hxxps://drive[.]google[.]com/file/d/1JJEy9TQaCzyQx4PKMDJ11z8TVzTSMOCB/view?usp=sharing

Resubmissions

13/09/2026, 17:55

260913-whd44a1cme6

18/01/2026, 16:49

260118-vb3cnsa16d6

18/01/2026, 15:41

260118-s49akshs8e7

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1JJEy9TQaCzyQx4PKMDJ11z8TVzTSMOCB/view?usp=sharing
Sample260118-vb3cnsa16d

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com
12	drive.google.com
19	drive.google.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_120345196\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_120345196\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_61529619\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5892_61529619\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134132285973097397"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2912682655-2448277277-4252517302-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2912682655-2448277277-4252517302-1000\{35B65D01-B95B-4568-95EB-590286BB6551}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2912682655-2448277277-4252517302-1000\{993050A3-BC89-494F-BF79-74DFB93D23E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 2244	5892	msedge.exe	84
PID 5892 wrote to memory of 748	5892	msedge.exe	85
PID 5892 wrote to memory of 3580	5892	msedge.exe	86
PID 5892 wrote to memory of 3580	5892	msedge.exe	86
PID 5892 wrote to memory of 3580	5892	msedge.exe	86
PID 5892 wrote to memory of 940	5892	msedge.exe	87
PID 5892 wrote to memory of 940	5892	msedge.exe	87
PID 5892 wrote to memory of 1064	5892	msedge.exe	88
PID 5892 wrote to memory of 1064	5892	msedge.exe	88
PID 5892 wrote to memory of 1584	5892	msedge.exe	89
PID 5892 wrote to memory of 1064	5892	msedge.exe	88
PID 5892 wrote to memory of 1584	5892	msedge.exe	89
PID 5892 wrote to memory of 1584	5892	msedge.exe	89
PID 5892 wrote to memory of 5324	5892	msedge.exe	95
PID 5892 wrote to memory of 5324	5892	msedge.exe	95
PID 5892 wrote to memory of 5324	5892	msedge.exe	95
PID 5892 wrote to memory of 3940	5892	msedge.exe	96
PID 5892 wrote to memory of 3940	5892	msedge.exe	96
PID 5892 wrote to memory of 3940	5892	msedge.exe	96
PID 5892 wrote to memory of 1216	5892	msedge.exe	98
PID 5892 wrote to memory of 2760	5892	msedge.exe	99
PID 5892 wrote to memory of 2760	5892	msedge.exe	99
PID 5892 wrote to memory of 1336	5892	msedge.exe	103
PID 5892 wrote to memory of 1336	5892	msedge.exe	103
PID 5892 wrote to memory of 1988	5892	msedge.exe	104
PID 5892 wrote to memory of 1988	5892	msedge.exe	104
PID 5892 wrote to memory of 2548	5892	msedge.exe	106
PID 5892 wrote to memory of 2268	5892	msedge.exe	120
PID 5892 wrote to memory of 1712	5892	msedge.exe	121
PID 5892 wrote to memory of 4208	5892	msedge.exe	122
PID 5892 wrote to memory of 5988	5892	msedge.exe	130
PID 5892 wrote to memory of 5988	5892	msedge.exe	130
PID 5892 wrote to memory of 4100	5892	msedge.exe	138
PID 5892 wrote to memory of 4100	5892	msedge.exe	138
PID 5892 wrote to memory of 1336	5892	msedge.exe	139
PID 5892 wrote to memory of 1336	5892	msedge.exe	139
