fd2d7cf1a20f422e6210a51464f90a3ec9013e1e19f88ca701dd9190afa65b4a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Hesv.cizl.exe
Size 5.7MB
Sample261018-wft3jaca49
SHA256 fd2d7cf1a20f422e6210a51464f90a3ec9013e1e19f88ca701dd9190afa65b4a
MD5 03de05d0ee229e2238499946baa42193
SHA1 7f474dc9efad044688e6d0d8a202766b9959e6ea
SHA512 8484c0b179633758039fee1486c9a4734fe1077062c7f38237ce33a38b6f4bc3040c78646a4d13d8815fd3444023823a2a056e93d4823e4c3a1ba0f187f5f283
SSDEEP 98304:QHu3l8mnILHAmqOhlJuy2ZCmq2HK+B8SRDJdbLca+hb1oFj6seR8Nrt4t5l1RgJ:mqe0QlJuy2Z7KoxRDJdbLcaaCdva8NZ3
TLSH
T106563361FD618CEFDCF3E3342F1E26808C9FBEDE113458142A25996D2C09AA9D58F653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer macro persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Executes dropped EXE 4 IoCs

pid	Process
4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
4216	tscc.exe
3748	GLB5133.tmp
4644	Excel Edit Formulas Software.exe

Loads dropped DLL 14 IoCs

pid	Process
4680	regsvr32.exe
760	regsvr32.exe
4352	regsvr32.exe
2224	regsvr32.exe
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Excel Edit Formulas Software.exe	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Document created with cracked Office version 2 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

macro

resource	yara_rule
behavioral1/files/0x0007000000024392-782.dat	grizli777_cracked_office
behavioral1/files/0x0007000000024393-783.dat	grizli777_cracked_office

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\~GLH0001.TMP	GLB5133.tmp
File opened for modification	C:\Windows\SysWOW64\tsccvid.dll	GLB5133.tmp
File created	C:\Windows\SysWOW64\temp.000	GLB5133.tmp

