Overview
overview
10Static
static
10Test.exe
windows10-2004-x64
7Test.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4Test.exe
windows10-2004-x64
7Test.exe
windows11-21h2-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows10-2004-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2025, 01:06
Behavioral task
behavioral1
Sample
Test.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
Test.exe
Resource
win11-20251015-en
windows11-21h2-x64
26 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20251015-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20251016-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20251015-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
Test.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral10
Sample
Test.exe
Resource
win11-20250619-en
windows11-21h2-x64
23 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win11-20251015-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
vk_swiftshader.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
vk_swiftshader.dll
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
vulkan-1.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
vulkan-1.dll
Resource
win11-20251015-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20251015-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.8MB
- Sample251108-bgh2faat4a
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ja\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\zh_TW\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Fingerprinting msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ko\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\pt_BR\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\fil\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\be\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\gu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\eu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\si\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_473761470\data.txt msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Mu\Fingerprinting msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\fr_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\uk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\de\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\my\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Cryptomining msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ro\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ur\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\hr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ta\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\service_worker_bin_prod.js msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\hy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\zh_HK\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_473761470\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Mu\Content msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Mu\Cryptomining msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Mu\Staging msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ca\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\es\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ka\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\km\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\dasherSettingSchema.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_metadata\verified_contents.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_473761470\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Content msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\offscreendocument.html msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1141245629\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1141245629\typosquatting_list.pb msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\id\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\manifest.fingerprint msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\th\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\fi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\gl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\en_GB\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Entities msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\sw\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\mn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\da\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_459891429\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\hi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\sr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\en\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Advertising msedge.exe File created C:\Program Files\msedge_url_fetcher_2564_1813634102\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_97_1_0.crx msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\ru\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\LICENSE msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_785593849\Sigma\Other msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\el\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\lt\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1006294734\_locales\fa\messages.json msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134070378077449134" msedge.