0dada63854d953b06cb1c17e63c0c8663b2b0a9c4541ba74bd1c7677561e2e65

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
Size 239KB
Sample261014-e18b8af16p
SHA256 0dada63854d953b06cb1c17e63c0c8663b2b0a9c4541ba74bd1c7677561e2e65
MD5 7fb9b44d8c2fe409463991559150c1d4
SHA1 d04c15a9c866f5e9099714ada7305a41551a91a4
SHA512 0d311909fade06dba5d417095a7a35cfc9961031138ddb1ad47ab09818a5f0f5783cf44895060c763856fcbcf2f2d26040837086b87c33e3e912a50d70ba0a84
SSDEEP 3072:qa5hnhThuIc2/8OA58zMssM4HTLzz6pRFtgagtHQ3kGYKVg/JYBRrjVAm10:q0hNL/8OAgMsFiv6BtgZHbGYXwEm6
TLSH
T17634E0163BE08423E8C34A3948E2937AF779FE842A6287077674779B6DB27D55B100CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_809883205\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1890638638\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1890638638\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1675617481\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1675617481\nav_config.json	msedge.exe

Loads dropped DLL 10 IoCs

pid	Process
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
4788	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4776	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{CF9E9099-C251-43D7-AA4E-0FD27BBF6A3F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4788	WMIC.exe
Token: SeSecurityPrivilege	4788	WMIC.exe
Token: SeTakeOwnershipPrivilege	4788	WMIC.exe
Token: SeLoadDriverPrivilege	4788	WMIC.exe
Token: SeSystemProfilePrivilege	4788	WMIC.exe
Token: SeSystemtimePrivilege	4788	WMIC.exe
Token: SeProfSingleProcessPrivilege	4788	WMIC.exe
Token: SeIncBasePriorityPrivilege	4788	WMIC.exe
Token: SeCreatePagefilePrivilege	4788	WMIC.exe
Token: SeBackupPrivilege	4788	WMIC.exe
Token: SeRestorePrivilege	4788	WMIC.exe
Token: SeShutdownPrivilege	4788	WMIC.exe
Token: SeDebugPrivilege	4788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4788	WMIC.exe
Token: SeRemoteShutdownPrivilege	4788	WMIC.exe
Token: SeUndockPrivilege	4788	WMIC.exe
Token: SeManageVolumePrivilege	4788	WMIC.exe
Token: 33	4788	WMIC.exe
Token: 34	4788	WMIC.exe
Token: 35	4788	WMIC.exe
Token: 36	4788	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4788	WMIC.exe
Token: SeSecurityPrivilege	4788	WMIC.exe
Token: SeTakeOwnershipPrivilege	4788	WMIC.exe
Token: SeLoadDriverPrivilege	4788	WMIC.exe
Token: SeSystemProfilePrivilege	4788	WMIC.exe
Token: SeSystemtimePrivilege	4788	WMIC.exe
Token: SeProfSingleProcessPrivilege	4788	WMIC.exe
Token: SeIncBasePriorityPrivilege	4788	WMIC.exe
Token: SeCreatePagefilePrivilege	4788	WMIC.exe
Token: SeBackupPrivilege	4788	WMIC.exe
Token: SeRestorePrivilege	4788	WMIC.exe
Token: SeShutdownPrivilege	4788	WMIC.exe
Token: SeDebugPrivilege	4788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4788	WMIC.exe
Token: SeRemoteShutdownPrivilege	4788	WMIC.exe
Token: SeUndockPrivilege	4788	WMIC.exe
Token: SeManageVolumePrivilege	4788	WMIC.exe
Token: 33	4788	WMIC.exe
Token: 34	4788	WMIC.exe
Token: 35	4788	WMIC.exe
Token: 36	4788	WMIC.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
5972	msedge.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4776	3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe	89
PID 4776 wrote to memory of 4788	4776	cmd.exe	91
PID 3564 wrote to memory of 5972	3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe	93
PID 5972 wrote to memory of 5704	5972	msedge.exe	94
PID 5972 wrote to memory of 4488	5972	msedge.exe	95
PID 5972 wrote to memory of 2680	5972	msedge.exe	96
PID 5972 wrote to memory of 2680	5972	msedge.exe	96
PID 5972 wrote to memory of 2680	5972	msedge.exe	96