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-7UBI5.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\unins000.dat	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-D817V.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-0TQLB.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-5FUJ2.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-K01N9.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Splash\is-DT40M.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Samples\is-V9HNU.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1274662474\manifest.json	msedge.exe
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-16VTI.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Video\is-K7OCT.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-LK1M6.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-ONQ4A.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File opened for modification	C:\Program Files (x86)\Excel Edit Formulas Software\unins000.dat	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_232753539\manifest.json	msedge.exe
File created	C:\Program Files (x86)\Excel Edit Formulas Software\x\is-PDBED.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\Samples\is-JN52M.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_232753539\protocols.json	msedge.exe
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-OUVME.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
File created	C:\Program Files (x86)\Excel Edit Formulas Software\is-QRTMG.tmp	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tscc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Hesv.cizl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLB5133.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Excel Edit Formulas Software.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
904	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4228-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4228-15-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{676B9842-AE6D-46A8-BC77-CEE7D5CE9ED7}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55537751-7F27-46D2-91A1-0442FD6DA0DD}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBEB0398-39C1-424F-9D94-FCA6112260B9}\ = "_DResizer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F855B4B-2201-4526-B914-94EC9D3FE1EF}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80FBEEF1-8A26-4220-9D9D-1D4718DC71E2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ = "ITreeView"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\ = "IImageCombo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}\c.1\ = "Xtreme Suite Controls ActiveX Control 12.1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF87BE9B-8784-4B18-976D-F889C1F8B1E9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F34DDD83-F4CD-42E1-A634-1BC1C1EDBBE6}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DD8FFC2-771D-4652-8C75-7BE414CEA1E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365EA527-D26D-4E8F-A262-4C58C6D2BDB6}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A56F6C0F-BCC7-48A0-B69E-6DD726B9B309}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCC528A8-9479-48D5-A14D-077A9FD5D276}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B99E3549-B654-4763-A103-A3830E7E3B2D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F855B4B-2201-4526-B914-94EC9D3FE1EF}\ToolboxBitmap32\ = "C:\\PROGRA~2\\EXCELE~1\\x\\sblc.ocx, 18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAE5A94F-59EC-4CFF-B0F7-643ADFD7D31E}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365EA527-D26D-4E8F-A262-4C58C6D2BDB6}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\ = "Microsoft Windows Common Controls 6.0 (SP6)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F87BE9B-8784-4B18-976D-F889C1F8B1E9}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0AE5A41-0B8A-4298-8396-81F0F31326CB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53763D01-7EB8-4C71-ADF4-66ECB1275109}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8387AF8E-8EC0-4F4F-A4C3-434CBF7FAA9B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68AD8A8C-492F-4741-AE86-42AF85CDFF1E}\ = "Xtreme HexEdit Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A32CF69C-EBD6-43CB-994E-65A7D67F102A}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D53930EB-7570-4B52-9115-8C8D4F7F4A62}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E8DDC8B-606C-40A3-B6A3-C5661F75BA89}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{137E3C66-1382-4064-B065-E1D64940731C}\Version\ = "12.1"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Excel Edit Formulas Software.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1366A5A0-53F5-436E-8A02-BF292AC38E38}\ = "DataObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1366A5A0-53F5-436E-8A02-BF292AC38E38}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DD8FFC2-771D-4652-8C75-7BE414CEA1E3}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6691B58E-6B74-4685-A640-DCEDF1258C1B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43FEE0C8-5DBA-4B41-9E78-0EB36A1C755E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1935891D-B4E9-45C7-AAF6-EF340E785590}\TypeLib\Version = "c.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCDB9842-AE6D-46A8-BC77-CEE7D5CE9ED7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1990EBD-BA08-44B1-80C9-0F5B4BCE8D3C}\ = "ListViewColumnHeader"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5012C11-D6F7-4A60-BC80-6B4D58112A97}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29DB1167-9C0C-4990-ACAF-627C58E2C7A1}\ProgID\ = "Codejock.TabControl.12.1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCC528A8-9479-48D5-A14D-077A9FD5D276}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A32CF69C-EBD6-43CB-994E-65A7D67F102A}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{773EB7C3-5E6E-455D-B6B8-6052BA5704ED}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\ = "ITab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D0D8FA7-C2DC-4C83-8840-879B3C33E6BD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34C6C5D4-C2E4-43DF-855C-0855AB5A1D7A}\ = "_DTabControlPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0379F6F-AB5E-4C8E-97A7-E02F99ACDA71}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E8DDC8B-606C-40A3-B6A3-C5661F75BA89}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AC310B9-F8DF-45E5-97B9-52003F19A9FD}\Version\ = "12.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1924	vlc.exe
1048	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
3748	GLB5133.tmp
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe
1924	vlc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
4644	Excel Edit Formulas Software.exe
1924	vlc.exe
1924	vlc.exe
1048	EXCEL.EXE
1048	EXCEL.EXE
4644	Excel Edit Formulas Software.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4500	4228	jaffacakes118_Trojan.Win32.Hesv.cizl.exe	85
PID 4500 wrote to memory of 4680	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	95
PID 4500 wrote to memory of 760	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	96
PID 4500 wrote to memory of 4352	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	98
PID 4500 wrote to memory of 2224	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	99
PID 4500 wrote to memory of 4216	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	100
PID 4216 wrote to memory of 3748	4216	tscc.exe	101
PID 4500 wrote to memory of 4644	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	103
PID 4500 wrote to memory of 1924	4500	jaffacakes118_Trojan.Win32.Hesv.cizl.tmp	104
PID 4644 wrote to memory of 2424	4644	Excel Edit Formulas Software.exe	108
PID 2424 wrote to memory of 3320	2424	msedge.exe	110
PID 2424 wrote to memory of 904	2424	msedge.exe	111
PID 2424 wrote to memory of 2288	2424	msedge.exe	112
PID 2424 wrote to memory of 1812	2424	msedge.exe	113
PID 2424 wrote to memory of 2288	2424	msedge.exe	112
PID 2424 wrote to memory of 2288	2424	msedge.exe	112
PID 2424 wrote to memory of 1812	2424	msedge.exe	113
PID 2424 wrote to memory of 3532	2424	msedge.exe	114
PID 2424 wrote to memory of 4736	2424	msedge.exe	115
PID 2424 wrote to memory of 3532	2424	msedge.exe	114
PID 2424 wrote to memory of 3532	2424	msedge.exe	114
PID 2424 wrote to memory of 4736	2424	msedge.exe	115
PID 2424 wrote to memory of 4736	2424	msedge.exe	115
PID 2424 wrote to memory of 3160	2424	msedge.exe	116
PID 2424 wrote to memory of 1720	2424	msedge.exe	117
PID 2424 wrote to memory of 3160	2424	msedge.exe	116
PID 2424 wrote to memory of 3160	2424	msedge.exe	116
PID 2424 wrote to memory of 1720	2424	msedge.exe	117
PID 2424 wrote to memory of 1720	2424	msedge.exe	117
PID 2424 wrote to memory of 3484	2424	msedge.exe	119
PID 2424 wrote to memory of 3484	2424	msedge.exe	119
PID 2424 wrote to memory of 976	2424	msedge.exe	120
PID 2424 wrote to memory of 976	2424	msedge.exe	120
PID 2424 wrote to memory of 976	2424	msedge.exe	120
PID 2424 wrote to memory of 1248	2424	msedge.exe	121
PID 2424 wrote to memory of 1248	2424	msedge.exe	121
PID 2424 wrote to memory of 3636	2424	msedge.exe	123
PID 2424 wrote to memory of 3636	2424	msedge.exe	123
PID 2424 wrote to memory of 4156	2424	msedge.exe	124
PID 2424 wrote to memory of 4156	2424	msedge.exe	124
PID 2424 wrote to memory of 5732	2424	msedge.exe	126
PID 2424 wrote to memory of 5984	2424	msedge.exe	127
PID 2424 wrote to memory of 5984	2424	msedge.exe	127
PID 2424 wrote to memory of 6068	2424	msedge.exe	128
PID 2424 wrote to memory of 6068	2424	msedge.exe	128
PID 2424 wrote to memory of 5248	2424	msedge.exe	129
PID 2424 wrote to memory of 5248	2424	msedge.exe	129
PID 2424 wrote to memory of 5300	2424	msedge.exe	130
PID 2424 wrote to memory of 5300	2424	msedge.exe	130
PID 2424 wrote to memory of 5580	2424	msedge.exe	131
PID 2424 wrote to memory of 5580	2424	msedge.exe	131
PID 2424 wrote to memory of 4688	2424	msedge.exe	133
PID 2424 wrote to memory of 936	2424	msedge.exe	134
PID 2424 wrote to memory of 876	2424	msedge.exe	135
PID 2424 wrote to memory of 5464	2424	msedge.exe	136
PID 2424 wrote to memory of 5464	2424	msedge.exe	136
PID 2424 wrote to memory of 5736	2424	msedge.exe	139
PID 2424 wrote to memory of 5736	2424	msedge.exe	139
PID 2424 wrote to memory of 5248	2424	msedge.exe	140
PID 2424 wrote to memory of 5248	2424	msedge.exe	140
PID 2424 wrote to memory of 5996	2424	msedge.exe	141
PID 2424 wrote to memory of 5996	2424	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\is-HG96H.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HG96H.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp" /SL5="$B0062,5774214,54272,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.cizl.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\Comdlg32.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4680
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\mscomctl.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:760
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\x\sbls.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4352
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Excel Edit Formulas Software\x\sblc.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2224
- - C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe
    "C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe" /s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\GLB5133.tmp
      C:\Users\Admin\AppData\Local\Temp\GLB5133.tmp /s4736 C:\PROGRA~2\EXCELE~1\tscc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3748
- - C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe
    "C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sobolsoft.com/
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7fffa040c188,0x7fffa040c194,0x7fffa040c1a0
        5⤵
        