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-756542885-431777018-975678197-1000\{0BFF1809-E0B1-482E-8BAA-8FCBD3AAE859} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 716 msedge.exe 716 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 5540 2564 msedge.exe 85 PID 2564 wrote to memory of 5540 2564 msedge.exe 85 PID 2564 wrote to memory of 5308 2564 msedge.exe 87 PID 2564 wrote to memory of 5308 2564 msedge.exe 87 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 2384 2564 msedge.exe 88 PID 2564 wrote to memory of 1000 2564 msedge.exe 89 PID 2564 wrote to memory of 1000 2564 msedge.exe 89 PID 2564 wrote to memory of 3728 2564 msedge.exe 90 PID 2564 wrote to memory of 3728 2564 msedge.exe 90 PID 2564 wrote to memory of 1000 2564 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffdb159f208,0x7ffdb159f214,0x7ffdb159f2202⤵PID:5540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:32⤵PID:5308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2244,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:82⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3004,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:12⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2996,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3192,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:22⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1604,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:82⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4892,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:82⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:82⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:82⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:82⤵PID:5752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:82⤵PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:82⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5836,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:82⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:82⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:82⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5636,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,463918299179159030,2596475694517518088,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:2440
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2564_1141245629\manifest.json
- Size 118B
- SHA256 b3d4a36078b4bd64177ce86e7ebd70e93c537a50c1f12ae8b9f6dc0f3272db26
- MD5 b1fc4f32c9aa71f679fd0cebc69933d2
- SHA1 c0ed51abd086e3b2379cf7f95ab4d225e17ec7c1
- SHA512 91f71e89796000ff7029825f5256401f8e1f55d048abb4e515cb3994372de7d35269c5bd26f91f1eeacc2f7a861331e8f5c72c0651b07f89a37b7f7a882a76a7
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2564_459891429\deny_domains.list
- Size 12B
- SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
- MD5 085a334bdb7c8e27b7d925a596bfc19a
- SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
- SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2564_459891429\manifest.json
- Size 176B
- SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
- MD5 43c5775bc9bc99578d9a96958edc8864
- SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
- SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping2564_473761470\manifest.json
- Size 53B
- SHA256 6099008680f5d76ff2c21b93b06183b6082f91fd3afd5c8324f82afcf9648a53
- MD5 4101fbac1248b1946a6f67a4e6c1ce14
- SHA1 11a4ae615df907e9e6bcc72c57628992cfec8375
- SHA512 c07b192571c940905db291df91e641aa89e551ac37bd489baf5347eea01a92a21dcf1a8285d73b8d41c40f13584327e5665ccde6eb53dfd23a1dc2bbaedb1ecf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ced387eaa76e6be8d625335b51a1984cb392649a91262901b7fdd38e61c0ce98
- MD5 32f70bf1456b1bd2761eb3d369276bc7
- SHA1 e5020a6506e0ec89c259cd8c9f0d946e164759ba
- SHA512 362083606c719e02fdd1bb699ce3d1ee1bac8150d99845b29c28012b96c9257a7af4891d1cab36bfbde370a98a3fae9dd14ca91a0bba2379d68c5de00d345242
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e5fbdb5a933ed29ac0a1f942e5a943779f540e2dd261256e34acc26a2114d320
- MD5 0817d1c76152927c48d4d409d478673b
- SHA1 6cfbe665f2fbbcc28ad79778545ccefdf8f0fa47