PID 5972 wrote to memory of 4668	5972	msedge.exe	97
PID 5972 wrote to memory of 4668	5972	msedge.exe	97
PID 5972 wrote to memory of 1396	5972	msedge.exe	99
PID 5972 wrote to memory of 4168	5972	msedge.exe	100
PID 5972 wrote to memory of 1396	5972	msedge.exe	99
PID 5972 wrote to memory of 1396	5972	msedge.exe	99
PID 5972 wrote to memory of 4168	5972	msedge.exe	100
PID 5972 wrote to memory of 4168	5972	msedge.exe	100
PID 5972 wrote to memory of 5288	5972	msedge.exe	101
PID 5972 wrote to memory of 3476	5972	msedge.exe	102
PID 5972 wrote to memory of 5288	5972	msedge.exe	101
PID 5972 wrote to memory of 5288	5972	msedge.exe	101
PID 5972 wrote to memory of 3476	5972	msedge.exe	102
PID 5972 wrote to memory of 3476	5972	msedge.exe	102
PID 5972 wrote to memory of 2544	5972	msedge.exe	103
PID 5972 wrote to memory of 2544	5972	msedge.exe	103
PID 3564 wrote to memory of 696	3564	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe	105
PID 5972 wrote to memory of 3884	5972	msedge.exe	106
PID 5972 wrote to memory of 3884	5972	msedge.exe	106
PID 5972 wrote to memory of 3884	5972	msedge.exe	106
PID 5972 wrote to memory of 4720	5972	msedge.exe	107
PID 5972 wrote to memory of 4720	5972	msedge.exe	107
PID 5972 wrote to memory of 5684	5972	msedge.exe	108
PID 5972 wrote to memory of 5684	5972	msedge.exe	108
PID 5972 wrote to memory of 5048	5972	msedge.exe	110
PID 5972 wrote to memory of 1996	5972	msedge.exe	111
PID 5972 wrote to memory of 1996	5972	msedge.exe	111
PID 5972 wrote to memory of 2564	5972	msedge.exe	114
PID 5972 wrote to memory of 2564	5972	msedge.exe	114
PID 5972 wrote to memory of 4128	5972	msedge.exe	116
PID 5972 wrote to memory of 4836	5972	msedge.exe	117
PID 5972 wrote to memory of 1524	5972	msedge.exe	118
PID 5972 wrote to memory of 1064	5972	msedge.exe	119
PID 5972 wrote to memory of 1064	5972	msedge.exe	119
PID 5972 wrote to memory of 1916	5972	msedge.exe	123
PID 5972 wrote to memory of 1916	5972	msedge.exe	123
PID 5972 wrote to memory of 4568	5972	msedge.exe	124
PID 5972 wrote to memory of 4568	5972	msedge.exe	124
PID 5972 wrote to memory of 4072	5972	msedge.exe	125
PID 5972 wrote to memory of 4072	5972	msedge.exe	125
PID 5972 wrote to memory of 5196	5972	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Downware.gen.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wmic computersystem get model /format:list
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic computersystem get model /format:list
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freegamer.info/join/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffdea79c188,0x7ffdea79c194,0x7ffdea79c1a0
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,15628513034680571956,14636839216428621533,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,2113912546543563859,2464239871121008057,262144 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,14135498902787452208,11063465489243682911,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,8660604628711958502,3619157709187559579,2097152 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,10394406100723357581,15870453799657077338,2097152 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,15104226029461172924,621380585469541333,2097152 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3528098504020262493,4213468927272843558,2097152 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4024457703035933897,12191618605387025277,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5512,i,9408949630446482290,13203684561401271772,2097152 