        PID:3320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,4698323869523248628,4820835696865791721,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3502192071802714262,5125644975398383636,262144 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
        5⤵
        
        PID:2288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,9279893386203091472,8923992196850031560,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3947070473577694038,3686921193452788127,2097152 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,15723724873403220149,14209016342185582769,2097152 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,10902650233579932800,13274639576846606594,2097152 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
        5⤵
        
        PID:3160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,16466760420504148924,231878356400214981,2097152 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:2
        5⤵
        
        PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,13762451973741808302,2138445819486145775,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
        5⤵
        
        PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5248,i,3996081856459873254,9151176742686183193,2097152 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
        5⤵
        
        PID:976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1752630664768998450,382929739556080539,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
        5⤵
        
        PID:1248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,17861572854955968186,3262951504728127614,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
        5⤵
        
        PID:3636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,2147672128895191825,6361466242202549596,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
        5⤵
        
        PID:4156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14733542673166853314,15528243742042763000,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14733542673166853314,15528243742042763000,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        5⤵
        
        PID:5732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16286895184685124432,4170324932048817078,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11128424059846703077,4162211548777390572,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,10534787438741127385,14407385299777907481,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,12125017343967581286,1300900443170687097,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
        5⤵
        
        PID:5300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,17047646889652247271,4176526848781438346,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,13043229620560503697,14659951159158497110,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
        5⤵
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,13613301682303473823,3791466061735130882,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
        5⤵
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,8155442389701262918,10818243996828505491,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
        5⤵
        
        PID:876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,9827286682556684675,17554566643064901661,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
        5⤵
        
        PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,4232414136971189877,808814353144480207,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,6893601853752807733,12984437754950810619,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5603508958710330689,16523251293298947516,524288 --field-trial-handle=2372,i,153063422276599401,7882980850801506635,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
        5⤵
        
        PID:5996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Program Files (x86)\Excel Edit Formulas Software\Video\How To Use Excel Edit Formulas Software - Reduced.avi"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1924

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Comdlg32.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\Comdlg32.ocx
Size 137KB
SHA256 46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
MD5 d76f0eab36f83a31d411aeaf70da7396
SHA1 9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
SHA512 9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
SSDEEP 3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
TLSH
T1B6D31A9273F66222E4B73B302A7A27A06EBABC515D35D50F6710724D0872AD0DE74F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Excel Edit Formulas Software.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\Excel Edit Formulas Software.exe
Size 816KB
SHA256 1b61b8706452d03e3a11bda0d0b4fdfc91ce6d60ae1b20d3c8b23db8a6f67f65
MD5 d815183d047deb472acf863cecf53072
SHA1 027c44d4e6fdf47fa585bdcc34948b891ca7996b
SHA512 127b9b9611cbf9bcfa1f841386dda07700dfea316d1a608ef5169cab72675311774f4c5848065aa22987d2da91e2a03b10ee8e716de57e0b18d970745a85ddf3
SSDEEP 24576:s4SErrqrnrGrrwrrWvrDJPvrDx4SErrqrnrGrrwrr:7
TLSH
T1A505D6A31A6652DAECEC8CBDC53AC57206222D339142467B62D93F2F3BF14C152CB756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HAND-M.CUR

Path C:\Program Files (x86)\Excel Edit Formulas Software\HAND-M.CUR
Size 326B
SHA256 87bfef52971132ff30f7713898a8e729e6f54976eff957e47507f14469455976
MD5 36af4bd3e963bb6d681c3e043c06f504
SHA1 7a1c7a8646f6e47f38dfdd3874ca90c05d52507c
SHA512 6a6a4780b82b5539c6abad1dbd94c562e0e67250639649acbb2079963af8e740a6fd02e5717b61d4b21c5c06d16055e2cb55c052281be4fb706ab625ca8d21c8
TLSH
T109E0CA20B038D081C0C40ABC8A27CA920658AC9F184426022A60BE4F7E383A2AC20024
MD5 SHA1 SHA512 TLSH

Submit Download

sample1.xls

Path C:\Program Files (x86)\Excel Edit Formulas Software\Samples\sample1.xls
Size 16KB
SHA256 2e9f95d1eca9594a3ee17426cb7de2ad335ff0001a7860773eaa983462bf9855
MD5 b4d840a89f475cc73fce70dba60cffea
SHA1 d54b0aeb3f23b3852820b2b2f7bbf3a61dded2a0
SHA512 cf1def89e55e076ac65106d4ceb2912649bf6fab4ddac4b41fea25932ffbc83fe202c25b18b3105d4a59f18ed1111b058db814a36db07728db605780cd560f5a
SSDEEP 384:iI2ETvZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsqlsljl:iqDZ+RwPONXoRjDhIcp0fDlaGGx+cL2O
TLSH
T1DF72BAE7B7D5AC45CD49033548A783A06627FC216BA7978B3389F71A1F72BC08913617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sample2.xls

Path C:\Program Files (x86)\Excel Edit Formulas Software\Samples\sample2.xls
Size 16KB
SHA256 47adf7e9be8676f81f7b2f82bf3cb7578acb95181d473d7d0707f9ff163bb184
MD5 a2ac24bc02c56794e431f793fcc5ac0a
SHA1 c57086c9666b0c79be9541fd7ec1309d2a4b5449
SHA512 5c1db7b5cb3b0f00e1d97fc7afb71a0beabf6fb91fbf14186c094e590cc9c6a086df172381d7861c3be04c7b898332d665b0ca3deb6cb4482416bcc63fb60c0f
SSDEEP 384:Gk2E4uZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsClAlbl:GeVZ+RwPONXoRjDhIcp0fDlaGGx+cL2C
TLSH
T16472BAF7B6D5AC05CD49037548A783A06627FC216BA7978B3389F72A1FB2BC08903557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How To Use Excel Edit Formulas Software - Reduced.avi

