39b8d89f49c86b2a1f876763e3b4666749c85de715aa10aa96a00d5a2d83861a

Resubmissions

21/04/2025, 09:34

250421-ljrrga1rt5 10

21/04/2025, 09:28

250421-lffj2aytdt 7

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SDK/Assemblies/ru/Microsoft.SqlServer.Management.UtilityEnum.xml
Size

156B
MD5

da938c42876ddba8011792eb7df56ad9
SHA1

c60eb8a7871047991a91298c841cbeb54258943e
SHA256

5ba31a46176fb73a065ec88fcad2058ceafff5000af329cd88e61923d5be0817
SHA512

b48b9cc3e04927c7f28dbb27a952d63ded100261d14c4c4bbc35b0dbd677314a5ab5cd1dc7deda2cfbf7d8bee0b1a137525c9bddbfd202e6dff8e68907edcf3c

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1414349110\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_25169017\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_25169017\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1414349110\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_25169017\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_25169017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1414349110\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-de-ch-1901.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1838403194"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31175407"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897013928416366"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{1F5CD183-54D2-4A30-9B64-3BB50C821EE5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 3880	5900	MSOXMLED.EXE	78
PID 5900 wrote to memory of 3880	5900	MSOXMLED.EXE	78
PID 3880 wrote to memory of 5868	3880	iexplore.exe	81
PID 3880 wrote to memory of 5868	3880	iexplore.exe	81
PID 5868 wrote to memory of 5996	5868	msedge.exe	82
PID 5868 wrote to memory of 5996	5868	msedge.exe	82
PID 5868 wrote to memory of 5048	5868	msedge.exe	83
PID 5868 wrote to memory of 5048	5868	msedge.exe	83
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 3336	5868	msedge.exe	85
PID 5868 wrote to memory of 3336	5868	msedge.exe	85
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 5056	5868	msedge.exe	84
PID 5868 wrote to memory of 3336	5868	msedge.exe	85
PID 5868 wrote to memory of 3336	5868	msedge.exe	85
PID 5868 wrote to memory of 3336	5868	msedge.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Management.UtilityEnum.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SDK\Assemblies\ru\Microsoft.SqlServer.Management.UtilityEnum.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/SDK/Assemblies/ru/Microsoft.SqlServer.Management.UtilityEnum.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ff86bc2f208,0x7ff86bc2f214,0x7ff86bc2f220
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1816,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2320,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2260,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4768,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4748,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5908,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2016,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5096,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5172,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5128,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5280,i,10334920910005254667,15134223686982134197,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6bf9cc89-5fab-4b49-b4c7-613d6cf1aae8.tmp

Filesize
17KB

MD5
a9436e52a8e3bbd98a0f71ea6ce66fa1

SHA1
53dc379240f873eb8d60abebd6dcf75d72ed7f23

SHA256
85a62dec4e4bf499eb4d8ae5987eda5388f8e6a7ab47ea4a62bcfeb7a4813361

SHA512
f8129707c96a2fae2fa495d8e711b2d16989cd4fba50eab570d7433f532c581d7f61e90dcbaa99fa03f195d4940090626150a293ca439c26482e4b7ef89cf730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
61a89b923d6c3e1c27ebc78ed61bdbaf

SHA1
16ce6d2f02051d612bf21c9b0e577fb1255f50d6

SHA256
0b459c01ada3d5e04d7b087bb8ab553948a5cb824488964b38a2370f098857d4

SHA512
900e872c3410af00ec39e8c804d3809399ba20dd5d3ecb9b2999e1a5faeb85b0edbf7745e4253c8485618e508a8fc51ff78f69e26daf55e5ae8646f1de8dc10b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f79a3aed3168202c09cef7493a320038

SHA1
a7c98154492e74425849cbbaf4a04c3e116c24a8

SHA256
c56f6449faeeb1fb6b7450988f2fbebacf5ce69f74ee9db92197408b18968a00

SHA512
97ff6c7214ee383f9efb6fe9983bceafdd65d898c3e726d2b8e19fe76124e40ea921c67fb61b5bc7ce4204840d9b165353ec936180132130409f8e186823af2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
0b9d326009dbdf02c46c2d23e8c8e554

SHA1
6c39646036dd0ab779d92876dec7f0d063de4e70

SHA256
af7f6ccadf26c8475034e378e8a72f897907b495d01cb8ca6d7d44ea0c6f878d

SHA512
38af65f92995aea6a294ab383193f37d629d9eb65c76e5c8457a0e3e387d7593ae43e020a04b6dc02d312a502568ff521e7332e58a9d939eb243ff500b2bbf49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
22d2644ecedd95eddd663e8ace870cd6

SHA1
3e7ebe12609311bef920b7662a44ee06f6f9ca17

SHA256
fcffc94da39e20cfd5a368d3b2536b42c6feca6ee5217ed2062124b0a0c71d02

SHA512
fa583a449c5b64ee7c6e4d1ca9db63c25812454e50f2d4693836d34541cb7b4a5676306c8eeeee0e280acb886fc8eea5b55bc76e9ae66bd3896aa20da5d866ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
894B