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12336731283343197963,6404601710803967453,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,13265019352166449657,11071894003213262380,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,10422697794659335691,15336085718012886563,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,10422697794659335691,15336085718012886563,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,583294573202924243,15824934767777270336,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,15217576960447550652,3595261137554992088,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8979181537137752636,6407220478600104782,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,12935993840920624051,6333297423959717407,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,18231537436001627368,13769661382362681684,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9319549673917840980,6113395839058416853,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5525838158143432962,13374729274038000741,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,8234072894191568631,18392203183221816820,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,11110417320979679901,4894982170205010806,524288 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4512,i,1715989990897381024,17925932368894412952,262144 --field-trial-handle=2028,i,16474392274263206223,14744755432812419172,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.freegamer.info/mirrorsofalbion/wait.html
  2⤵
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8059a81e-9460-4caa-98e6-1e1bd402ecc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8059a81e-9460-4caa-98e6-1e1bd402ecc3.tmp
Size 38KB
SHA256 9e21c1326cbf1cd33b7c7ab2383e791887e6ae234a05a83ab7ad128a1eef4834
MD5 1fa79f6fa2171ce7526d3e28e6e5401d
SHA1 fba55b0dba0eb03245d901d297438fae914f6a42
SHA512 0634860d818b993a1442662f358a3a3b09fabc088f09102050ebac4fec9cbbf646716630031fe0a9e5e1434cd0c3ea41b46c43a513cf1a044cc5e9064ffb8766
SSDEEP 768:q/UxvxjgC+93x7wOtNCQ3u5fgGM1TnXMqO/hWAaP8:vZj3+93gscfgt1TnxOEAG8
TLSH
T14903BF35A959AD639CF3D384B21AE3D7AEF154B3C4821DA8C9ED2D0E058735E170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

3cdc3c0d-7e05-44e7-adb2-317ab078cd68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3cdc3c0d-7e05-44e7-adb2-317ab078cd68.tmp
Size 29KB
SHA256 0a7cab29b6162428c59d775fe856765d5bd672964ce3056cfb9dcdf0ada0cbe7
MD5 04bcd1593af87a98bab84a1a40bb6bad
SHA1 6590d241909b1984c680c7ef04c93dbdb6da86be
SHA512 2528233eb36a0ea721631d6458ad12195b1b2e6fa795c4aa33ff967e8a042ccd3d8d19bb50c2da025ccf6282216775bac3d697668cff776a3a9c8b5a60a78c94
SSDEEP 768:UEg+DC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxh+6tyiroqDhdi:UEg+DaEb7uWgf/fXHu1jayh+4y5P
TLSH
T105D2DA7B644CCB7F4FC00A9D9C1A7E9B6DA802CB9698CD4047FE991C02C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3de5392b-c58c-467d-92e3-4b15ece777f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3de5392b-c58c-467d-92e3-4b15ece777f5.tmp
Size 12KB
SHA256 625d91d44111a7847d565af48483d2374753362afa09ec5b4cfb9230f4e2d88a
MD5 8c955dde3e70900f7310bec2f3383a7c
SHA1 a716f7a2a6257889cb00492616751ddea6e730e7
SHA512 1947c9d5d8f6cae4eac9345f047672dac1d1572b22d053d41a65a1b938ba31e20ab6798668eecc948be3055f77ef49b513296368d48b6a1738a94620e9cc764b
SSDEEP 192:sxR0REBCv/fWs8KZnCzoA8pFl+/tr6+WN1Z3fYRIk/3jYGXIgD4VuAJ:sxR0Bv/fWs8cP2/+vfITOuk
TLSH
T17742C915AD28A97B8CCBD31DBB557F53E2F95132A0915E48E6FC8A1C18E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43409e49-2287-485f-a461-576346e38991.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43409e49-2287-485f-a461-576346e38991.tmp