Path C:\Program Files (x86)\Excel Edit Formulas Software\Video\How To Use Excel Edit Formulas Software - Reduced.avi
Size 15.8MB
SHA256 8ebfdbf189369aa4b9538a91085933ab82ad1f536277b56bde7ec32e5ac72864
MD5 46ae16a77004e5bf08a3119e3ac5cf5c
SHA1 60b9cd2ff68deaccd5da53e6ca5aba9e0b9285be
SHA512 921b93f8258c21010c4949b25794223076b05b5b6a195385ea601d07612561833f63f06a9d7370d72966c253bc2f5351a95308fd032dfabb54d554139bba33c8
SSDEEP 393216:HttNbJbv5bVbVbvbGbVbVbvbCbVbVbvbKTvgDi2BXUk15POzN:Hz3+gDi2BXUkHPOzN
TLSH
T1DDF6E1BD01A84062CF9A513166AF43D3BA53AF4EF51C2875FDE8BDE0ACB40176179827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon256.gif

Path C:\Program Files (x86)\Excel Edit Formulas Software\icon256.gif
Size 21KB
SHA256 4a94edb4c42c904e072df9f64f67bc1365287a25a901ccd5ee10266753c38010
MD5 25fed95fe961b448a4b878d1941041d4
SHA1 8a40dbca1cc9a00fffd52ac3dd115540ea3c5858
SHA512 a65d02e2f715231ae2f491bdea20b254368a5b28c19337444f0b8618eb7d72e3cc89cea0d11161fc98d686aea23740541666f4ab102c40527ebb2e31eead46ef
SSDEEP 384:gaIOj2D4EQvx9isEjCVHfkncnH15ZbDmmYS4uAK03INyU3TePo2Q0:gapc4EQvisOYkncn5D55ZyU3SPBf
TLSH
T17AA2E12B9E97679F44288219F144A1840076565CB4BC2ABCF1ECC84BDAF55AB13FC7AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscomctl.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\mscomctl.ocx
Size 1.0MB
SHA256 bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
MD5 ecc7d7f0d3446de36045d1d9e964fafe
SHA1 da6b0ec081d628c33b150327f3bd16d3b7fa4729
SHA512 443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
SSDEEP 24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln
TLSH
T101355B0273E58022D1B726B0197B37B5ABB67F619D38E94F1B503A0E2931E81DE35727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tscc.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\tscc.exe
Size 169KB
SHA256 fb049f47abbc559e6eff46ee67ad6836cee7c82cb3559742b75c1774894e01c0
MD5 df94598bfa01136951b4221611af4db5
SHA1 fd1e48c75e6e14dd48590dc5718d4322535b5b7a
SHA512 2a2e3cb2145149b247c98828c8fd5fb72f4eb0b8e173b0ec1ed7b647a32a38ae8c69d07ef12c0e634345371b50e6db333064e75664c837f9a6f11ddd5730b3e9
SSDEEP 3072:zsJ6EJtqNuYDvFebKpjwd87vNP2R2d7BdXvGwB/Z8YhS3jBUC+5QyU1:z4fwJDvFeKBw8v92A7BBfRuuh5QR1
TLSH
T1DC0402670AB13FE2E5586EB00536F219CEF6D7342D90895B0EB01D0E2D256DE6F2660E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\Excel Edit Formulas Software\unins000.exe
Size 698KB
SHA256 c32aefa41d46963eb42ff6a8237a9b97d00c62b2c069ffbe56f5823c29d5d22f
MD5 deaaa6c730560569e4bd295ea7761fbe
SHA1 c989d26041dc3facb39482e7c8c4df27f8c86fbe
SHA512 e6c6a0d359322f99d4b87d894a2cfe34cfff80f77616805dee83c98671d0b1800028a55d21b3b2c3fc5b35c1b3cfb4dec7f8cecd2c6a39d93aa9b366db36a963
SSDEEP 12288:QRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExycb:6ObekYkfohrP337uzHnA6cHswHE/6gUL
TLSH
T168E47C32F2A08837D1B31E789D1B86955936BD103E38A59737E81F4C4F796817A2B3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o.cjs

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\o.cjs
Size 529KB
SHA256 b097cc6db98c456381b1c2f5e4827dde3480c2f0e9561cae81d33d5efd8104ed
MD5 663ce82c52435d68e20910f6a7252725
SHA1 ef6719db6ec6209dd832d0a336ddccef87343a4d
SHA512 86be243024e0c055d13516c8568090f3fc5347fd0d6764be8c64f08c753c1f3cc4db00af5c2746e97c74e2f01292b5bcc855a2b94b8cb95cacfd53dd66b28fa0
SSDEEP 12288:JDN/5k4u34yKisgR4Jfi12XPbbPzNq3dEAPc71j53dEG:xk4u3HJ4qNEh5NEG
TLSH
T172B46E4277EC0059F2FBBB74AEB940719B3BB89EA93DCA1D10D1140E66E296059037F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sblc.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\sblc.ocx
Size 1.7MB
SHA256 0c9e0d800c941ac780c77f105b3cd5641aeed56e40aef1c6e0e26b607a7a899c
MD5 ce01a4dba630802c3b57f5c383f0c418
SHA1 1a6c2f58a0870d3dde64eec668404a328c135fdc
SHA512 479defbb1b7b2b7b389d7dc70c0b902414925243fa55c62efba8ef019459c54074d81dde183f91dc2410a52afba29fb5babf43a3585e5cc57016ec133daa1efb
SSDEEP 24576:l1FVJ77Sr00N2tq0/FyQ/iiKW3ITAgdwBWKYJ1qLbXVLlcFruE6gy:lLFxFPAxTSlBgrppy
TLSH
T100858D11F9DA84F2D60C2634146E7B7A8779DE8ADF148BC7725CFE6D38322D1943224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbls.ocx

