1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
Size 666KB
Sample260924-b99pvsbe97
SHA256 1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94
MD5 e85473a5917f5df592797c0b97b240f0
SHA1 5f0ce5b6d96b40f5bfeb57028ed0fce28bb258ca
SHA512 49cb025e407420ade56923b4671af321c1350e9333ce06f5ab4a2f95c6c905280a5f0c137c7d713c9499095a571432d0c2b5f04d5aef76d6d6bc2daec1a25346
SSDEEP 12288:HvtvrncTvdVr85zX0Qp905VfO7RbA5PO1U+76VaV1ZtUazFggG:HvtTcTvdV20QpualbQPO1U+mV6tUaOgG
TLSH
T11EE40223ED10956ED03C91B322F21728BD749F622C750567EB99BDB16E32A305F47A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution spyware upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000016b4c-4.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5908	Pcsszuoor.exe

Loads dropped DLL 6 IoCs

pid	Process
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5908	Pcsszuoor.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000016b4c-4.dat	upx
behavioral2/memory/5524-6-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/5908-20-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/5524-28-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/5908-278-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/5908-533-0x0000000010000000-0x0000000010129000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Pcsszuoor.exe	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
File opened for modification	C:\Program Files (x86)\Pcsszuoor.exe	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
File created	C:\Program Files (x86)\Pcsszuoor.dll	Pcsszuoor.exe
File opened for modification	C:\Program Files (x86)\Pcsszuoor.dll	Pcsszuoor.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1082059612\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_478705602\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1440383170\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1031573871\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1031573871\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1031573871\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1031573871\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1440383170\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3028_1082059612\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcsszuoor.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	Pcsszuoor.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "NO"	Pcsszuoor.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery	Pcsszuoor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	Pcsszuoor.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346885080964258"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{C15DB07C-892B-4204-83A4-C099F84E444A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
5908	Pcsszuoor.exe
5908	Pcsszuoor.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 5908	5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe	90
PID 5524 wrote to memory of 5956	5524	jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe	91
PID 5908 wrote to memory of 5872	5908	Pcsszuoor.exe	93
PID 5872 wrote to memory of 3028	5872	IEXPLORE.EXE	94
PID 3028 wrote to memory of 4216	3028	msedge.exe	95
PID 3028 wrote to memory of 4592	3028	msedge.exe	97
PID 3028 wrote to memory of 872	3028	msedge.exe	98
PID 3028 wrote to memory of 4592	3028	msedge.exe	97
PID 3028 wrote to memory of 4592	3028	msedge.exe	97
PID 3028 wrote to memory of 4636	3028	msedge.exe	99
PID 3028 wrote to memory of 4636	3028	msedge.exe	99
PID 3028 wrote to memory of 5676	3028	msedge.exe	100
PID 3028 wrote to memory of 5676	3028	msedge.exe	100
PID 3028 wrote to memory of 5676	3028	msedge.exe	100
PID 3028 wrote to memory of 3324	3028	msedge.exe	101
PID 3028 wrote to memory of 3324	3028	msedge.exe	101
PID 3028 wrote to memory of 3324	3028	msedge.exe	101
PID 3028 wrote to memory of 2928	3028	msedge.exe	102
PID 3028 wrote to memory of 5680	3028	msedge.exe	103
PID 3028 wrote to memory of 2928	3028	msedge.exe	102
PID 3028 wrote to memory of 2928	3028	msedge.exe	102
PID 3028 wrote to memory of 5680	3028	msedge.exe	103
PID 3028 wrote to memory of 5680	3028	msedge.exe	103
PID 3028 wrote to memory of 2412	3028	msedge.exe	104
PID 3028 wrote to memory of 2412	3028	msedge.exe	104
PID 3028 wrote to memory of 5604	3028	msedge.exe	106
PID 3028 wrote to memory of 5604	3028	msedge.exe	106
PID 3028 wrote to memory of 3756	3028	msedge.exe	107
PID 3028 wrote to memory of 3756	3028	msedge.exe	107
PID 3028 wrote to memory of 3432	3028	msedge.exe	109
PID 3028 wrote to memory of 1108	3028	msedge.exe	110
PID 3028 wrote to memory of 1108	3028	msedge.exe	110
PID 3028 wrote to memory of 3340	3028	msedge.exe	113
PID 3028 wrote to memory of 3340	3028	msedge.exe	113
PID 3028 wrote to memory of 6056	3028	msedge.exe	115
PID 3028 wrote to memory of 2864	3028	msedge.exe	116
PID 3028 wrote to memory of 5780	3028	msedge.exe	117
PID 3028 wrote to memory of 5844	3028	msedge.exe	118
PID 3028 wrote to memory of 5844	3028	msedge.exe	118
PID 3028 wrote to memory of 2888	3028	msedge.exe	121
PID 3028 wrote to memory of 2888	3028	msedge.exe	121
PID 3028 wrote to memory of 4324	3028	msedge.exe	122
PID 3028 wrote to memory of 4324	3028	msedge.exe	122
PID 3028 wrote to memory of 2072	3028	msedge.exe	123
PID 3028 wrote to memory of 2072	3028	msedge.exe	123
PID 3028 wrote to memory of 4884	3028	msedge.exe	124
PID 3028 wrote to memory of 2952	3028	msedge.exe	125
PID 3028 wrote to memory of 2952	3028	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Pcsszuoor.exe
  "C:\Program Files (x86)\Pcsszuoor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer Automatic Crash Recovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "about:tabs"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8588c188,0x7ffd8588c194,0x7ffd8588c1a0
        5⤵
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,6435167220728013849,6528111959317377485,262144 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
        5⤵
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1009774290217384388,12012029568849639642,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4166414808860390754,17815602912731530484,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
        5⤵
        
        PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,7685222337022037592,2457131671071340872,2097152 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13356846010457291851,4235458329584831512,2097152 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,16930786974809250100,11037212412134943264,2097152 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12501522269708067602,4066280304858513190,2097152 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,18017742723827661170,12262079573480059164,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
        5⤵
        
        PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,5043189175343216699,4389030971940156926,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2418859770537946616,6126729607068617505,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
        5⤵
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13254103038465287018,11763791929459638176,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
        5⤵
        
        PID:1460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13254103038465287018,11763791929459638176,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
        5⤵
        
        PID:3432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,10935010933804695909,5594061751297026051,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
        5⤵
        
        PID:1108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,7306057688444397872,17141116781958926058,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
        5⤵
        
        PID:3340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7537091394683106319,1594983496199241639,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,17659841588397889980,2661219734150737756,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11588332820222476591,6191769970628936135,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,4595499636453099638,16702873506032321655,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,7306709069940389646,6288684748156344899,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        5⤵
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5305944684787532636,12351647152339540509,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,6043404408805276096,8550086393614471207,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
        5⤵
        
        PID:2072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=916,i,6439953301222762640,3054727391884308357,262144 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2720,i,4518298956407752833,2203183490450515154,524288 --field-trial-handle=2472,i,12793817402178422732,10942141438396651785,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
        5⤵
        
        PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""c:\jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe_And xMe.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pcsszuoor.exe

Path C:\Program Files (x86)\Pcsszuoor.exe
Size 42.3MB
SHA256 272883291c93960f5d3916a8ebcf5d7da911b7baece8caf9041bad93d3d16c57
MD5 0ad4caa9d8101fa7f61f13016da7acff
SHA1 9c9c82252c297e96856f8f098067ef0e8995b292
SHA512 35c9fe953e2c879a3e343a60b0d219468e39b4ef6135a94aa600558f36597105d268fdcf2eb7daf6a7d069cfae331777b4d17961a4a51845aadb2dab70adcf42
SSDEEP 393216:FKLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLL:m
TLSH
T194A70223ED10956ED03C91B322F21728BD749F622C750567EB99BDB16E32A305F47A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