Size 12KB
SHA256 534162bd6809a3c11f0b3d782003bf8327645329aa21420dec54dd312391c6b1
MD5 bd84be4ce579120d99cbec180ec2079c
SHA1 e65ce62f13ee4e2c3e7a59b54f2b2c24d1d06ae7
SHA512 1d8959b6bc5bc772eb24b03cbca071a97a021f3426ecbd3cf25be8af03dbd371388bfbe4656a47ddc66b2c0752258068d5a2583dbfcdd44ae3bb48dc4664050e
SSDEEP 192:sxR0REBCv/fWsHKZnCzoA8pFl+/tr6+WN1Z3fYRIFV3jYGXIgDiVuAJ:sxR0Bv/fWsHcP2/+vfnTYuk
TLSH
T1BB42B815AD28A97B8CCBD319BB557F53E2F95132A0915E48E6FC8A1C18E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58aac224-deea-45e9-a9bd-ef2800b2f823.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58aac224-deea-45e9-a9bd-ef2800b2f823.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3a73032b06a4ada69949668ceeeba503bbb3f26015d362ea4773611940b7c3a6
MD5 31076948ce94acd01968f732fd2b4a7f
SHA1 a89b57146a24048cae85e70e0592031a7c83fb4d
SHA512 4833295165b443152f9087608df05d3b77933738683e35ff241660f7273163e4a33ad79ced58ba2c30e191599dc37428ed84d3676aff39032628cdfe97ae7266
TLSH
T17F61708057943592D7ED52F4D3DB108F3A3869B728973F1007D8EB78A98636EC09E388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c68143ca8d1fcffcc65948f3fc861d5dc5787985695e3d07e6ffd205e0f54c23
MD5 a2f9f9d7a258a6253d5fe75b5ee1653b
SHA1 b59bcf5902e6597a25bdbdcc638390d06031f76e
SHA512 de82d7cd7e1e5768dca7c99785b9fd052467e210a273b4f561fc72d888b98b76a80bef9a7c2e51d31b1c89e2b3436508aa4229fdebdee790024598c70016be47
TLSH
T12961638057943591D7ED52F4D3DB118F3A3869B728973F1007D8EB78A98532DC05E388
MD5 SHA1 SHA512 TLSH

Submit Download

24263f5a-d7fb-4a63-86fd-b0022cae634f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\24263f5a-d7fb-4a63-86fd-b0022cae634f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1da8efc42f832022c8c5b8bea47615763b69d9ae45735cf657c93c8651e9e153
MD5 3b76f15322e3e74dc70956e78e1961df
SHA1 4fcb002310c1dcc5623f723229286856920a9f62
SHA512 501185d6faa0adaa2d7ba553b49940c8bc739a38f38aeb0acc48113fa33bb88d18b92fcde02e4b2644d2e410b0c431e47c394ad641e70a5ef6777affedbf1860
TLSH
T1B441CEF783F4856ECA0156F4AA186E1FCF2C0515432C7C5AC9E4AE2B93E3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

a199fd3b-e17f-4a4e-82f7-27cd5259a2f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a199fd3b-e17f-4a4e-82f7-27cd5259a2f7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f84f6218-7b83-42a2-8e98-452701b7f44c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f84f6218-7b83-42a2-8e98-452701b7f44c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d2547ebd-6632-4917-82e6-eb9e8690c6bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2547ebd-6632-4917-82e6-eb9e8690c6bb.tmp
Size 11KB
SHA256 b105dd35f7cb13217b3634279059f663a74583170fb83c1a89d62f0afdbcaa10
MD5 9e925ea92991d3c7adf6d7a967dd1ced
SHA1 6112c9b8b784a6c77e7d8801b5b331aa4ab0c27c
SHA512 638d2dba331c8f959c5dfcb9d1d4e4fbc4d49eb2e5e7255e4599a81d5f3a19aee709fe5d7caa9c95d32c3a4f0e55d6139854835ac330de37c3e8c76f652a8296
SSDEEP 192:sxRLREBCv/fWsEKZn6zoA8pi/tr6+WNIYRXFV3jYGXIgVVuAJ:sxRLBv/fWsEc3i/+IyTbuk
TLSH
T17432B715AE28A97B8CCBD31DBB557F53D2F95032A0915E48E6FC861C08E76DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

333619ef-530f-4432-9e8e-87467fe7bd4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\333619ef-530f-4432-9e8e-87467fe7bd4b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a5963403-693d-4b62-9e67-3b73378790b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5963403-693d-4b62-9e67-3b73378790b4.tmp
Size 38KB
SHA256 298f7885f3d31a994412899ebddc18ed55683dae4071ec4fc3502e101e70e5d3
MD5 0f795e8b284fc88df90ef85f802afc8c