Path C:\Program Files (x86)\Excel Edit Formulas Software\x\sbls.ocx
Size 545KB
SHA256 b3d054482d112e595c19a8d10d71d231217b0ca5c209db51e8114f55ea2de8a0
MD5 f5dc31c9f74358c3121eb3b55bc301dd
SHA1 752444e4c78bb1c7e9a3de0b5694e67bdeb25d7c
SHA512 b9d114e5da392db735f1ba63088412c00ec722ca52d4c47f7076b3bb70d58ce394471b703ca77c8c31c7b635804a44060560cd22002c8aac55c121dfc6bed0c0
SSDEEP 12288:DLZSoPM352YYfcGtFx6DHTxvu7BiZ3w43i:XZSt524Gt7oTM7Eg43i
TLSH
T1E2C48D42A69680F2CB9D143915AA773D537D9E8D4B3ADFC39328FE7D18720C2913934A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2424_232753539\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2424_232753539\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

262ad532-c23b-4692-96f6-0de0fc5abb0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\262ad532-c23b-4692-96f6-0de0fc5abb0b.tmp
Size 18KB
SHA256 bd438a839effaec60bf49a852242d1cd25b21eb49ed50b539a22cf04db1fca66
MD5 3099df54b41d3a881296532f87ea3fe8
SHA1 0351e6e1602f4ea9c860f3e01d947a1696fcbb78
SHA512 67982055b9bb026e33905c469c3860c8d546ab1a6f08fa9b569b6324d9f846994a9718b9c5f4f06116b9702ca769fd8961a779eb17c3231279b202b999594ac9
SSDEEP 384:n7RQkUSv0sNjedE0Jjp5u8i0a/nS+MTH7IIlH:7D0rzLk0d+MTbLR
TLSH
T1E0828C742878AC2759E7A515F28B3B539FA840BBEAC40F44E9C9971C01CB2C9270BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3018ad7e-b280-4c9c-8734-67a2d46a9da1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3018ad7e-b280-4c9c-8734-67a2d46a9da1.tmp
Size 8KB
SHA256 c817005eb06f629d02efce9ef8a8da25b6c7a9b07ac428673e575acedc0fa557
MD5 807399801c0c1321d7cd958a2bc6fcb6
SHA1 8e5eb9adfd8d6337917e8119eddf250280a7ab69
SHA512 91d86162a9051cdb9c7d0e332968150da60ff42e3355f13005736d2dad9206a493958bb7bc402651ac3dde9622611e581c40cdfa95bac8fd46da40c8200228e4
SSDEEP 192:SONh6iDCQmiUyI6Hq5u88P0PCiSqWIIIU6:SONh6/4Hq5u8i0ayqIU6
TLSH
T14B02F838AC787CBB9DE3AE15B48B7B179FA4016FEA941B84D9E8161C41D769C1303933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d6af7de-4aa2-46eb-9c98-214a738c37a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d6af7de-4aa2-46eb-9c98-214a738c37a8.tmp
Size 8KB
SHA256 6c1b1656174f1ae3f150c9578237d12e543ce08753518a6a03c10325cfc21823
MD5 bc351aa42a96856fa9041f672d20a6b1
SHA1 0abe544493592bcf4adc4dc4141f3fc6b6a7a167
SHA512 9f556340e2f7d83fbb51b8eb0e46d434a1cd50ad961da3ab802b874d704578317eca9ceb36cc0e1f65b1d9b9b2193fd13fd5fd85d56ef9e3ec8b21f1ef56cb85
SSDEEP 192:iONG6iDnQmiUyx6xq5u88P0PC/WKxuZLqfxU6:iONG6Mtxq5u8i0a/no+U6
TLSH
T17A122A34B878BC2B6DD6A515F4C737539EA811BBDF84AF84E9D8571C01DB2881B0B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69a6dd6a-492c-4eaa-80f8-b9ae3455055e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69a6dd6a-492c-4eaa-80f8-b9ae3455055e.tmp
Size 28KB
SHA256 66f82ca0f4846a2fe1d1242f0af10a43c3b5a8b4454a18d5a95e165738949b22
MD5 1acffcae5314fbefe9e98ada6a11b279
SHA1 4f3f8bcca3c91cd7b633e74a637f92e9ac1604fe
SHA512 2d9dfe413bf46e7372203a4893cddb8ba010fd992cd96154f43618b078dd74e0cc135f9df517cff79205f408830994ea2771dc510aa0cf576fcb7f71c3f0dbce
SSDEEP 384:nytiFzQkUSvWzsN98TUNTUlIlHdE0/jCDf4u5u8i0a/nz+MTH7IIlH:ykFdm8wgv91Uk0S+MTbLR
TLSH
T173D2A3F594E79937E9AE4783A37E3E469EBCC053B5884984FB855D0CCC821BFD606802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81125971-6d42-4b5a-b7a2-1ab383c9f8d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81125971-6d42-4b5a-b7a2-1ab383c9f8d5.tmp
Size 18KB
SHA256 bdd6e289b5a8bd8b3b6554aba483842315cb64946b9c8bc6fa11ee74425aa1eb
MD5 a5a3982d0cc7373b3229f06450c8d7fd
SHA1 9ecd2635de8f5eb65531f986df9f6a2dbb06fda3
SHA512 fb3b698580dc660a5322c8d4dd36938fc1af5ae9ff55bd7d53a988c94441c5ea7b7fd596a5dfe8d89b4bd2a3e1ab141b0003d49a8be74a42616a30823b4ba31d
SSDEEP 384:n6RQkUSv0sNjHdE0Jjp5u8i0a/nS+MTH7IIlH:6D06zLk0d+MTbLR
TLSH
T1A8828D743878AC2759E7A515F28B3757AFA840BBEAC40F44E9C9971C01CB2C92B0BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