082450e9-1b7c-40a9-8afa-d83cf7d93854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\082450e9-1b7c-40a9-8afa-d83cf7d93854.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2527e183-dd6a-47d0-bb0b-54bf91f11890.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2527e183-dd6a-47d0-bb0b-54bf91f11890.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4d2315243cb0c7a1364a4a944da0c585adba380f7bcecb92da0bc26bd5d84958
MD5 1541a57b913ce7e35b14cd0642d1fe95
SHA1 cedd6bc9af4dd697558d699bc38a0eba60124304
SHA512 469ec985fff1341c75a9a5f8445e8f47ff80bdbafd6c0e5b6e6a5c2a7be1e8e8c0e1645c08f1db774bb1194f64d580f58bd1d595a9c5c104a82f11a556b2a199
SSDEEP 96:p5MKUlCglTcmdYeCqgl/OHd8uMNIlgcUqZ7laXIEQycL/Ebf/s4PpB5ugnzg0KHQ:p5lUhemfCn1emwac1fhqsI5u+K6nEj9M
TLSH
T14C91DB84D5CC2686FF88343DE8C8EE596965614C61DD0B43A96CF5B0FD136D3C38688D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0646b33ca4c94e2f3fbcbf19c766eb59af090980b36d9c76c7273ff55e89c0f8
MD5 f90a411eb3d7599d0fa18849af5b7756
SHA1 adc514c57d5d6eb5f362ecd8e4d9bc570e2abecc
SHA512 18ecb81b5f3673683d1d57e39b567d767bdacc54a51d16b813891317f1bb2babae0f52fa647beb5e07eb8dd6821b6d1e24c94aad310b7c423561c41e4bd6e0dd
SSDEEP 96:DcOcyWRzB3lgjhnAjbzBGO5c6itwBHzH/3Ey:DXcL1B3lgjhnAf175c6itkTH/3Ey
TLSH
T11CA1BDF3C3E5822DC91195F0AA186F2BCE190555436C3D5A88E4AF5BA3F24B1E151B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1eaa27c8a210f2aac85659825a639ef7d773679789e80b43dc92e059db923c4a
MD5 041c38f913b215c2ea03fab7ae6fe331
SHA1 b76e11a6bacb418031ef4d95aa808bc14aff7011
SHA512 87caec9bca468650b734e778b98f68e00cb4acb8c7a5f1070177283242164541f32a41f6d3007f764399721038d5f1738735df8d44c6f57c18744e1c11414c5d
SSDEEP 192:sxRkRQx7/fVsg8ZqBHmbQ7oA8pJit3/g6+WNPyIt1/YU2IJRo+GbIgDsBJ:sxRks7/fVsgCqVPmUt3/5KE/MJ6
TLSH
T19C52E909AD24697B8CD7D619FF157F62E6F85032A4945F48A6FCCA1C14E76DE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c5de6d4baa9dc85634976b2021fc01efa14e7764d8428f9918734142c9c400c2
MD5 ea56a5d32fb18641c1b4f3c45ee7c93a
SHA1 583a39f9c82871b8993d5d0d4baa0aae9b8aca5f
SHA512 9d515eadc7d6cee32c7e349503c0c0a79e29b06739bec3a3805c3293b9a3522de063bc6d59a9a172058c30a015c52efc25fc25acc196b7fb8738b2a3aa4f1eff
SSDEEP 192:sxRvRQx7/fVsF8ZqBHmbQ7oA8pJit3/g6+WNPyIt1/YU2IjRo+GbIgVBJ:sxRvs7/fVsFCqVPmUt3/5KE/aJ9
TLSH
T11E52D80AAE28693B4CD7D259BF257F53E6FC5032A4945F48E6FC8A1C14E66DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9e55cdb3cb662ea8bfc00dc11022c113b13202588fe70d83687688f4d00273b7
MD5 b59efc7374771a41373099247845af24
SHA1 e0d3b303479b9a27b0b22b1ac946743f2a9a73ef
SHA512 0575d492212424a9213c8143c7e02c01bedc0910c4dd23cf73c1f24f86578ae61e4b10cadf0e37b39286332c83bea57dc0bac543d0269907f05ce1af8b02170b
SSDEEP 192:sxREQUnkRQx7/fVsg8ZqBHmbQ7oA8pXit3/g6+WNPyIt1/YU2IJRo+GbIgDsBJ:sxR6nks7/fVsgCqVPmyt3/5KE/MJ6
TLSH
T12862D80AAD24693B9CD7D219FF167F63E6F85032A4D45F48E6FC8A1C14E66DE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9ec07496aa70bbbea589a80a45e6b98e08fce8405e42366bd5b698e7e8f3637b
MD5 4a56acceaf317ddc90a7760362c681cc
SHA1 770dae8c856853d677fb64b44d8a3c24e54430e4
SHA512 a7a4d85468300746ae9c149afc51122eea49196e335d69070bd477c60e8e233d576c94cd72066abce8b544bf35f3fc540269384eaf9f7970337b34f5c5c7c81b
SSDEEP 192:sxRkRQx7/fVsM8ZqBHmbQ7oA8pJit3/g6+WNPyIt1/YU2IjRo+GbIgD2BJ:sxRks7/fVsMCqVPmUt3/5KE/aJY
TLSH
T1FC52E80AAE24693B4CD7D219FF657F53E6FC5032A4945F48E6FC8A1C14E66DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3c7aa28ebb835ddd83c4dd7c5d37e339b49f1f6d1554d5a97f6070085aa78bf6
MD5 1ed7f617a5b42542d6f2fe9031d4754c
SHA1 d748426b0d4948e04dded471fabd6518da50e90e
SHA512 83ab601ce3df863a9c5f1d51d7e8f7444e3782ec6b0b851cf05e620f2ede4d7c4531f00f50df35e202753459c14d7e166323abe8bc35382525813dff86c565de
SSDEEP 768:6JajQ+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVG/gomB5roITf:6JajQ+Eb/KWgm0fbbu1jaN/ghByy
TLSH
T111D2C97B740CCB7F4F900ADD98197E9B6DA802CB9698CD8047FE941D02C6BEB91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\index-dir\the-real-index
Size 72B
SHA256 cd456df48a04e19012f334964e37ed37fd5d37e9c89d41cb9ac685e3592d8790
MD5 3985ecc89307127e81b4595620a1bc87
SHA1 c91b8f9560c47ef9543893780dce6e8c6a32ae6c
SHA512 0488ecd198f8eef7c2f2c3077648bb2cd49876a627cda23ed738cbcbdec86754571c62717dd8cc89b4f3842735b71fa177909dfef500a65b7f3d8b7e4de8daf5
TLSH
T1FEA0029023C00129D02255FB15A303812304D8115100135740DD4244DC50446AD4274E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\index-dir\the-real-index
Size 72B
SHA256 7ee4b872db6a4b9f55df76623163728fe47ab0cb542a18ccefcafcafa913e917
MD5 bf77d5b74a5c50a769709c01669793f5
SHA1 cb41f81cdd058a0230d9714642b821957a142521
SHA512 1927fb8c7fbc5a6067f2968aebb6435af2227e7cfb09b4b829b097dff095b88506781cd721f77239c9af53766aa96ef35d84a646268ac0a2da026d80e1ea821e
TLSH
T1A2A0022C528C2921C40212F92A9A1A496311E9140349174FF3905694EC6055B4DD540F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 3KB
SHA256 a76840d4819226a9cc2c8a5b3c22e4d67ea151872a3fece796d0d63fec54aedc
MD5 12718e31155464de449ff6f35ba79eea
SHA1 72cdc810819c7c3d3fcadd2de73d4b631d695014
SHA512 e2d9032c3430ec0f05ded5dd5b57e9acfc3c69ceb485c45b82d10fa3f11627904b88aa232f9e02252eb25a96299b6f1c4447081fb01cd3a451edb285aa6116e5
TLSH
T15651D84F4F025B25CDEC127118B900413379AACC13848A5F10FE5279FDD3F662CC922A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 360B
SHA256 49f8b8b01a6f024ed7934cde48677af95c1422008b3c533fe1c3ada92d7edb22
MD5 ebb0b834b59120a873643924a6b99607
SHA1 94be7cccc8bf1cfec8ef15f69825bb6540d6ab5a
SHA512 fc66591b179eb1052d3151c92828343bbc38204785d095a6b24ae5fc00328f7744ff101ae6dea06f34937df17ad453ffb08205148a34f8d404982c2e5bf0fe78
TLSH
T182E02B4E1E136109EC08597634797465673124DCD340671B64EDC45E4C843A4FE03608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593c25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index~RFe593c25.TMP
Size 360B
SHA256 698cd6de90970b098b70c85d5d640e5f3eba4479d25cd2c179a5766c7ad9cd88
MD5 c3cb3db9f0cf47f47fba960a5b9ec89b
SHA1 ee533756cca7fadf0c903dc3ff2c5c5f385555a0
SHA512 02162ba71208255ad08b69c75b123ee41f4606cf94405509402f0031cf1cc52a8b598497608b3fe5552775f9d44f4de02186e909ee1b3fd7f35330164f6c9d5f
TLSH
T1BBE02B4906339141F90455B63979607562721444E3543A1F61FA909A8CC0B84AE02B08
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 00fed17e4d4a6abfb71e6633d6333552c5bcd12d8225f5780d6e8660b4a7e716
MD5 b33a6255af0a6c2f79fe60fac934958c
SHA1 9ca2840cac4ec548f2ed986fb0c505413b9db93a
SHA512 7f10393fc9c05f987c3eacffd6ffcb860d3f1545492ffbb7cc822d1485376aeb3da230f58564efe6d1b8f37216b48264e0bc03cc267cd7067881cb2af253fcc4
TLSH
T151E0C0FB2DE31800FCDF83E414F344A440457858C4406C4F642D56E390E13543A97C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 79eb658beb99915c69c2a251da824be806bdd667dffbd5f8f9ce9ef2e4d8ab81
MD5 189b91fee1dd898e13a9da071d3e0874
SHA1 a2c8290cc9b2bdd1b037c5bb89d6243a8f6b62db
SHA512 63f78c1d00640a7cfc4e08211a74060a9e248c1e7a7c20d2571b341154e5bb0bac1c19aba3cbca9275f765385dd8963aadcd54cb4179d5373c469dda8130a3e9
TLSH
T1C2A022C0C80FC002F0000E3008AA0000333008EE0008330000C8A0AC8C80000C0C0200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5990ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5990ad.TMP
Size 48B
SHA256 3c87bf26d53ff84ebb498c62c3da13d97ede4433d14fdbe56eee3ea94d828690
MD5 b750cf948f7981dd60d47005be228974
SHA1 731eba967863f4dd2c5afeb4e1cffa78cbbd8498
SHA512 665fedcaef2d5601f769e451907d7094de3afbff6baa1974d95ab402251a0ab493cdec47b63b85c40bfedc0fadbc3e4829274e31f38cf54533f02d90e859e40a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 93dfac2b9f0dbfbc3aa85f9417705c61d2f2039da130b986d08132f5a79b4cd7
MD5 b9597dc21ea91a3660deee2d51f15ba8
SHA1 882033fe62ae32c407c06ce0f4a3d0ade0423a98
SHA512 a7d1155f933e778b998c06ef6dbe036da51d7d34f8f8a245114a460e352b09c575a7d5b95c48002035437defd9ccba8da01cdce7b8e64860d97070396070773e
SSDEEP 48:KMcb6OU+KLT6h6IaWLKVy9ALRcboZCK4yDQv2SgiO/T2lWIaa/KVu9M/RYvo9mVH:K4DGKcoWu3+KIYznGKkc6l
TLSH
T14891161270774210397E350C9590A7BE0742FB633224E63B77EA54925E6BE282CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3543cad8-1259-46df-afcf-a89029119f4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3543cad8-1259-46df-afcf-a89029119f4e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2e1b8ede35d4dbc60fe1e16281a20b3b7f2819217b3257b712eacd59007d0f1c
MD5 4446795c1791b0be357dca7dc5f43409
SHA1 790e65c74a015c2542f2f2c4124084eec5b0c70a
SHA512 169cbabca4d3d91ec217328b6923c9bc0e20b44df29b61e80782d6bcb4f0e0b1f20f148dc8aa41275ed4e4384bf18b5741c79f40cfe773016e27cd6131f57b81
SSDEEP 768:nFHI3GwgZ/ttMt8QE57Y0GZxJsXBdK8ZpPSa7dLKkiQ1U:JI3670/JsXf7zPAQ1U
TLSH
T147037C35DCA1CEB7ACFA97D176057686AEF441B389888ED4DAD99E4D00C35DE0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7916f827dfa1797569df8b9e0436dcec7f0e0051b3d6e36b7473f7f657407850
MD5 837e0b80c241edad9a595c82ba82f397
SHA1 4238f7d681dfb92f10254a41f5e65f9595ed450b
SHA512 a8e81334087b620c42cd8960fe57a52842db375e03e385cf376bdb27bc2282ff3b623f119ab35cb623df3ce8ef5f0dbc4da23df4751b90ecdc86466ff469fbb6
SSDEEP 768:HB3UEKotMt81E57Y0GZxJsXBdK8ZpPSa7dLKkiQ1U:HB3070/JsXf7zPAQ1U
TLSH
T159F2AF30ACA5CEB35CFAD29175097683BEF451F389C84F48DAEA9B0D018369E170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0623df1ccc3c1b3172b853e918216e48e8b41a702d0522616d7f26a2257823d4
MD5 fb32c9e00d03cee199d1aa0fcc7cd84d
SHA1 0bb5b8b0021a33679bdea63669872babfbf3b8a5
SHA512 5c547b1e9ca7378fcfad55af273148da1d767ce7b8c558c240feec679abe5def3288d8d861f65253ecbf9ced50cb70c56d5db6fb599675e17bd6b6d4f2316870
SSDEEP 768:EB3FEKotMt8NE57Y0GZxJsXBdK8ZpPSa7dLKkiQ1U:EB3N70/JsXf7zPAQ1U
TLSH
T101F2AF30ACA5CEB35CFAD29175057687BEF451F389C84F88DAEA9B0D018769E170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6921c6b2e4acc8b7f9bb6992b5daff4f7690c8fc05d25ec20e919a4c3245ffff
MD5 336b02b321e5f4b8137f7bdd66c72cc2
SHA1 06a0b20fc5716fdbfab92b9d2c5986de4bedb2b1
SHA512 341c7548be8618ccf7dc127bb99174f3430834243318633959c6e5c1282aab8cfb7afb66d99126d6feb90babef8f3ccce5c1b79bfc3acdaaeb823bb7c4868702
SSDEEP 768:CB3wEKotMt8NE57Y0GZxJsXBdK8ZpPSa7dLKkiQ1U:CB3A70/JsXf7zPAQ1U
TLSH
T186F2AF30ACA5CEB35CFAD29175057683BEF451F389C84F88DAEA9B0D018769E170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 25313b6885c08a6d09f7709aa23232bd9ebf9686d3920039731aa998b946dc0b
MD5 52ce955cb7387d3ac6b69e3f2ca666ae
SHA1 09e1cebebde1f581c9463b4c48eadd5a0c7de37b
SHA512 d10dc502708a4a94f465c2d532ae6f501a47ab2ac9a6ceb608c7669a0af40bb30b7910050033dfb18f92fece0cf4971cc5fb54a6f034fe6ed18619948c2eb936
SSDEEP 768:A/UxvxjgC+I3xHKotNE57Y0GZxJsXBdK8ltSHUPpMs:tZj3+I3q70/JsXf7PSfs
TLSH
T1C503B034EC909D735DF7A39436097397EEF445B3C5C54EA88AEDAB0D028B26D430395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Exmlrpc.fne

Path C:\Users\Admin\AppData\Local\Temp\E_4\Exmlrpc.fne
Size 72KB
SHA256 cf8e29720823eb114fbc3018569a7296ed3e6fcd6c4897f50c5c6e0e98d0b3f8
MD5 f79ee77a4f30401507e6f54a61598f58
SHA1 7f3ef4945f621ed2880ff5a10a126957b2011a17
SHA512 26ccde784b06c46f60fb5a105c806c4d9dc1497fd79d39728fbcfa869d470ca2ba018b0665f3cbc05019fb0766dac2eb1084a6fdce2f9aaaae881beb09dd3739
SSDEEP 1536:hPlSctRKgITXZwSB6kodysX6Sn6St3wEo:hPl9RKLG86ko5X6Sn6St3w
TLSH
T13C739D51B78180F2C195A17E21F3AB3DA73A960161E69583CF66DCA82C22275FD3634F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dp1.fne

Path C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne
Size 112KB
SHA256 fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
MD5 6d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA1 09c32ca167136a17fd69df8c525ea5ffeca6c534
SHA512 2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
SSDEEP 1536:IxM5MufmW0C3flmskqT0qYvwDr3cFoWPrE:IxMmomWP3fQEFrsFoWT
TLSH
T143B38D52A6C281FFD4A8193D44F75B3A9F3B6116475A8E839718DF947D222106F2338E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krnln.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr
Size 409KB
SHA256 ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f
MD5 c3d354bdf277263b13dca264ec2add9d
SHA1 b428dfd7df0f6024e22838823cc702e2293bd314
SHA512 24c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e
SSDEEP 12288:03kQkFe6NpD9pOIUsJbxbaSvdBz0+IEY:ckt1NN9pnbDmazhJ
TLSH
T1DE94232EA65F5E47C4960772EB1298856239E51721030F8B9AF0B9CD7C3837F3E58836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_1701168537\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe_And xMe.bat

Path \??\c:\jaffacakes118_1c6d5fc40d3bf8f2c4ae2bf57bf572063f39dd2e1e1434fdbbf5fa63c05f6d94.exe_And xMe.bat
Size 274B
SHA256 8bd784264060b4d4b1dfba0eacb9bbbadd8cab8151df3a314f8135b98fddff84
MD5 37f7abbfb52edb9cfaf0f67066a551ed
SHA1 cf9ae61a167f4dc52d916b8a9d22f5b865ce26c5
SHA512 c9f82c0e2f90cfb3d97f7edbf241d241d2a5a48a129f2491ded78b31b242f391675edacd6b9274d1f32e039e272347752f83166c32a18be3e72d66b69aa5f8de
TLSH
T122D02B171242C80AC404C41F0270A90D86010AB536CCBF230D2081E412EF30973837A4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5524-8-0x0000000010128000-0x0000000010129000-memory.dmp

Download

memory/5524-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5524-29-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5524-28-0x0000000010000000-0x0000000010129000-memory.dmp

Download

memory/5524-6-0x0000000010000000-0x0000000010129000-memory.dmp

Download

memory/5524-24-0x0000000002430000-0x000000000244E000-memory.dmp

Download

memory/5908-32-0x00000000020F0000-0x000000000210E000-memory.dmp

Download

memory/5908-533-0x0000000010000000-0x0000000010129000-memory.dmp

Download

memory/5908-331-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5908-278-0x0000000010000000-0x0000000010129000-memory.dmp

Download

memory/5908-20-0x0000000010000000-0x0000000010129000-memory.dmp

Download