkm3YUFreyHnB/qQdx6+SugBayy6J2si:vNREnZkkPreyHnxqQXnSdBayy6J
TLSH
T150F31A53EB847111F56784713838A2A5A819BD3024A1DC67B742BEAA2471ED3F8F371F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5840	iexplorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msnexplorer = "c:\\windows\\system32\\iexplorer.exe"	iexplorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\iexplorer.exe	jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe
File opened for modification	\??\c:\windows\SysWOW64\iexplorer.exe	jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_288068924\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_1889501630\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_1889501630\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_697134198\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_288068924\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_288068924\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_288068924\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_704268499\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2448_697134198\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4768	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347633547471803"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{0CE6317B-BE45-495C-907E-205F47653949}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4512	jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe
5840	iexplorer.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5840	4512	jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe	89
PID 5840 wrote to memory of 2448	5840	iexplorer.exe	91
PID 2448 wrote to memory of 4216	2448	msedge.exe	92
PID 2448 wrote to memory of 4768	2448	msedge.exe	94
PID 2448 wrote to memory of 1180	2448	msedge.exe	95
PID 2448 wrote to memory of 1180	2448	msedge.exe	95
PID 2448 wrote to memory of 1180	2448	msedge.exe	95
PID 2448 wrote to memory of 2156	2448	msedge.exe	96
PID 2448 wrote to memory of 2156	2448	msedge.exe	96
PID 2448 wrote to memory of 3696	2448	msedge.exe	98
PID 2448 wrote to memory of 4816	2448	msedge.exe	97
PID 2448 wrote to memory of 3696	2448	msedge.exe	98
PID 2448 wrote to memory of 3696	2448	msedge.exe	98
PID 2448 wrote to memory of 4816	2448	msedge.exe	97
PID 2448 wrote to memory of 4816	2448	msedge.exe	97
PID 2448 wrote to memory of 6132	2448	msedge.exe	99
PID 2448 wrote to memory of 2584	2448	msedge.exe	100
PID 2448 wrote to memory of 6132	2448	msedge.exe	99
PID 2448 wrote to memory of 6132	2448	msedge.exe	99
PID 2448 wrote to memory of 2584	2448	msedge.exe	100
PID 2448 wrote to memory of 2584	2448	msedge.exe	100
PID 2448 wrote to memory of 2288	2448	msedge.exe	101
PID 2448 wrote to memory of 2288	2448	msedge.exe	101
PID 2448 wrote to memory of 2780	2448	msedge.exe	103
PID 2448 wrote to memory of 2780	2448	msedge.exe	103
PID 2448 wrote to memory of 2780	2448	msedge.exe	103
PID 2448 wrote to memory of 5672	2448	msedge.exe	104
PID 2448 wrote to memory of 5672	2448	msedge.exe	104
PID 2448 wrote to memory of 3324	2448	msedge.exe	105
PID 2448 wrote to memory of 3324	2448	msedge.exe	105
PID 2448 wrote to memory of 2660	2448	msedge.exe	106
PID 2448 wrote to memory of 4404	2448	msedge.exe	107
PID 2448 wrote to memory of 2660	2448	msedge.exe	106
PID 2448 wrote to memory of 2660	2448	msedge.exe	106
PID 2448 wrote to memory of 4404	2448	msedge.exe	107
PID 2448 wrote to memory of 4404	2448	msedge.exe	107
PID 2448 wrote to memory of 3844	2448	msedge.exe	109
PID 2448 wrote to memory of 4304	2448	msedge.exe	110
PID 2448 wrote to memory of 4304	2448	msedge.exe	110
PID 2448 wrote to memory of 3032	2448	msedge.exe	113
PID 2448 wrote to memory of 3032	2448	msedge.exe	113
PID 2448 wrote to memory of 3032	2448	msedge.exe	113
PID 2448 wrote to memory of 1404	2448	msedge.exe	114
PID 2448 wrote to memory of 1404	2448	msedge.exe	114
PID 2448 wrote to memory of 1404	2448	msedge.exe	114
PID 2448 wrote to memory of 5332	2448	msedge.exe	115
PID 2448 wrote to memory of 5332	2448	msedge.exe	115
PID 2448 wrote to memory of 5036	2448	msedge.exe	117
PID 2448 wrote to memory of 3412	2448	msedge.exe	118