361541db-e37a-4d72-b344-35005abcfddc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\361541db-e37a-4d72-b344-35005abcfddc.tmp
Size 10KB
SHA256 4957d25ed78a17120bb3dc4b0e3615a755cd9e122e243479e9f690e4dc464139
MD5 f371b9492d9aa7a1bfe4d39ea95f2569
SHA1 dd9f56f3c6e4180b40e3ffd7b7717abb763f74a7
SHA512 95b82e12ca72b7e2d46a82f2073f071e906ab477df0f5d5e282159845a43b09168e464e159fc18747d6a0966712cecc73895497485e143679bc37dd7c7193e3c
SSDEEP 192:sxZSRjsX/fHsh4bJ0uIdpjYHW6+WNJYF/YaT0jGIg5PJ:sxZS6X/fHs+N0/sHbW/Nj
TLSH
T19732EA51AD38697B8CCBD309BB55BF03E2F95072A1D11E48A6FD961C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a7faa81-84f8-40bc-aa2a-e376a3a3141d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a7faa81-84f8-40bc-aa2a-e376a3a3141d.tmp
Size 10KB
SHA256 f62a2a02e41125cb386cefa044bddc3ffde3c87dbb3b865fee8d05cb307fb623
MD5 141f3388f17432551be4b59d8c92a532
SHA1 7f39b70d887373295b64d0b101995905bde6ebac
SHA512 b4a923b51dbd9aaf6be9f1b778cfc8c2a374e26733b1927ec5a8ba2fa935b5579f771d08af7bd99f65f0b26f71c4135a4ed5ac476c156e9dcd63d810a8ea2acd
SSDEEP 192:sxZSRjsX/fHshDbJ0uIdpjYHW6+WNJYF/YapcjGIg5BJ:sxZS6X/fHspN0/sHbW/bR
TLSH
T11C32E951AE38A97B8CCBD309BB54BF03D2F91072A1D11E48A6FD961C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85b14a4f-d23f-4e16-8322-17ec783e2497.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85b14a4f-d23f-4e16-8322-17ec783e2497.tmp
Size 10KB
SHA256 c0f75d73bf5969b5648bf948bb590be2c2cbfca982e6543d00d2a5cb61e6a812
MD5 79e1e5b7428bbe31db461b360356f98b
SHA1 5500ace908866844edb5773235ddd47ed510d396
SHA512 c769f4169971ead315369f9d3fefbc8223adeef947d1d45705bfaa4a883aa8f59e94f9dc6b6e167393ecb249fd2d1e40314070239602b497ec18c832656fa964
SSDEEP 192:sxZSRjsX/fHslDbJ0uIdpjYHW6+WNJYF/YapcjGIg4J:sxZS6X/fHsNN0/sHbW/bc
TLSH
T11222D8516E38A97B8CCBD309BB54BF13E6F91072A1D11E88A6FD961C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99414859-4474-446d-8d61-694caca9619b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99414859-4474-446d-8d61-694caca9619b.tmp
Size 32KB
SHA256 f4b6a0e7f768090acb73473aba15d5958be34bdb595464f165fc906d94cca1f1
MD5 ab1593c0e7e28c8d4549cf511ad7fb07
SHA1 ae9e95fc480283f7e196d02c1f101542d01d072f
SHA512 9dd26440c4528d790b73c7204279cb06752023e2261c8ed5ff9e6e0bf03e9cc0f309ae8136460c8b556ce918c867172ca1b0ee51ae3396db6afe6ed19d505c1d
SSDEEP 768:30yQRbQ7pLuLjTrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfwXKLlRXH3Aro2:30yQRbcEjTrWvvlpZu1jaSwXKLf33LBg
TLSH
T1B3E2FA7B780CCB7E4FD00E9CDC2A6E9A6DA802CB5698C94447FA945C02C7BEE51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5217cc2882341a43faa6bf47300c0552d2660a4bf3462e31e4042b9696962303
MD5 fd57b2fab7ad0b9cf4410e29cd244692
SHA1 16f56c3e8fc5f7d874e7dd2bbc1e77ebed48998b
SHA512 9efd21ba0945f9b56f451f5d64bf99e23099b3e085a50cb9323e61957e7e2d32a8072892834fac6b08cf44646a375599d6544b469862f09e06b9737abfc161e2
TLSH
T14AE026C685CAC22EA748648B03BC730C93D07B2ADAC0692E1B2CC5C8B505780EE83691
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 39cd37c76d2fd7e63ded92c75d979135c5ce8822e2aee6780d93dd67fabbacc4
MD5 205e6b20cb19bbc09feeaa484fa887bd
SHA1 8014a73ba43912795259775e31d68850dd16c2a0
SHA512 2a471b4d7795d914049c9e6dd641dcaf0dcbc38ab0eda317909220ffa4b94ba07251e666cc8aeba5d8e54a1628e8743b7167ad97b11c0bec3e15e03cf4f61d2a
TLSH
T12451C9B9B2D50495FB5C487089DD2363FEF685807D931E2208A7D8B89CB533DD0E6E48
MD5 SHA1 SHA512 TLSH