MD5
6d4e94b8cea85f52eb7e30c8765f7e58

SHA1
47ccb7155810b389e30cdea983ecb97b7698aa7d

SHA256
0eb271569f16623a79cca602387916781ef292be60e4626ea3bb670da26c19c5

SHA512
f3a104655bdc7f83d1fded046b1ccfb6ef56e5b6a4930d90f52a2050db5437dd6259944f0d978a0bb88db8dbc07dde509a58df13158679e18313b0027dfafebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
463B

MD5
eec54b18341a3adaa6d03bfac5e66588

SHA1
25e2424adcddd9b4748d9786daebd5133b742ee7

SHA256
8fad9bf859399afb161361cbae73aa403b5fd82f88a5fe1cf0b29e695504aaf9

SHA512
dfffbaa08c4076823b9bb54788b6ed7581e8e060ecb984331d37e1c3165b0aa15ea8ade3d77d854a0ba1a3138ce83940698addb689a3f35a15b768823dba0aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
b3509b72f1bc96b10dedbeda27042351

SHA1
106e4fa985d5896b5b682c0e9ca25061fc3fbf30

SHA256
a1ffa1aa9bfcb5a13f959cafef4baa01ad44d67dd7ffee4ed792f958f088f6bc

SHA512
52708caf812f21345d7fb676e77e4c5af20f8b996a7e8bdef363dc6314d946ccf52ef1a337c6d08e84cbbb700dab2e94408d92db93d368b24b2006adf5ff5ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
199d02d59f4f4bacc54546265c74269a

SHA1
b68c23830b984cd3619f7893aff1e3ebcfdf40ce

SHA256
f99316c5448719d91c95442817f7424a00b7acdaaac8d3988f9809304550d379

SHA512
27aca321007795893e99494b07dc2d234d66b4a95121edbc5899e8b616f6874b2e77e9626df5a6f959a812dd176989d696e4d754b7318f1b14751d47eac6b02f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
fbe040b245bab84a22487d85800aee7e

SHA1
03005b471f205e4d34044fa3ad699d93cc1a15c4

SHA256
b1632156acf5e4a688d35ceca0c55a1108ecc3b857e705e16d00989f18ac35da

SHA512
55b79f8f8628727a56e2511eaca27d631e18166eee142df0486d9e2dc573bbd8d18dcd0d4fd6816189110bc6d25af427b681f570900dcfa5d46cedd1a832b98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
098d9f01867d081fa6979e8946493ef0

SHA1
827e3f345be07446bf3e49affb64da3647f6fa65

SHA256
3fa62390cf4ed64e8b40b1570970fb71545ab40bbd4bfaf4ece6eee87ab51ecb

SHA512
6fbd7315efb3d6706a26ec275be3f02775844b338f83dad4df46a373f5b055999490866d14cbdf0e08d75eb382cb2da6bc0c231516afab571b5e628ca67ba146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
88c79eb148001ae8cdfb3253cb5849d6

SHA1
04d6f74df699caf0549270a7dcce9efb34692bb4

SHA256
17efbc1ae3ccb8f2fa9f2c7a24d5df4adf114b51904dfb8640f0f3764807a8e1

SHA512
e5ee7da8d2f12aa29736ae0b2ca80e15ade83c65677ea0bfd2b74c465fc2ee1d5559c2720838721a6db62329dfa8742183484147cc88bf78e652d9572c2ab143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.21.1\typosquatting_list.pb

Filesize
623KB

MD5
b5467605f1d5600fe6d540ebbad3c3a7

SHA1
4c52cfde3375a6fee3c1bafc6deecf77015ab154

SHA256
f58fec5a101bcd710e42c4df00fd8064805fbedcab030eddab6b636f9f5efce1

SHA512
0554b2eade8dee9ed85f196530b9f45cb261e1232b3fe1f3c8f9bf584b9b0334f09f7c9d7ad8b9daa776d82bb71093c48e81bdc6fb1f3d7b7991b96875e696f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1414349110\manifest.json

Filesize
118B

MD5
03e6b705075692ba847a04282c612238

SHA1
c49e349819bc7d2ce591fbae49377d11baebc943

SHA256
afd2af664504604698242823a388751ca6e84102ab752716d3bf8b1e5440d24a

SHA512
28920c512a7b0c505b87bb90692ce0188f78f43da487d4dffbbbcc7c05cf853e238ebcc01166a7e56f3d65f2372ff7b10502b8daac472b303529d2db77326a04

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_25169017\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_709323521\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_806726515\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
memory/5900-7-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-13-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-16-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-3-0x00007FF87AA83000-0x00007FF87AA84000-memory.dmp

Filesize
4KB

Download
memory/5900-5-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-0-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-6-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-1-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-4-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-12-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-17-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-14-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-15-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-18-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-2-0x00007FF83AA70000-0x00007FF83AA80000-memory.dmp

Filesize
64KB

Download
memory/5900-8-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-10-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-9-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download
memory/5900-11-0x00007FF87A9E0000-0x00007FF87ABE9000-memory.dmp

Filesize
2.0MB

Download