PID 5892 wrote to memory of 2748	5892	msedge.exe	140
PID 5892 wrote to memory of 4816	5892	msedge.exe	141
PID 5892 wrote to memory of 4816	5892	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1JJEy9TQaCzyQx4PKMDJ11z8TVzTSMOCB/view?usp=sharing
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffda3a4c188,0x7ffda3a4c194,0x7ffda3a4c1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,10149780497090929560,15573213782923760856,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,10012629369216196145,5331063959226351064,262144 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16398623238187603529,15846155631970577425,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11693555508214230482,2362878211267288819,2097152 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,12432195250793609476,10327933370898495484,2097152 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,5558306352703831673,6661462300924719230,2097152 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5172,i,13224880942649660815,5252042882730018802,2097152 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,2340525438834357053,233561673937151979,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,5068591126285837571,3410513531715081822,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,197447103472211692,402143250485449132,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,8757593581824581886,11737444205587702427,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13289125935027045037,10328808721404758418,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13289125935027045037,10328808721404758418,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,14634559867671201057,207966144169236130,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,15655375018588554625,3840031535331028245,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,13383684829111991338,1615312392691533212,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9962274784719197840,15344130978511174802,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,6339331591135858079,3574998176718374031,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2920,i,9086364507280751420,4073404746393629608,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5808,i,757823183594529135,10262884945480573242,262144 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,3210356652857829042,3916981266195419514,524288 --field-trial-handle=2268,i,548613143112729320,14048108636900297087,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5892_120345196\data.txt
Size 143KB
SHA256 4edfdb9cade0be665696dea609332ae299080986e7adee23432a7012f107851f
MD5 695d1e0603e2d8d001b7b604580bba26
SHA1 796e01101b9596a88c2e12ed2b7406d874df7c43
SHA512 91865dc3f65a7c722207fa8e1e442fb637c49b9d0160e885b58fd4afb2cdcddf0f8ca516c6a1d9aafa00ff8ce5b5a91f122f46dcba264e35753b8daf39d3749e
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEnGA3iqS5Wt8y:YX1aI5aZoKzMJ07NnGk1
TLSH
T1E5E3F150CA841F9CDFAC261C50FE0F1DB3D0C79D852B658AEB63BE4A6F4AA0457274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5892_120345196\manifest.json