PID 2448 wrote to memory of 1152	2448	msedge.exe	119
PID 2448 wrote to memory of 5108	2448	msedge.exe	120
PID 2448 wrote to memory of 5108	2448	msedge.exe	120
PID 2448 wrote to memory of 2496	2448	msedge.exe	124
PID 2448 wrote to memory of 2496	2448	msedge.exe	124
PID 2448 wrote to memory of 568	2448	msedge.exe	125
PID 2448 wrote to memory of 568	2448	msedge.exe	125
PID 2448 wrote to memory of 4272	2448	msedge.exe	126
PID 2448 wrote to memory of 4272	2448	msedge.exe	126
PID 2448 wrote to memory of 4484	2448	msedge.exe	127
PID 2448 wrote to memory of 4484	2448	msedge.exe	127
PID 2448 wrote to memory of 3964	2448	msedge.exe	128
PID 2448 wrote to memory of 1944	2448	msedge.exe	129
PID 2448 wrote to memory of 1944	2448	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- \??\c:\windows\SysWOW64\iexplorer.exe
  c:\windows\system32\iexplorer.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://charges.uol.com.br/charges/20061210som.swf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdd23ec188,0x7ffdd23ec194,0x7ffdd23ec1a0
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,7637285499699205297,4522302846703559773,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:11
      4⤵
      System Time Discovery
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,297032981403621486,17180794096828828228,262144 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,15476709049670427897,7153358764177569450,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,17961950860026947824,10911457608683850930,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,2704137900528686892,10513008174681903986,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,5924446971897189885,18394945144623943205,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,1159377422742858910,1676276865170232316,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,17087769577155899226,6866295454346264914,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3772,i,12347379772526342945,10904170571112907578,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,6803919397528067342,670947084045644539,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,15628621508284439910,6643394491711484623,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5744,i,5211175361020434528,7048374660777811818,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5224,i,12652630669018046526,16552956774301358469,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2076682815631451998,14096234921140506395,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2076682815631451998,14096234921140506395,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,1958312746985029033,15800782456284030005,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6404,i,18206971015271126016,16364690484701105860,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7148,i,9310542164820401979,583098876717327502,2097152 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,7116477139100988218,9212667003307121639,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,4858056113155403705,1416118270641062867,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,5592836172439525194,12279529700387143485,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,10231709314342629783,12367277917989654112,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2760,i,6952073270024978997,6720805681936974172,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,12101927073940268862,13096750896314417799,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,9856738667951269597,12154514072726368278,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,11033396914914405549,12320680259312910574,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2418668691091885489,16740955294553288161,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5592,i,16782848951256131092,4694059533188223125,262144 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17498849319239241153,6552332488150431463,524288 --field-trial-handle=2992,i,8442832993097575934,10458856964547190684,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