- SHA512 f7ce94290c2fa764ea84048007572e2f401bb591a65b04a0ca2cddc5f8bee523ddfaec3ebe56ecd3ce54777611e5632e8df3fe6884adde4806494e51c48f5b9e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 3daec13b7584e684729943454c8eeee4241d506b8394cf7e5b8e46ba8133f67c
- MD5 05d5483d9dfd837ebf6d71f204efc30e
- SHA1 79af0678e0f482c8fbf8aea2ee74ff06988b17f2
- SHA512 b7bff100ed5e5765d8334de6db5c8bddeb8dad75e78db34ad2304e7508e59de6fd9cab9fb80c4822fd5bc441c1b68887118c74104b203cc692ac274668c7e7c3
- SSDEEP 192:sVtR5yMqv/K1Ml8UQu7AsuIafUZ4jV2QzoZ8pLmHY+WNrY3D3S0QTWIgCMSJ:sVt8qEAsunWW2WaHSrMQu8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 cb9e47c43fca2fa18ee3fdbac038c2eff037a799f44151507941aec008038aa7
- MD5 de3f6800fd3eab29b1b3b5fae8c2be4b
- SHA1 d5fcf7cbc0e703aec9b56760645454910f8b7e4b
- SHA512 2487d732a67ce2ded5667b94b3bd8d62a0bf1c1735e8ed1cdba0d442a63e43b0b1d808fdd8d582d965bfa1111b245f366488534e796b1ad057602db38701e1b6
- SSDEEP 192:sVtR5yMqv/K1Ml8M7AsuIaf6Z4jV2QzoZ8pLmHY+WNrY3DMJS0QTWIgySJ:sVt8jAsun0W2WaHSr1Qul
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 615568d7b2e04b20bc9fc2232058fcad11405eed4f4755535c60bde343ec3c21
- MD5 fc04b5b4e8033b7c3110ea01856f01bf
- SHA1 0c95bba83922b7d066f31d490047db6483da8efd
- SHA512 368e323348c9e2e98cc97606fb0c45e1fb97a5238ba6721a8da7fb53ddee1ede4ac3e9acfa5247387bf5d6c88ab4c8836b0256577b963fe14e608c60c50e2f5a
- SSDEEP 768:BnHxUWap7pLSLbAXWF3RHd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAQ1GLlUS/OnCd:BnHxUWa/4bAXWF3RHdu1jarQ1GLiIOng
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 22KB
- SHA256 62dad62f5afaee6f61a93bedf5dc21f94668b1a7ba45c1342709acdd56e2e9ff
- MD5 c998d1d0313a0e5e13d1039d8983e6a6
- SHA1 3a7dbfefd86544ca35f70ba77dddca3e2ce2c832
- SHA512 5fd4bf8ed4d95fa292eaebc35da57aeec6b80ef25745ec4b0febbc766645df973d0b2ca5fd50eec76b66cd0e7c1659c0c2a87c50f92114c008a3fb3785912e56
- SSDEEP 96:JgKJK/KweV6+gYI22Yf++2KwcceHMHenKhKhEKJ6/K32KtugKANaxNX3nC5vkd9V:/jZ3SKvOMQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4b1577e-9960-4ed3-936d-e530d8f668b9.tmp
- Size 108KB
- SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
- MD5 3692b82273b09514a7212381ba0e0098
- SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
- SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
- SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.17\data.txt
- Size 140KB
- SHA256 27dd78ee466ad514c627b5315dc6806283618b517721e20c680a5eae85bfa087
- MD5 42a86079936750ac5819d88b242a3b57
- SHA1 27b6b4baa864c3ef3dca2118f57f2b9263bb8ce0
- SHA512 513f0c9d1b7d37893a4336e1f3910ea59c1ab21ffe77e1995b9efc26c3a16a09a0bb91292298dc224c5fc2c160519ae93a5b69ef5bf5d225d5a4b32e81d560d8
- SSDEEP 3072:KOmkTNO7NHrMziBxfPURO+/bAipYbzFCSJL+yNxadxI3kX5ONyzsSU2tIYz:K7kMRIziBxfPe/sipYbYByN8dxI365jD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
- Size 460B
- SHA256 d204e6a65bcc8988940d8973671301db11aaa696f54dd53320d1695ddf90e1a1
- MD5 4ccad3d45160382353c4b2fe3ffb700c
- SHA1 c40ebbd7ea95e6cfc5523df2d4192f00d074d1f5
- SHA512 83fa2e859045e0c523e73ccdc7b7d582eb90179cc4529e2af94e5482d61c84b15ea6e83cea0905fc42be909e880b0eebb20ae87c9ae4163ae8069b33951ce7e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 40KB
- SHA256 167804a8c47de53fde553a55195427e07da58a561ce5facd980c4f95f4df12c5
- MD5 4af7f5903ae273a52439c4d39a21b2c9
- SHA1 c85872718d7dee829e542ba4832b8b70ed884335
- SHA512 7f5a92c6f88fc9c1bba4068cbc63dcb6cb3b206ea8e33d35378aaca3858f3bc9627f21c80dd4d9b39a19e0de7cccf7c91c39be59a263a7beb43f45cee183d0b9
- SSDEEP 768:9FqYfJSJLdOuDwLAE3PCgmXazZ3xSeNiqwCYyjSsaO2t:2YfEhOuY3BRNrwOjSxV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 3368b8a2ebb06c0bc492706de9d30c70d6e1dfed63f24e43c168e8f833fcff21
- MD5 d75ed50951d257bcc2c44832575c217d
- SHA1 c98255df0ca3dceed4b0ee6751e3b7642b70d592
- SHA512 489261b1a58bc2d4fce9dd89c1d40f2113f9c933b1ffd92fd77356d5cc0a807bf8caa8c0c17cde85d59b1f909a1cab29a608fc32ba89057b5c3393feb59500a0
- SSDEEP 768:QF5BLv7I5wCPFdV6Zi63ECgjdazZ3xRelmsaO6jW:IJUV6ZL39glmxpjW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 40KB
- SHA256 6a82772fa4fe5bd2777a327a2d4d999e1929b5f352ed6e1237275a26ac40e384
- MD5 4d00f4babb8a74ffef3a0270ecb4bf2b
- SHA1 dc57dc7109ba30edfd3495557113830412388ed7
- SHA512 36f16999eda88aa0cc1a78edb24ebb9d1708022df602e1a21955e0225e08b5bb70e4f6c3ca8738618da8bdab7735848b15815e9274f5ff73f730ba25e171313e
- SSDEEP 768:GFqYfJSJLdOuDwLAR3PCgcXazZ3xxeNiqwCYyjSsaO2t:9YfEhOu13LwNrwOjSxV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
- Size 19KB
- SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
- MD5 3495430eefd1e96e8bd95b67ccab0f91
- SHA1 54129d2d72e062ad36a66922331818e81bd34df3
- SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
- SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
- Size 4KB
- SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
- MD5 db9a3dbc4820c8d84a0a569be1234dc0
- SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
- SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
- SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
- Size 689B
- SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
- MD5 108de320dc5348d3b6af1f06a4374407
- SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
- SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
- Size 4KB
- SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
- MD5 26c006f350f70dbc8c18098b773c3d4c
- SHA1 eb015f7010dd74c874675d0599e634027363b7b4
- SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
- SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
- Size 668B
- SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
- MD5 95aa820d67ec466eb3444a9458eb7e56
- SHA1 f93e178ff40310e071e4d596f0aff0514666f787
- SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
- Size 68KB
- SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
- MD5 478a605d5578236f2d1ddc93c2f22456
- SHA1 917f05453d497b3e3de684a905e141972c34a267
- SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
- SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
- Size 1KB
- SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
- MD5 3d90e5235a4bee8f1dccfc2aecf7c585
- SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
- SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
- Size 754B
- SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
- MD5 1d06d58fe9131c14ba5ba5ff740b020f
- SHA1 e6ed812e23e201b20170e928686a5d612165df85
- SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
- Size 20KB
- SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
- MD5 6959a6835772c67f4e72105e4be259a2
- SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
- SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
- SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
- Size 3KB
- SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
- MD5 e018dfa2df54c80ffbfd02c6d2ff5430
- SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
- SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
- Size 5KB
- SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
- MD5 dee2a727844dd3cea088941e82722406
- SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
- SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
- SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
- Size 32B
- SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
- MD5 4ec1eda0e8a06238ff5bf88569964d59
- SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
- SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
- Size 106KB
- SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
- MD5 751e7cc660220e7464935a9b90643274
- SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
- SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
- SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
- Size 2KB
- SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
- MD5 5330ccc991b45c6f2777d23c7d8afe8d
- SHA1 d11187c035458fe1201608a91062962903de2e53
- SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
- Size 198B
- SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
- MD5 7bb2f4076e4f47781b77d811b21ef1ff
- SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
- SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
- Size 3KB
- SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
- MD5 fbfc314bba2160b09a3376521c762772
- SHA1 3566357486c5d466958334e813c90c0a97bfc985
- SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Staging
- Size 36B
- SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
- MD5 0163de1b14421d4eee3757ff76fd81e4
- SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
- SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.11.7.1\typosquatting_list.pb
- Size 1.4MB
- SHA256 abdbaff563f5c2febc803fc7a59474f74624176975e1dc7a4b83a4d61319d55b
- MD5 cf6b590e3fef95c4b7417422f1558a4d
- SHA1 97d4e116b575dc4df33457755d5268c8ffcc0a40
- SHA512 ef7ced756164735b256f2189faceb19e8137372dc04cd8f3758e78ce8520001909680a95f4497bd45488877e00c374e36139232804ac8c7468ccbb7925bd78d2
- SSDEEP 12288:HynkFFMuO4FGoBzh6NLQMRJxJPsLVrp5B:VZO4FG8h6Nk8nJPK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
- Size 154KB
- SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
- MD5 4ad81f6ccc657d1da582c75c5db037cb
- SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
- SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
- SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 0e928d66028788e69fd6cff1c25fee14226c557b7ab1b430a3793f48c00a393c
- MD5 c4bb302c5fcb70414c6201e127d4ae72
- SHA1 c61afdf737f62d53507b5e928a1162d14634d3ae
- SHA512 5d30dabb6d888038f59eccecad294e977c0101aaa28167baa7d0508fd39cebc81e9044a1a3f95115308c4ec2c663a23c26badc1be7c0bddcd2c04a8313b0cf14
- MD5 SHA1 SHA512