SHA1 2ad15270ad29bdfd84a26ab63b5dcb8f390156e3
SHA512 2461bd64bd33f74580a68a74af587cadcde57cadc5a4bdd55da8a50a8393928c7b2faf950b7edfd835e1b8f4cbc7ba83a75f27ee14342c93578fc0e1415cc383
SSDEEP 768:q/UxvxjgC+k3KdwOtNCQ385fgGM1TnXMqOahWie:vZj3+k35sCfgt1TnxODie
TLSH
T17003BF31A865AC639CF3E244B31AA3D7AEF144B3D4C22D9C89ED6E0D058735E070B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb5ce8e9-6ade-4ed9-9b04-13d1df3963de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb5ce8e9-6ade-4ed9-9b04-13d1df3963de.tmp
Size 33KB
SHA256 b21f49b9cee2cc6ae87b817f735df9a1deec7320df85db1926a2203bd4820094
MD5 9025333ce2003a09d2cc4f6c16f01c97
SHA1 c1fa0d6f5e52fdd86ce12aea46cc6a601c9a8cf7
SHA512 24b19e9376fb10e8aa95fb3b27f6b86c42a1621263048dcb82e1992aba2a977060cfecbed12b97dd400ab89df67da2f27484cdf144818c3d81e9ce138b5c015e
SSDEEP 768:ct3MR3wOtNCQ3+5fgGM1TnXMqOahWykJx:ct3LsMfgt1TnxODyQx
TLSH
T19DF2BE31A865DD73ACE6E244F206B6922EF191B7E9C51E8CD5ED7E0D048379E070B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd33f880-ae53-4067-b8c2-cbb1b5de9295.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd33f880-ae53-4067-b8c2-cbb1b5de9295.tmp
Size 37KB
SHA256 f07ad27f7e8455046cd39bceac76ed27f6d42850f0375b0be063d35ece449c49
MD5 e4b05e18293d02ae60c5cace727bbd5d
SHA1 cc731a6224462dd36faee28aa38b35ef437289e6
SHA512 ce88f291558f63952f66ae9f3e5b2f0302cedc5ed02f89cb92fd8cb5000aa6c90209a86fc5d0dacf31b4a9de0389dec0eaa5804de7cecca5633a2c60b4fc90a7
SSDEEP 768:5/UxvxjgC+93UBwOtwu5fgGM1TnXMqOe8AaP8:sZj3+93Vcfgt1TnxOPAG8
TLSH
T1AC03CF36AC556C739CF2D384730AA397AEF144A3C5C52EA889EC2D0E069B35D530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c83b0838-3604-4451-be1e-5ff9c6d73080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c83b0838-3604-4451-be1e-5ff9c6d73080.tmp
Size 34KB
SHA256 35670608977c34e30eadfe927b43e16f6dda69e5bc07f7a7b465815053851292
MD5 7dc6d9c42e1085e448a58cba5f6a6c1b
SHA1 912a1f0606199b8e9b45959175204fec1f978562
SHA512 95eefe2b089e70c769dccc6d3771c1a631a774ca6bf85e6f1d4439f5cd276e43f3f76700c5c03aa05f47d17a3fc3153b9922f3a04bf1c70bd72a2a333d9177ff
SSDEEP 768:et3tR3wOtNCQ3U5fgGM1TnXMqOahWykJx:et3qsafgt1TnxODyQx
TLSH
T1CFF2BE31A8659D739CE6E240F206B6926EF191B7E9C51E88D5EDAE0D048379F070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc398306-c010-4b17-b8c1-47e309c5857b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc398306-c010-4b17-b8c1-47e309c5857b.tmp
Size 42KB
SHA256 f7b2d5130eba2b16ad27b2a069600e803d5d6b0548844e1b28c2624ae2394a4f
MD5 4c709e9c3e3e5d7684e7fbc18b3417c6
SHA1 3847867b179fb7e9b8e430bf9460a56888318a8f
SHA512 398abeaebf9050720f7eb7a5ef2510eb1954706db53b05102702a6313b2b1dec03a359c49588872f41e553cde507d3c4781b8b5711317470cd4f23e53abde52c
SSDEEP 768:4FQi3ywgiRVIOtNCQP5fgGM1TnXMqOahWykJx:bi3Qofgt1TnxODyQx
TLSH
T1281328F198D38972E8AE9783A33D6E465DFCC163B5895984B7D85D0DCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f0c7d21-8a28-4251-8659-99febd27a867.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1f0c7d21-8a28-4251-8659-99febd27a867.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

25978628-1db8-4180-8b6b-9ff9e8c6d873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\25978628-1db8-4180-8b6b-9ff9e8c6d873.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7b79e1df-bf5d-40a8-99c1-fff9222f760a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7b79e1df-bf5d-40a8-99c1-fff9222f760a.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1450c26e-a382-44e6-93b0-fff75aef73f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1450c26e-a382-44e6-93b0-fff75aef73f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d55f37cd-f2f2-4da3-8683-ae6a3ce5840c.tmp