      4⤵
      PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 492eef2ae215a1b99d6d6fcd0b111d75451b606a18f2c7eaad21f1b5cc5bbb77
MD5 ae1b6ef77695ad3dc0abfa5a861981d9
SHA1 f3fe279c746875aebd17821754fc578a6e2d39b2
SHA512 5d4e9a155b1df17fea44971a1b1895372f0adea7dd831abf6dae7cb1428d396bc154b037adfd66ab0ccc23ae07ea8f7b284c7b30306f57583fba24019e6ffda3
SSDEEP 96:rirB7qo5rtm0DZCoQqL6jAcf1sMg6Y9bA+VSY+7293v7gzCp69xLsbD+JP0:qQdavkO3Tb+QD+JM
TLSH
T1E891ECA68580D0D0CBA47B32D2F125CF3E7415BE1843BF1212E7E475DB36B9026E846B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b1a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b1a3.TMP
Size 3KB
SHA256 bb3cdb32513d85dd13d9346fcb4d6b3327243e5e9c8e8aa4b7aff3eef4c91971
MD5 1620afcd78f8f2084386c509360cac3b
SHA1 96df362d722459995958c62e5095c85aaad55e0a
SHA512 49c61c212675b854468dd3f3f48072f5aa96bf0b7926c7281cfca4fb59a7c0b21fd9396fb9baf1b8ffe7f0704142cdf29f4edfd4121a7f8499b6a2c72f531715
TLSH
T11D61FB95869080E0CBA85C33E2F5118F3F7556B36983FE2204F7F17A9B4AB205BE9048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.uol.com.br_0.indexeddb.leveldb\000003.log
Size 630KB
SHA256 3c24b2cac44e77162578065ca025e0a26c943073daee71a28036734c684f6678
MD5 2c8baf2f6fb4921765f9d46f01f9fa3a
SHA1 eefd684bdb19b85a1f66d2068f8d59051c02cdfc
SHA512 0ba87e692d038d5e4d0cde849d938579851675694f81aef3a87ff8b42dcd42cfc3839e721ada90f295d7ac46fa8c7a34ee7e14fcc54d94361e1e38e79aa1e694
SSDEEP 12288:qC6LJubIz6Np9S2WR4bk3SJ6p9O2kvHNtg+RkRS4tvHNxg+76:J6J1gpjWR93q6p/WHJRkRNtH576
TLSH
T1CAD4025B6AB1E916F669117364B21F8457372D48FC85CA0EF5C6F36ED8B33609C21B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.uol.com.br_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.uol.com.br_0.indexeddb.leveldb\LOG
Size 349B
SHA256 0d25d7283fdb248bb5c9fca20c70b13ace44986505675acb134618b419675b85
MD5 c1f990c92f8b7bced16e7cbb49ad63a1
SHA1 285ed8a83e3066a9b740d156b3ac180cd94f584e
SHA512 111fa55375feaaee6154e30ead12a22d73cc7c6e14d871318bbcd130a2b54819b223fefa4b669d4c5ceef03560d964af088df60719a38761112a7fca7273963c
TLSH
T1D5E0D82486D9D26BB11460F255647F0996A3251FEB8CAA868F01D810B6C388C986E1B6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.uol.com.br_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 75a30bacd3a31a1be38d49a19623279d8c97e8d3b0d7d80e88c9b9ed7102d312
MD5 9399955dfd9ce79de0755f88fe11e822
SHA1 6746b519d826e89b412ca71d01c2ed9f37018317
SHA512 b1b69c5f70cf063a06dd075ce5e17682c0b79039b071716cbdf1a6e01993ab2595b0666ca962dd7e65f7bb5443d2141614f43b2969236488d71cf1a961d00362
SSDEEP 384:DE8QedFqLBeWxxViDJPfvfa1PQ1pOK1wwXk1gbFgUedEy6Mk684OBR1ItB3/YxEA:yk3uajlRiIm/p2
TLSH
T1495235F783F4852D8A1166F0EB15FD1BCE590524831C3A79CAE5BE2753F2861E20179B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d81e158ef105f32a378dcc22f0fca9a202689e4102a3ba3967bbfe7d855f573d
MD5 dab755234c348d1d4aa2671633893c94
SHA1 6a4eaa40948a71bed7fae80be66f00feddf947b6
SHA512 dc63288aa90b7faade93268c7605d0459f195bbe574028efe36e3f69c7f4185e14cd0e00de8245a6bb2a67a43f0ade0355423c701f435f3ddbfd791ead4fb57b
SSDEEP 384:sxRzLO//fusmC+pBrOjtP/5f/i32LcBI+7wCEnVrc1:svLO//fIHrOjB/5n22LcO+7knS
TLSH
T103729597A574597B2CDBA62BF514FB2BE2F51422A0C44E84BBFC892C00D76ED6106C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1c0cace81de1c25d440f81f5e2ff91a9ef0299dda3bff5b779cfc35cbda7ad62
MD5 885b9394a9b36477cd4ae7919e99ec7c
SHA1 7f2392f85fdd267da7cdbaa03bf532bafb865640
SHA512 96d3c137047d786f23de25911062d5919e45183acf0d6f8d7eee07ade90c3022f83d60ee629a73e1b0dca69df60a8594877d550db8eb317ed63b27112a943596
SSDEEP 384:sxRcLO//fusjC+pBrOjtP/5f/i32LcBI+7wCEnV0cK:s4LO//fhHrOjB/5n22LcO+7kna
TLSH
T13462A497A974597B1CDBA63BF514FB2BE2F51422A0C40E84BBFC892C00D76ED6106C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 6e0d100288c6df313f93c1c6bd5f06dbef37b32234d54154df4d42009dfe9c42
MD5 2fa1e42069b6e7123bd7824cff947bda
SHA1 584a5dfa59738421073cff76dbac417904502b03
SHA512 108c32f826d752aacc46644e37e37bab80306bcc3c897e766d9a5337c1d50769a8b90f28508bf5677cb5da469dda4fea041738766f385a21e7562a6ba48931ea