Size 52B
SHA256 dcedd46fab398b40ecea0160d44a5140286672ecd6e70b7d63a675de3e0030e6
MD5 4100dc4a7cbcbfb95078f35006d88b85
SHA1 5ade230ac8f36d89b8ff3db7d7ed94175313b460
SHA512 ed02ff06ab9d94e287da52d034ff547094f073cb7e969f532840e0e8b91896f80e826264fd33b3a4bbe9c73fd085d4541265eebd11d56c83e21e8cdeea911708
TLSH
T11D900260042495571AC10E906574F8959391661A55850D1E0445154802D546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5892_61529619\manifest.json
Size 118B
SHA256 03b7f4d951c8d00b3fa33a3f477d9052d840d8e4e4fd4259cdc6f942d23fee38
MD5 0e3ffcc8a32c74b8d919c2668235430a
SHA1 53616b608690584a4ceaade73b08bada60b74a12
SHA512 69b1c9286987f4be09a244d5ff862d3dde816fc7721baa17a06e19d52f9a80d4c572a270ca14ef4c04af35e2544cc7d316650f0f5c1e765dd3fac0f7c85a0de0
TLSH
T152B092B00C0AA03B22C09360ECA1A6C287F80228E8062B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5892_678881848\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da093a0aaebd90b8de65f38db0b2f09fe8f58aec59928a3ccd381005879bfc43
MD5 01effb39f2d6a817f735efce357bf670
SHA1 9ff86c33e4062d1d093d9aa56126036e7bdd667a
SHA512 f54a1c3cca0dc0d3b8caab0178768f060758287705331ebd1569dc3b00bb270348ab9557b2f7043dff19aefb2eecb5a928783bd1aaabd91b22395b4c34886e5e
TLSH
T166D0809813045D56C69515F441CA5F2435CDC51D4047D741757BD5441C457F3218749C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38df9decb242ae75792f6a44ff8d29e3e4c964db9ea0704e21f3c42b9d78b13c
MD5 ab1d12a8afd2fbe91c62e15b488e3314
SHA1 799c9df7695b2fc24d4f1ebffe3e630515b429a5
SHA512 08709a1a04c2f3e22c7683583441b6d561a62c86bf4893ca857896516183cfbdaca6e675d885c16646e1c2043d1f18c5f8a5c0a7fdb1781c9556905599cbb865
TLSH
T18BD08CA817009D66CA8526F482CA6F283ADDC52E8047E74175BBE9582C85BF321878AC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 912f3ae9320aa049e3fc8b9d77fc9eb11fb5dee71dc590c46f5fe172656ef1a8
MD5 f5c54f5618f7f0faa3c2cee98d527c97
SHA1 cb370b728da08ec2e19553e7a4df48964e5ac127
SHA512 58df8e9d7df8c3e44ca6fc9870dd5a6ccc9ee15f3f40fb13df3d809a7c1345900e2e594b7c87e860f835f465da62932aa61822c8fff05c89aac01c931fd2ee0c
TLSH
T130F02DB5DD21FC3708FD172921A55B4AFB5013172640599F3B3D810D8FB1A3BC58581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b49d25cc2bb911522e7d382b97388a825f59a5f82b72cfdc197fb5a792918f3a
MD5 143af6664814d67dde51e22adcba7d4a
SHA1 9c36c48f95b872be465fb6906acfa6b55179d375
SHA512 b3b951a8f44972d4afd9882063035ca9a2f808d33436325da66b4eba2f14adc6244ae0f0b41800c1788de7ac7fafc65f4c958b9862913034d522464cf3465c81
TLSH
T1B751FBAF4D499628FB9F1971899110047078B848F9A33E2E3DCC63F8A55FB46011F774
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57e07d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e07d.TMP
Size 2KB
SHA256 219517ac90b5a14d3bbb917237ccbd04ba5a82b323cfae39049227880fbcdcad
MD5 400bc8747ab9905d40d55d640bc4b764
SHA1 145c8cce802007d4af4662db5b440ac9d3b1359c
SHA512 4b46924ad9761cd625b62731905af6e17a5bbebc79394529920f3ffed9c72563efcf6f7f461875a30de6049e6c34ae65b8b4c09be698c65f464bd1b77b20d5aa
TLSH
T16D411A2F4D821224FB9F293296D11004B170FC54D9373D223EDDA5F8E98FF164A18AB9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 847230079c4f31d8b0f45ec9ef4056e96526915113bfa72e437827a8f93d189e
MD5 cf81476379c2bc8c757420ff3c8b4286
SHA1 6a388d823e69a3f1b2136b2334a156fe7b0f5804
SHA512 6a9f1034bffbf665ac4d61425d47d1d8c46ee86b09229eb28c7c2e051faf6a349ee9af3c32e58109af5b497ed79d1e3a70d4db63d33dca0b4c9fac053908542c
SSDEEP 192:D1J7BxCcwawEfc/2ctJCj6a8aCFlkp29r2pFb74QLTl:D1J7BxCcwawEfc/2ctJCGa8aCFlkp29S
TLSH
T1C5029EF3C3DCC96D894155F4A715AF1ECE690A14432C3D6EC4E8AE0BD3E2871D219A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 df1d1f7235b681766f1f7e97a9be76c13448ca6ec5ed5f80c7670768e15d3640
MD5 664dba750f5baf41cad2e0cc94a2ad45
SHA1 81530c78a5fb44a6fe7483599bdee2f2b8f7f998
SHA512 268fc3f54bf48c60cdd47efa63a5334186cc85de16dfc439ca9d05618b65008abfb94a312191b601bc73be4909c1bf53ad2ee318c8ee54903fdbdc3869d2274e
SSDEEP 192:D1J7BxCCvwawEfc/2ctJCj6a8aCFlkp29r2pFb7LFBca:D1J7BxCCvwawEfc/2ctJCGa8aCFlkp2O
TLSH
T1FB029FF3C3DCC96D894155F4A715AF1ECE690A14432C3D6EC4E8AE0BD3E2871D219A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7c3c4b38a3b3e348532e05a9f5649f8807e9d41bd138a303f8b71afefd7c63db
MD5 e5cf133faea69adae6800a052ef1db60
SHA1 5f1baad39f4fd805cba196b5b3b821ddfdbaec89
SHA512 77beb9392f00e7f0a6c7a7d672c3478f4b1ae106d1f5adb9f2166bf0efd769674d3a0817e8e63b6011558c0d33318eb655c88b192228b39f6c072ec1e5686a28
SSDEEP 192:sxZGRwyMqZ/K1Ml8UQG7S/fDsQfG152TsKJEd1zodpp+HW6+WNyTn/Yp2kJCIg5x:sxZGFqMS/fDsSG3KsKJEdeYHbC/1Flf
TLSH
T1217209156A38597BCCD7D309FA457B53E6F95532D1805E88AAFCCE0C00E6AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7f3d4b9f6cdf39e9098c3b59dbaeeae84e58359851b41e5269cddb8d291b0752
MD5 16e248e34b86ab0506ceede0bb974242
SHA1 6b7e75ad0a69a6a7616f16908134fc0e07c4314d
SHA512 74bbc0c4003cc4407e6fa9b8cbe69dd9b79c2ea71b37340240e5b51763eb26405b776a65b750cbb4385dc01d7822f5628538c18f5313c6dabb02ab753394b7d5
SSDEEP 192:sxZGRwyMqZ/K1Ml8M7S/fDsMff152TsKJEd1zodpp+HW6+WNyTn/Yp2mJCIgjl9J:sxZGFjS/fDsef3KsKJEdeYHbC/jjlH
TLSH
T10572F9156A38597BCCD7D309BA457B53E7F95533D1805E48AAFCCA0C00E6AED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 33f5d8930f7be4a9c495cb6efe804e51aabd5a277a75ec403f9c78b6554c4cc1
MD5 d1c80b4f24a6ca0d01c96f3a5a0b2751
SHA1 83db0851d1506c97a9368936c0b9393a48fea6d4
SHA512 fe3aad7b346fbc5f52c438451eb70ffcf01f7a06729ce98fe3b062e361f72b94f00cc0905555a3ecc6806da80dcfff93561da6fc84f224cd5bb3bf25b2ce3c54
SSDEEP 768:SqslkVQ7pLuLr0QWv8YT08F1+UoAYDCx9Tuqh0VfUC9xbog/OVHcs/LlTVEBGro+:SqslkVcEgQWv8YT0u1jaecs/Lt2B9B4b
TLSH
T134F20B3F2C0CCB7E4F844E9CED2A7E8A6DE8028B56988D5447FA444C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 8c6630593ea29cb05fa360f8f1218e0ebf2b91200533295a1e0394aa6358ecc3
MD5 6c340bcb5af0b99c23025778712e3e2e
SHA1 720e5792ca7d592612cf26e3f5d542e038fca594
SHA512 729bfe9dcfc0baded90d81d6bb8f84e4bbaaa3fa795150b52b4946e1418bc065821dbac1c3e9756388fc1a632f4d400d4bd9f826233461e9533a0f001edc3688
TLSH
T1D3B00191840A3047C8A10AB466DA64D837389E969A022A8594A1B9AAAD5A35092A529D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 242a51ec2252316a6d740b4c7599de5746e5b63eac1383498a6a49b4cdd792a1
MD5 be465c7c0d2ad98cddd033586900affb
SHA1 0e09f48a2058962adf6f74025dd7657296d88a2f
SHA512 dfc3c69bff3f3e6db991cf64193eee0b9f6190633ae8ecc8af3b15377aa06fd2122d7d1796cee53636507a595db5e446a2dec3a5f7c74fc6afe330f190dcd39a
SSDEEP 192:Ibo9A5MgiKKva7wAAOeroATOjGbsY+oc3sJYg2AylGOB0c4EGbsY+oc3sJYg2Ayg:tHST39RlURYL/rBzFkX349Xq
TLSH
T187B27951711E02C43C7E698A99A9801F934211E32130ED3B7AF984E64E67EB85DFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 90B
SHA256 e9cf04bb9efe08c5d949188f7d07c1003209bd4decd95895fd60fdec80b356b5
MD5 ad4845e49f7c87b0d1900f13ff8fe80b
SHA1 dddcb82be4e688ee54f666114ead955e23f3cbca
SHA512 74169b9c4255bc514d834b2c3f4f1ac453c8bd89466718a8682b35cebdcea4b6617b34ba96db7d887657875efbc231f896ff2d90eace7367fc7f4777b6b8f469
TLSH
T1B7B002FB650C405A8A2599F50040341ED552414C0CD48AFC8830516651AC77600465A1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe577fa0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe577fa0.TMP
Size 174B
SHA256 bff9929d2af8748c67adcd31fe9d3f796667c0e1f11a5139e72d96706433802d
MD5 caf08cf5af502c179097b05d25a7d1c0
SHA1 e047e5d085943992c8b37128435cea7f932f77b8
SHA512 98902a34f0b84b207090dadbe39f75c5be21d0f360abf22ca98a965849449a170c59d133664c9c224d566a59fd2a7cb6eb139a7c737c7e55b6319b920b5d6e71
TLSH
T1C3C08CEBA62DA8668B24DAF40800341D81218D0C1CC089FCDC24F5A361BC362414B6A2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f9b5357d-f0b4-4364-8430-b1eef0ecfff3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9b5357d-f0b4-4364-8430-b1eef0ecfff3.tmp
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
TLSH
T196B35227D6A54C6B01F16264EC794382F325436F9282A82F3A7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1434075cff6f1ef1cad9ff0c8a8f2c1c05cf39c2ed3d14515c7907000273b057
MD5 fe5a5812aca02bef3bde9f17dd67291a
SHA1 937baf8a628eb9886a78c7c6b47605fbd13bb504
SHA512 bc43e09ce86d450cfeb6575a4b246c33d0561c420091d3b405077a83dc52c81c8a9e2085aae8e78622429394cd47091b9b82c8c3db2af8b04a6f74654b974aa0
SSDEEP 384:nLiFavqMg3sNN8TUNTUlIm23ImbNs/UQvfKYFxnKyt02uD3BLGbgcxatk0vI+31:mFayv34wgiMpYLnKytizdG/yt1
TLSH
T143C26C75AC68DAABFCEA8FD9A7097A43EEE40163D58C4AC4DAC81D0D10971ED1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c98f69b8d55ac12d84e47ef10fd63c3ccc75b91a93771127c53e6991a47c0c47
MD5 cd2504da97d58632b05e4d1d75ef4689
SHA1 82d4a5ea7cf7c2c942ff8e9031db224ea2673689
SHA512 6b7e7813f3ad39d98c414b79d23dc6f724494c753a7414554ac80a9afe5e5e2e770987274a96134939a566609d00a457df640403b79f371c303a144b04fefe0e
SSDEEP 384:nviFavqMl3sNE8TUNTUlI4x3ImbF7vUQvfKYFxnjIpuT+U2jd+AAhS34Decxatki:6Fay+3BwgicpYLnjIWr2jd1AhA4ByX3
TLSH
T15AD24B71EC68DEABAEE79FD5EB0A7A43AEE00167D48C4AD8D9C84D0D00D719D2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cfdcf476275f6b4618ab5731de66ceed8d87ba9a845dfa198ab3963fd9aa4e91
MD5 f51a66796c4f30f6a75507294df6e5cf
SHA1 7aa65a2e1d6e97c78c8359b26bd09687723ec988
SHA512 ca44ac47c6c99c09874bb06a1b5643187886b5c6e520c385dc2430ed38beacb8b76179ddfdca0afe8f4cf211abde13ba79105319461b2736974d343ce51253d1
SSDEEP 384:neiFavqMl3sNE8TUNTUlI4x3ImbP7vUQvfKYFxnjIpuT+U2jd+AAhS34Decxatki:1Fay+3Bwg4cpYLnjIWr2jd1AhA4ByX3
TLSH
T1CED24B71EC68DEABAEE79FD5EB0A3A43AEE00167D48C4AD8D9C80D0D00D759D2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5f7a70eb4911904bc9c4c72b8922e35930c01edcc1c3943f5e86207fbf8fd3d1
MD5 1ea11049e10315e0d75d4c81c7e1e855
SHA1 9a77ff8bc90b0922d955d92ad57ba37d7e894a73
SHA512 11247bb2fd412702bade75e9ebab0ebea481ce16e7125805ad4e2445fcb3f3452381ff4f4fa2b5e07a0d255d29f34689e46eb126dd6c7f63f087b3096a04206d
SSDEEP 384:n9iFavqMDt3sNE8TUNTUlI4x3ImbPJvUQvfKYFxnjIpuT+UEjd+AAhS34Decxatn:0Fayy3BwgqcpYLnjIWrEjd1AhA4ByX3
TLSH
T1EBF292F198E79976E99E9B87A73D2E02AEBCC153B4884584F7C40D0DCC961BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.1.18.1\typosquatting_list.pb
Size 1.5MB
SHA256 052a5ba554eea93f8d7bddd205b4a26f874b0ade4e068225ebf6bf023acc2668
MD5 fb92aaec00e18c38d1332c82704bb542
SHA1 2bf96d109bd9980aaec0466bf5574412a9370199
SHA512 ee15cfd3417ed506e8f38986f1677847dbae3d9adc154ab5db3d912bbcd529712a2f61a1f03eff7340ac67a0aad2bef4ff85e8fe95c9f72594e0a0e17f9090df
SSDEEP 12288:y+PxxpPFDQb3F8qIkGoMhqjyp7A+Ym4NoqEESo0+3Jcf:fPtKiqIkG+jyp55AEE6
TLSH
T1CB65B4B9DFC00185DBB8112D20BF71D8181412A180E9DFEAFE7C85DF2B8598977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 598523bb4ec5affd8b35d2b88a06a5f40161bde1ad41ab23a085c4cd6967e5f0
MD5 7b39e2c5483fa3c54f078ba96c4e8257
SHA1 b593cecee61f95126b663580c586aa868e9df3c5
SHA512 edd583b41ccb1b24073da2ae6f942fee458072b16d9174e57b169a362ad02d56323a9d63007f04ffcad6d8402034cf6cd37236e3b1eb26f7352aa7aa5534f0b4
TLSH
T18B411EE18D3E26E1D4FD0D7E64573CFC91D8D326F4A8713C6464EA88463AA1EA44143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c44aa28e6691cccd18bda26700fcc75966cc5070e4daf4a38e3c83f9bcc0e4b0
MD5 4a541e7949c98f8937f79d6cb9ce3e31
SHA1 324bf6a950d305e9b3243ef4cd66762aaa4b7e48
SHA512 e0bdabea3efc7340de829f014db56c1288ba243f8f335a9e658c7334c57c0be118765aa96a0c176fca20e111585012205ac246c50b185c0fd5f0b18cce52dacf
TLSH
T1114120D14D3E26E1D4FD0E2EA4573CFC91DCC326F4A8707D6828EA88063AA1E644002F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2241ffa4c2e730ebd4e16ade1221aecb46e735cff8650b0dde1fad77703f1268
MD5 9e64c2ec3a8a6e85d4b259c4682429db
SHA1 837ce160e949654402a39e6fc4f9bf2b82fd187c
SHA512 576da9f78a8b58ed87f84fd9d46e7d3e546edbdcef53a4047de990ccb8e8d3dad9e004d6a4da1cfeb956d1d56975dde333b0d009c2a72bc771320ff0c52014d7
TLSH
T19F4130E14D3D26E0D4FD0E6EA4573CFC91DCC326F4B870786824EA98063AA1E644003F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa4be354351bf28870c49c4ef147265fd79772480f20330ede4cc8f400c4b993
MD5 84b4129a31eb5c9231810f9226953704
SHA1 636f5b0558584371491cc46cd0c6a0302274e538
SHA512 b1b2d015d7c1668c88d298dbb7f290ea1f20127148ba21a7d518e384c1e18f6c5694b2a51c7d2ca57bcd587ad9e52932d600858c5a54945fe7e761c1dc4f4643
TLSH
T107410A58BAF91144B3B37F57ABF664AE447EBC372F07946D00010E8E0762A44C861B37
MD5 SHA1 SHA512 TLSH

Submit Download