Submit Download

6867544f-0f2b-41f0-8405-7a56e6c71f35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6867544f-0f2b-41f0-8405-7a56e6c71f35.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3c0d7bae-4435-4cf6-aa45-62b7770748f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c0d7bae-4435-4cf6-aa45-62b7770748f3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b10ee4b6-bf9e-4a7a-b948-06d9ae0ec7e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b10ee4b6-bf9e-4a7a-b948-06d9ae0ec7e4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e68ffae6-80ba-49ea-a93b-c29ad9251c19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e68ffae6-80ba-49ea-a93b-c29ad9251c19.tmp
Size 3KB
SHA256 2037c8261c6b48934a8533154b90b1bf8c355e52a1a7174d56b1ca3ccfd5eb7e
MD5 64524b21edc486f7877260c62b58242e
SHA1 d225d0751413799f0cf6b224d9bac801044f1168
SHA512 ac04d298619be237ba614235f1eff9f48dd876eed3e9e827b0259955253fcfa21d0166598e2e924d378bc75fd02e43728e22df4108284ae3394b3e2a46c2901a
TLSH
T1A381DFF3C3D9CA1E8D111AF0A7247E1ADF1D0A1982183D5AC8D4EF5B93E3072E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 452a816ecc9fbff260b0cebb59dd3cf29097053dc2424723823f4ece7d9cf717
MD5 d7d1dbaa7ac43f7e05587ad7862eacee
SHA1 2e16c83381eefaf45e76cc4d88940870ee1e9f17
SHA512 db612ee39961d608c310beac7074bea79bc554f7d0ab1993a30b458b731c010d869f41f7ce56063da6e6dc42288f2ce0134b7938773e520c8d8e3f4f26fa38f1
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyL8rKWkmKzb6ZCISOzK9q1IzxsjYhy6k:KA9OKmYiO7WKwcTuAK7q2d
TLSH
T159915F50747B024538BD3A5A81B5866B22823173B45CAAFFBFBC44A19E6FE041DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b074eece-3343-43e4-ac62-04b813f6dbb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b074eece-3343-43e4-ac62-04b813f6dbb7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2daf00c3-0bea-4af4-bd90-21352fe0fbf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2daf00c3-0bea-4af4-bd90-21352fe0fbf9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

2d6d94ab-25f6-4ae9-9d6f-ce975aa46837.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2d6d94ab-25f6-4ae9-9d6f-ce975aa46837.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1a9c8e35-c7c8-4b39-8cdd-4307af671fdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a9c8e35-c7c8-4b39-8cdd-4307af671fdd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 a237d1e0adc994f662561ed42510eaf67b16d3df7fac5dcf4d3bab676be592a3
MD5 fe095386b304e0a8c09ffa6a7df5e9e3
SHA1 b25cd5d0d5a3435e5710ff6d710cd2a213ef71e3
SHA512 6d0420aa44a4d01a291ce451b3fd141071809159e6e859d105198787de47ce317fa45b9c6b780749acf24c9a51075d98156b3811f0e16598ca09c33a23d1373c
TLSH
T193412858AAEE1048B3B36F569BF6B86D887B7D672E06D45D10110E4F4A23A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 a0301de97b45c0461a3953d5ccbb770c724ea624413514bb8bfe96bc2d4bcbf2
MD5 26dd94a5d088cb3d29a8dc1b38407da6
SHA1 cf9bbd183ee389c0d8edeaaf200890ba4383829d
SHA512 13e4aeb4a0c712e9ea29afc7742e0fa981a6d94777a57436f0e49e1e93918c96ccf0ea91faf47b6cf124ea6293620d105911162ff248a050c8b7c666efc6341e
TLSH
T12251585CB9FA1108F3B3BF1A9FF2A5AE857A79732946D05D00010E4F0963A41C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 99d8567f435e8a562792b2a1ff6b7f92de120d3a500aa53cb6c430709ab19237
MD5 c0a45e3d91f3a54fcfbad72d88b66b78
SHA1 f92e13441021d224f1e79efe300bc14145c5f899
SHA512 955aa3b39b2ea903669288bc85177e238864b179d9be29b48a5410d5ec04ccfa56eaa9cee61c2e585659716e6b6b2b7f602fc6ccdf6d1fda1c02f63f82c4fa2f
TLSH
T147412758B6FD0108B3B76F5A9BF6A86D447E79762F06D49E10110D8F0A23A00C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

59487bb9-7aa4-4a48-a8a4-c6d134c31857.tmp

Path C:\Users\Admin\AppData\Local\Temp\59487bb9-7aa4-4a48-a8a4-c6d134c31857.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLB5133.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLB5133.tmp
Size 70KB
SHA256 cee481bc6a15e71f092d92c0e9153a38aa45c2a26c21af42055aca11f304eb0b
MD5 5381ebfc057c1ec9e0469aaeb0ff2a4e
SHA1 66dba95101119fc62f209c30acc56c31a374c857
SHA512 86b0253780c7383dc22ecae79000fb19532d48db4d6af4a2df64151653fb20311a5b1f15b2c1bf238dda9f0a31ebaf13777126f901db6bf0e7fea36ea3296307
SSDEEP 1536:bgiiJZEE8QjsUX2Yq6huJkHYD8QNMYqqleYFjuKfMcXrP3wP1un4:bsJ6EJtqNuYDvFebKpjwdd
TLSH
T18663F11508F0AFA3F5E8AD715A30F01ECDD6D27938208AC71DB52D1E4A2A8985B37723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLC51A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLC51A1.tmp
Size 161KB
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
SSDEEP 3072:5kgzCh4age/BKZ5akmUbe2Rm9+ORsUIlyR6J7ooLGA5:9zCuagOcZ5ak36pTRTvRKGA5
TLSH
T1B2F36D1E7554A23AC9D3843D20745B329BFF99341356A5D3DB209EEA7DE0AC2AD38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLF5404.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLF5404.tmp
Size 10KB
SHA256 166d7156142f3ee09fa69eb617dd22e4fd248aa80a1ac08767db6ad99a2705c1
MD5 3b2e23d259394c701050486e642d14fa
SHA1 4e9661c4ba84400146b80b905f46a0f7ef4d62eb
SHA512 2b792296dffa4e43bc85295dc7691bd29762ce5d9d5eafaa74e199e6a8e5b24aa85d0a1b27776d4719a49b0d29abcf6f240746a209528e608b596b560e5a3b88
SSDEEP 192:GHil+IWcS5ju90M1hfOENXfzZ7kX65caiPEJd3lBD:J+Dcz9fhtflYqcaiPEJB
TLSH
T13D22A40A774149F1E1667674B02A7735E3B99CB442183C0BCB535B3BA976622FC3A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dba14f79-8de9-4133-82b7-23837272c507.tmp