Path C:\Users\Admin\AppData\Local\Temp\d55f37cd-f2f2-4da3-8683-ae6a3ce5840c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e6ca98e2-c5ee-4930-b174-2f3e80534bd2.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6ca98e2-c5ee-4930-b174-2f3e80534bd2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ButtonEvent.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\ButtonEvent.dll
Size 4KB
SHA256 d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
MD5 55788069d3fa4e1daf80f3339fa86fe2
SHA1 d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA512 d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
SSDEEP 96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
TLSH
T18D91963717F457AAF49207B6A5B706DB2127BC3057A0D2EF09A219183C206C7AD75F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotifyIcon.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\NotifyIcon.dll
Size 5KB
SHA256 d2b04b5b33877521f6f140148521f219e25d2de753ff20954f90dcee55d1a647
MD5 9ab83d7ef9bd55db63ceb33840431cd5
SHA1 548c54c8b9d683f32b2f1bd8b3f374fc14691fd4
SHA512 5fbceba72421834d5b888818b1fea5f88c518ad871539a3ff1422d4a3e3d6bb945dca1da0839158c446e54cdc5c916e1ca17283b44135d2078bb1188ae142545
SSDEEP 48:aFV2n5RPl5A9+DyhKqfCdGMfMGMoTtmZE+dlpn6sT6lQQAsjRz:s05RP72BCdjUGM4R+dHn6tV
TLSH
T167B16033B2D595B3E36E063AA0D3295BA0758320A3D1045B8E631FD2B691E37DD64F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\System.dll
Size 10KB
SHA256 ef99ac22506e4011523ad4f5f2f212747e8feae35e8a8cca42dece347f2da2c0
MD5 1209356a1e393cacf08ff4cede226b13
SHA1 4bda3a2bb5cea83e19561977373ce79e7a318120
SHA512 99cdb4c0c39456f5c4b09e5093c9d75e250d76ac2adac9bfdddddb6841ea4f1d3e10e7b01368e434c7c4edca173095e007fc3f0907c8f9c6a63802ee5079813a
SSDEEP 192:E4g09uu7tzoKreNh/SlyXMUspRRFtvD4dpWQAXmt2h8oGjXSe0:EpORz202MFmTWQaGT70
TLSH
T121224B6543A0C2F3D944827C1D677A376B78361152F20E93EF7358D0DD1AA827E3A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\inetc.dll
Size 21KB
SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
MD5 d7a3fa6a6c738b4a3c40d5602af20b08
SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
TLSH
T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\nsDialogs.dll
Size 9KB
SHA256 e3875ea6a3cdde76661536ca4e742b843b3215df9bd98195c33022e7529cecde
MD5 0975b6008916c7bea5bb2b5d0e020b8c
SHA1 fec8699abd22d588846130619221f96b0bd69eab
SHA512 61a459d8f08462038efdaee6d9b2134368a4b788e17fb7294699d117cdfb237e17a88f4190ca6f48c7d7c71a010e009fe67e9b7e1b75e6fdefff1bcf160592bb
SSDEEP 192:SoAf1alNDVyAI+MU3MrHH3Km3hgPqjE7x:SoColNQ5WQ6mKPqjE7
TLSH
T1F41209639A40A0F7D5C2223E322E2B1FD7BDA63590776C10C6B74E4674F43976E3A242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4BA6.tmp\nsExec.dll
Size 6KB
SHA256 5d8e75750695b756625ae46ba4302b54808e82790074518b1eafc4411c3fdb0f
MD5 47452b427911d43b8fef70b6ab1d48e7
SHA1 8be26e8222b9ef4c7acd7ea36955571618ad09a3
SHA512 eeb62ce80f6ddff7885ffcfea6f74f08c323b3979bec5c1ac200c24548ac16d5bb4091574cb738008e31245f16e23d6b821c4204e5115127e2ae25f7c81b3a38
SSDEEP 96:Rj6zFERX/tDeB/iYonzmrZursr9d1hhUoPYZ4BzS2oOK3EfVhiI:05ETDeB/lSz+Ars1hWUIz3EfVh
TLSH
T1EBC108BA59D22EE2C60A89F97C31540F47FDC82207650320BBC7A8C668D1F56F836706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5972_865385937\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1675617481\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1890638638\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_809883205\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download