SSDEEP 768:ksRdMG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSu1+2+gZroe2FF:ksRdMmEb0JWgSwffTu1jaBu1+rgSe2Es
TLSH
T16DD2D97B640CCB7F4F804ADD9C197E9B6DA802CB9698CD8047FE941D02C67EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf85aa21-b803-4922-9f10-8556bc8283fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf85aa21-b803-4922-9f10-8556bc8283fc.tmp
Size 15KB
SHA256 9eded2f8c0bb1aaac1ee3ba7d0d21529cf6081d777d93a7e72f55964ce4de990
MD5 e3186f1bba5cf586d5ec59939672f89d
SHA1 38a13e9b292b3179ce923e7449ff88dc6f0a8dcf
SHA512 622017d0314fb7c0ca4380943865a2283baac15509b02f839fc095f37a4c1e50d67aab5356ba361578d371d40baee064a77fa312b7df4330fd78065cbb947d98
SSDEEP 384:sxRzLO//fusaC+pBrOjtP/5f/i32LcBI+7wCEnVfcX:svLO//fwHrOjB/5n22LcO+7kn8
TLSH
T14C72A497A974597B1CDBA63BF514FB2BE2F51422A0C44E84BBFC892C00D76ED6106C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fee8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fee8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e3ed8a01855b2dd628a11c52bcb48d840313e148017145b21fd2c07b0a7ce641
MD5 24caa69614a566e33a28d8ed80ef23b9
SHA1 d1390245b31ab68b57364340f220f35fe4566083
SHA512 c7d8b67c05a111509d07b0afdc0ef9741c64bd9dc2102b59b71b3a7eb27ef4bd9374a13e8d4e49533da21f7664078fe94d0c4c55c546ce2e8aed1b3603d3726c
SSDEEP 768:qm3GPb9SFajUTut1nqMwQi5BgK5/CwYcZAPSa7dLKkC80:qm3G77VmBg8/diPX0
TLSH
T1FAF2AE31ACB5CDB31CFE9259B5427B87AFF461A388980988D4DA5B0E0683DDD134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7a9b316db3a11871db8f9fd30f0adfaab296f6d301c9dec7e50f27d52b386deb
MD5 61756b38880ad87277d732ce8de887c2
SHA1 86e07b7aa2d3254551bdbaacb9b70d33caa9955f
SHA512 613974124fd012b00edace303541643746aa96e20c15af346b60a376758c7a9733dabca1a6b289a668c1f28e45ad39a3001ce8386d7924761881a17b8a2cb232
SSDEEP 768:O/UxvxjgC+Ft3xLESFajU6nqMwQi5BgK5/CwYclCA8Dea:DZj3+Ft3xEhVmBg8/dIA8Sa
TLSH
T19F03C036ECB49D778CFA9244764A638BEFF451A3C584089489ED2E0E07D79EC530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5a66321f1e9b2fcfd45be94dfcdf0e271b7faf18d0a541858cc6cf66630ce656
MD5 4b6d91edaddccd7caf48a06c7b94b2f2
SHA1 182923da303e928660db32d3047b1c4f84e1a1b3
SHA512 1f7d12d57251d3198c7ed6f451eff6596557d66b38de8b696aae6020b7f5b928ed70b8b23001283802e5f425689396de2e5598acac7c61b9afecc382cd9f0e99
SSDEEP 768:Hm36PJ9SFajUTutOnqMwQi5BgK5/CwYcZAPSa7dLKkC80:Hm3614VmBg8/diPX0
TLSH
T1DBF29E31ACB5CDB35CFE9255B5427687BFF461A388880988D4DA5B0E0683DDE174BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 332d10a56fc48c28ff5d88071684ed57b8d0d6c4406ac1bd43b41fd5ba1a09d8
MD5 7cb0f7ff26da09b4ed8f1f70dcc19ffa
SHA1 64048679a7bda578803f4170a5696317993b1f6e
SHA512 178e1ebc854213b0ce70a7cea4d5206fbfdf23cba1619dc1ead11944669fda6c165870655c2bad001e31a7cb86b86344f05b5e0496e5b4cd2515deee0ab17fb5
SSDEEP 768:2m3fPJ9SFajUTutOnqMwQi5BgK5/CwYcZAPSa7dLKkC80:2m3f14VmBg8/diPX0
TLSH
T1F3F2AE31ACB5CDB35CFE9255B5427A87BFF461A388880988D4DA5F0E0683DDE174BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 300fd6b1e316a524ee6cb467d2056e81ef62b930fd5fb043071e84385657460d
MD5 9416307e6a96c1b33869f1d84d6fe502
SHA1 c38e80de6cd952bfaca8e1495c4596316344e9fc
SHA512 78f292828eb6fab78f859dd12ec851d10a72c666f53797066fefc7893ca323305435c4cdeca998eef4e5b6519cffc6c33f42aadc0f1deeaec8eec51386007e24
SSDEEP 768:TFJ+3swgAPH9glajUTutDhnqMwQi5BgK5/CwYcZAPSa7dLKkC80:j+3JH1hVmBg8/diPX0
TLSH
T1F51317F598E38977D8AE4347A73D6E469EBCD193B4884884B7D95D0DCC825BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2448_1683074528\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iexplorer.exe

Path C:\Windows\SysWOW64\iexplorer.exe
Size 168KB
SHA256 6f7a55d5af89d995069d5b9cbde340edef7ee7c6ce86ff03745424f40d505b54
MD5 bd5a413f762f543c67257e2c66abdd03
SHA1 7eaa1ac9b9d00348009d5e3f950ac759c5fec97e
SHA512 8eab8f7e588939c50d73c0413877b3896b40037b80a32fd46d56d390df99a8e472a703764f0aec88f942ccea1e6aaceb82ccb455af462942c4cd36ca0a733661
SSDEEP 3072:vNOexEGdszZkm3YUFreyHnB/qQdx6+SugBayy6J2si:vNREnZkkPreyHnxqQXnSdBayy6J
TLSH
T150F31A53EB847111F56784713838A2A5A819BD3024A1DC67B742BEAA2471ED3F8F371F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4512-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download