Path C:\Users\Admin\AppData\Local\Temp\dba14f79-8de9-4133-82b7-23837272c507.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

jaffacakes118_Trojan.Win32.Hesv.cizl.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HG96H.tmp\jaffacakes118_Trojan.Win32.Hesv.cizl.tmp
Size 688KB
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
SSDEEP 12288:YRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:yObekYkfohrP337uzHnA6cHswHE/6gU3
TLSH
T130E47C32F2A08837D1B31E789D1B86955936BE103E38A59737E81F4C4F796817A273D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

235af19d-8a91-4b42-ac26-d3211302157e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2424_2130276879\235af19d-8a91-4b42-ac26-d3211302157e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2424_2130276879\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2424_762134810\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 180B
SHA256 27b5c31fdc5a108f69f37330bc7019da7b0a881c72391ff9425888be28a5d552
MD5 7e53c9fac4f9a2e4f6354e45b125a45b
SHA1 9d8e00dba56bae7f2c8a80e132d942326f7771ac
SHA512 7e7e042ebda23d3e9e6e1e510c6cf05e1f0c4db88e14b4982c0248ef9a84f1255590deafb12c688d1eac5212b0aa1760c0248f189f9d66d4d5e9b8ae5cc1481d
TLSH
T1B5C0125D38A21765E6A21396560F225EC963D5908C849061274C421A998041988BA4E6
MD5 SHA1 SHA512 TLSH

Submit Download

Excel Edit Formulas Software.lnk

Path C:\Users\Public\Desktop\Excel Edit Formulas Software.lnk
Size 1KB
SHA256 9dfd88a90ac90724f3700b2c49adf556dadbe6773ec83acf10d252afed752c4c
MD5 02baf00e575bf739e9e2075548599011
SHA1 73ce492674a9efa2d9930d8a2ee54a2626d4de32
SHA512 40716100302c86ffb030f1c3c69841f362e5a6a47f0c77a3962bcf513df21d3d997b341c3d7b580b2b15a530f7efb6403550886caa62202a4c38d2bde9651725
TLSH
T12621C0054BF64725F3B3CA327EF1AA116373B801F6258E6F01C8024D1977A2198A8F6B
MD5 SHA1 SHA512 TLSH

Submit Download

temp.000

Path C:\Windows\SysWOW64\temp.000
Size 100KB
SHA256 90a4fbf97f24e7e29972b97aebcc558c83dddbd68328403b03157d730d009972
MD5 a6d28943a33dc7e717795af68581c624
SHA1 f2617f6cffe12de523f0d61322a3d3986c9b2a5d
SHA512 85908aa3ba92f2788728c8ca0e1f16614ad2fbcef4bae35d7779a70ffa80f2a3c5a57ef7f72a06040daeba98d2f213815c16b385a323664f76e33dfb2a4ec47a
SSDEEP 3072:c3fB0uVjn85lq6Kp8StaVu+a/SFiX/l6K:uBRVjb4ja/SU
TLSH
T14FA37D06F7D081BAD46549BA84EF5B32CB33B5091739CDC736481B5E5D222D09B363D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4228-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/4228-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4500-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-113-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-16-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-13-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4500-275-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/4644-145-0x0000000076740000-0x00000000767BA000-memory.dmp

Download

memory/4644-144-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-143-0x0000000076740000-0x00000000767BA000-memory.dmp

Download

memory/4644-163-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-141-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-156-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-157-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4644-153-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4644-151-0x0000000076740000-0x00000000767BA000-memory.dmp

Download

memory/4644-148-0x0000000074020000-0x0000000074039000-memory.dmp

Download

memory/4644-152-0x0000000076A20000-0x0000000076A45000-memory.dmp

Download

memory/4644-150-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-149-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-142-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-147-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-146-0x0000000076A20000-0x0000000076A45000-memory.dmp

Download

memory/4644-140-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-134-0x0000000076740000-0x00000000767BA000-memory.dmp

Download

memory/4644-154-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-155-0x0000000074020000-0x0000000074039000-memory.dmp

Download

memory/4644-158-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-159-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-161-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-162-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-160-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4644-164-0x0000000076A20000-0x0000000076A45000-memory.dmp

Download

memory/4644-165-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-166-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-167-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-168-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-169-0x0000000073EF0000-0x0000000074014000-memory.dmp

Download

memory/4644-170-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-171-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4644-174-0x0000000076D70000-0x0000000077323000-memory.dmp

Download

memory/4644-175-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-176-0x0000000077C40000-0x0000000077CEF000-memory.dmp

Download

memory/4644-177-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-178-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-179-0x0000000077D00000-0x0000000077DDC000-memory.dmp

Download

memory/4644-180-0x00000000768E0000-0x00000000769C3000-memory.dmp

Download

memory/4644-182-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4644-183-0x0000000076D70000-0x0000000077323000-memory.dmp

Download

memory/4644-184-0x0000000074040000-0x00000000740CD000-memory.dmp

Download

memory/4644-185-0x0000000074020000-0x0000000074039000-memory.dmp

Download

memory/4644-186-0x0000000073EF0000-0x0000000074014000-memory.dmp

Download

memory/4644-187-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-188-0x0000000077C40000-0x0000000077CEF000-memory.dmp

Download

memory/4644-189-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-181-0x0000000075980000-0x00000000759F4000-memory.dmp

Download

memory/4644-173-0x00000000768E0000-0x00000000769C3000-memory.dmp

Download

memory/4644-172-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-135-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4644-136-0x0000000027580000-0x0000000027686000-memory.dmp

Download

memory/4644-137-0x00000000217A0000-0x00000000217C3000-memory.dmp

Download

memory/4644-139-0x0000000076740000-0x00000000767BA000-memory.dmp

Download

memory/4644-138-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

memory/4644-133-0x0000000074540000-0x000000007469D000-memory.dmp

Download

memory/4644-128-0x0000000004420000-0x00000000044A9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads