remcos | 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2

Resubmissions

16/02/2026, 12:01

260216-n62ajadv2b10

16/02/2026, 11:45

260216-nwt4gads2b10

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/02/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
093421~1.exe
Size 3.9MB
Sample260216-nwt4gads2b
SHA256 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2
MD5 1570da0ad8cdd03ac5da82f163d6f256
SHA1 870e9ee1adbf93a35395178cb0f6ae8842d1fcb9
SHA512 348a45eec36b8408c38908342dd27d00d802c67886ef34b22e73b70994f3f9ae120cf36a594a6feb77b913f1765abda07d444428cbf167e97ba848d6abf33066
SSDEEP 49152:RlOfSMm2cPA8p8ZaE4sUAh0kuzcxQqDZdaar8oWGGukhKljxY1za5OT4D:HcS/2cPb8yJAhNM0paW
TLSH
T101169E236601C51BD7120930C9649BB95D6CEC234B12F0CBB29C7ADDAAF61E31A375F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\ProgramData\\3Q8Szx5vLnKmK4J5\\fix.vbs"	093421~1.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\wallet_donation_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_558071098\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_558071098\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_239168350\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_558071098\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-notification-shared\it\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	093421~1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4036	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134157159367081209"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{2D78812D-870D-4B46-B84D-72EBF384D742}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4256	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4256	3756	093421~1.exe	80
PID 4256 wrote to memory of 1064	4256	msedge.exe	81
PID 4256 wrote to memory of 4036	4256	msedge.exe	82
PID 4256 wrote to memory of 5840	4256	msedge.exe	83
PID 4256 wrote to memory of 5840	4256	msedge.exe	83
PID 4256 wrote to memory of 5840	4256	msedge.exe	83
PID 4256 wrote to memory of 3852	4256	msedge.exe	85
PID 4256 wrote to memory of 3852	4256	msedge.exe	85
PID 4256 wrote to memory of 2632	4256	msedge.exe	86
PID 4256 wrote to memory of 2632	4256	msedge.exe	86
PID 4256 wrote to memory of 2632	4256	msedge.exe	86
PID 4256 wrote to memory of 5080	4256	msedge.exe	87
PID 4256 wrote to memory of 5080	4256	msedge.exe	87
PID 4256 wrote to memory of 5080	4256	msedge.exe	87
PID 4256 wrote to memory of 1472	4256	msedge.exe	89
PID 4256 wrote to memory of 1472	4256	msedge.exe	89
PID 4256 wrote to memory of 1472	4256	msedge.exe	89
PID 4256 wrote to memory of 5316	4256	msedge.exe	90
PID 4256 wrote to memory of 5316	4256	msedge.exe	90
PID 4256 wrote to memory of 5316	4256	msedge.exe	90
PID 4256 wrote to memory of 6112	4256	msedge.exe	91
PID 4256 wrote to memory of 2084	4256	msedge.exe	92
PID 4256 wrote to memory of 6112	4256	msedge.exe	91
PID 4256 wrote to memory of 2084	4256	msedge.exe	92
PID 4256 wrote to memory of 5380	4256	msedge.exe	94
PID 4256 wrote to memory of 1384	4256	msedge.exe	95
PID 5380 wrote to memory of 2088	5380	msedge.exe	96
PID 4256 wrote to memory of 4244	4256	msedge.exe	99
PID 4256 wrote to memory of 4148	4256	msedge.exe	100
PID 4256 wrote to memory of 5420	4256	msedge.exe	101
PID 4256 wrote to memory of 3748	4256	msedge.exe	102
PID 4256 wrote to memory of 3748	4256	msedge.exe	102
PID 4256 wrote to memory of 4428	4256	msedge.exe	105
PID 4256 wrote to memory of 4428	4256	msedge.exe	105
PID 4256 wrote to memory of 3668	4256	msedge.exe	106
PID 4256 wrote to memory of 3668	4256	msedge.exe	106
PID 4256 wrote to memory of 5904	4256	msedge.exe	107
PID 4256 wrote to memory of 2408	4256	msedge.exe	108
PID 4256 wrote to memory of 2408	4256	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\093421~1.exe
"C:\Users\Admin\AppData\Local\Temp\093421~1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\InternationalPayment_20230321_1353.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc6294c188,0x7ffc6294c194,0x7ffc6294c1a0
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,1011575542890635060,4579834811744546347,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3557872446397883809,10568068983758501714,262144 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11345058306676467117,15662839718249440251,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1882992219281161662,15830590328300058709,2097152 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3540780483420594127,17691500216702816079,2097152 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3868,i,62079516435964693,18073890001234553001,2097152 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:9
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5008,i,7945885149728255476,16532845681534116889,2097152 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:15
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,6378656555693918284,10291571172791148118,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,11933830841025690310,5119702433431337840,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,15057519073736716451,4135572616731559621,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3705475120203812244,1075134407056039066,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1108
      4⤵
      PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,15057519073736716451,4135572616731559621,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,14179321149716336420,16719474783064555563,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,927597362820590995,14910474618667578151,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,15509699443657554061,4773060652589326193,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6703989753558261071,14024349957144357964,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1839773042537788576,12460744091739097213,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10480722540161817997,3577067718632892198,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5536,i,16109599261655514320,9456271693710910368,262144 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,7227499737132473600,13985741678504024225,524288 --field-trial-handle=2056,i,14135767025910255761,3466437827843250897,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dc088f90acdc4247fb33d1563fe2f6dd81dd3c857c4801ab77010568075c304a
MD5 bf3b2317f0e53a7f59d530d503e171b2
SHA1 99b00a8c1ddd06dc6c5236f0539afdcb61c07a17
SHA512 553acb9351cd2dc45fd66f09c344d91b48b1cdc4bf659d916c5f722adc5d97aad913dfc3648d2af859f7f60ab9574b590dba28256b3134e2da8b2bd3b45e913e
TLSH
T164F02D75CC25AC3708FD0B2920A50B46F76113772640985F3B3C910C4F7163B8996C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eedb61a6c7410f5d607d9d308ab95cf3e687f73053d8e8c5d6c6602f417b7a42
MD5 bd00bc0cbc7429667012532c92e2dcd7
SHA1 2c3b1263f9312129b67691e96a115e0fc732a5ce
SHA512 f0875dc0505b37b9f8bb2379fe0ae81ef9b74bcd59773dc0888f21693436e9f9377c388334ac82c8bdbf5d63d54e999e2b99fafdd38167f2a9942880332f09e6
TLSH
T1E5814F5491B8482FFFE5E3B087C52446B6F8852812570FA20EE6847DDE3CB8F608BD02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 105KB
SHA256 a3e0ed3b7b22eb63f8d684039026c6d1cf309dea226c1060864a6dde8ef4297c
MD5 35ae3b10ff09df4a55dc35b6a13e7f7a
SHA1 fe687665d50274195c09df8c0da43a3281143963
SHA512 6e0f0955ecc244ee48e49a902266addd795478331bd0f0865b92d66a08f660efe55cd0ca570f6116b5ba85970c359854e921faf3b517b566cbdc2ec1c6e7719b
SSDEEP 1536:IEpH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:rHSRhPjU1
TLSH
T172B35227D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 876849bac007aff23c83c0456fad8da197fe6aef650758a2766a2255b8979423
MD5 9b28dcbc69ba4cdd76257cf8866e0612
SHA1 ba1060632175a1f5b5f4cfc6ba6789609b77353a
SHA512 9321ae84a50ac8db3951d59946615bfcc6b08234212e45e2d5776dc34d88ca9e625d37560a48c54efc422caacc71b4c44f97bac171073cb98b471ebdfe31e873
TLSH
T15641E1F3C3E8997D8A0195F4A7187F2BCE690555932C3D9EC4E49E0BA3E2870E24085F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2ecfa273c493c619510ee8db8e6566181fec4b4798e71b03108942260861d539
MD5 3ef644c967006a04ff7a8ed685800aaf
SHA1 26326df66fff718c063d97243650f83292b7c9f1
SHA512 dd2ff56045a357e479537e5318424efc6c17d632e020018a5870856ea5a20b7d2a2589e63d4f23d0265ce1490277f5b0d169c7f9ac2ecfc12e95e298095baf2f
TLSH
T11D41E2F3C3E8997D8A0195F4AB187F2BCE690955932C7D5EC4E49E0B93E2871E24085F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 150941ea2afe55e6b8db11ed7bcd54f8f0046d6b335c4a8cbff2bd04737c451d
MD5 f4f0faf7e9597f8502a9016cab2c18b1
SHA1 ce9a3491e634c789db4571ac3c9f66d787f68af5
SHA512 d30db34f51270f98b3135424a4346911cdaafedcce21aeea761267918232fa9ab26561607370ba38b9963cdd59efbc0feb7e52a54a903fbaffcbc66a339aa8d5
SSDEEP 192:sxZ3PRHyMqZ/K1Ml8Mcc/f2sKfvpcJnuTP69ZzodpEO/W6+WNGY0rJOwmiiqpIgA:sxZ3PI0c/f2s0BBTL//bG59O2iSjk
TLSH
T15272F9166A389977CCDBD219FA457F53D6F91123E1805E48A9FCDA0C00D7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1dc9f6054681f5f3de42ab46042ec95df2b43cdb1a9a4da92ce7f5f20f325313
MD5 99d4bb80c7877e4d6a5b7554588d4a96
SHA1 0ce14739d407337ef72adc2b7024d66e3af70208
SHA512 84c79146f912608d7db8e0cf77a6c67849b252a618d083f029ba83ca95f58b75d6b8e2b9055c904946aaf9515f60de9167ce09f221f1459a3bdab6a22266fe49
SSDEEP 192:sxZ3PRHyMqZ/K1Ml8UQAcc/f2skf2cJnuTP69ZzodpEO/W6+WNGY0rzOwmiiqpI3:sxZ3PIq/c/f2sm2BTL//bG5XO2iSIn
TLSH
T18C72F916AA389977CCDBD219F6857F53D6F9152291804E48A9FCDA0C00D7BED6207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e60a131e9ca525f61df323c940a9a05180463c4dd0f803353ebf6f1af6973aff
MD5 68e9f2d0774b6f196ffb07cc1725de71
SHA1 14af4047fbc24a84f80b4f611609109aff8eae04
SHA512 2850dff1d13ee5152776619d9f47421901ec0f90d60b80c61504f1aad24862f82e952fa536692aa1c2ff29b821cb92de2e11361b9dce245bd8f4cd50b29413f9
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RU3SLl/:kA4so86s2+CE/HzWRmH9QYRu1jaKRU3W
TLSH
T142031C3B684CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2b69ba0fad8d978f1f32943a9f359db4e5d1b754ad15c6d9224d2061e95a3560
MD5 79cd1c3077952642275b0fa69f197259
SHA1 cca33e029d1e86b90403eb0092f2559f0bc4aca3
SHA512 c66b09be27b25d7e682523d099dd18e30fd5355691973db9fd29e51ebf1d1d30a6f081bf53a8870210edb5a78e9c2a198235d86617b0a5dde783a26f3956dcee
SSDEEP 384:ul9rPJYXkt7HSh4raNqptT7rU7wtt9Tr/gFNIvNH4f:ul9rPJYXkt7HSh4rj/4f
TLSH
T137B24A91797A02903A7D298E85A5B87E52C23163711CE46B3BF900B54F6BE20CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3d7c06661b953fe241e72754e05e626eb3dba9bbc7c4e72158c05ce88cee9188
MD5 9a75bf970a311da70b0df77eae52bc54
SHA1 5f9ae8ef9cb6c85b2fab15fc524774a7ce87fbb4
SHA512 c3d4f2ab3141b37728c6f66185b6a60a98aebca1bcab811fc645f5d176e153b3e7ae1c8b4dbe4b7f37d1794403d3e9dda0ea372e1f29a44b59424d26fc43da38
SSDEEP 384:n8ziFjvqMH38NZ8TUNTUlIR1PgPSY5mD1uVFfLY+1WxqbvX7Or4OdvTyrN1k+5vJ:VFjyE3ewgvuC6Y+1W2P04Oda5
TLSH
T1B6D25B32EC64CEE7ACEB9F9AA75A3643DEE001A3C9888ED8D5D51D0D008758E170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aaa29c2869bc37aac36b50a2c921beeb6672fd31e39cb6eb97fc066dc47c6d35
MD5 9f5c77095f000d6450fb683a4047e852
SHA1 767244a8702c6ca5c703da9112b7899999c6098e
SHA512 759a34b9987be14617993758f40cda56abf179b84ea653b0c06bc1944637eb8f76d4573fb2af4db52b6c9a8b4c56eb24b80f4bae6f62dab870b3816fbf475e19
SSDEEP 384:n8OiFjvqMM38NZ8TUNTUlIR1PgPSY5mD1uVFfLY+1WxqbvX7OrQOdvTyrN1k+5vJ:mFjyR3ewgvuC6Y+1W2P0QOda5
TLSH
T124D25B32EC64CDA7ACEB9F9AA75A3643DEE001A3C9888ED8D5D51D0D009758E270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c850b4644cf3a3f34e1b21f9fe106326e958d5b1862f5b70927e58205f07ff9c
MD5 3cf18a5dc3c1e733075fa2bb1cc16e4d
SHA1 631b19d73b5957c449e080efdd9f204c935a9a01
SHA512 22c0c09da4683ca3bcb1acc5aeb45faffbfbed5d1ce80bc2e155f7b4027182778b33bcfe9dbcc110b55def965a78fd3160687bc5207cfd0e8987063b0a692d3d
SSDEEP 384:nXziFjvqMH38NZ8TUNTUlIR1PgPSY5mD1uVFfLY+1WxqbvX7Or4OdvTyrN1k+5vJ:OFjyE3ewgvuC6Y+1W2P04Oda5
TLSH
T106D25C32EC64CEE7ACEB9F9AA75A7643DEE001A3C9888ED8D5D51D0D009758E170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c427ec23014af07bcf02b064999108d7f6a997473756f85b6980446346cb9894
MD5 e053f749b5efa4a78d02fed5cdcba983
SHA1 b58539049621fce09210fc3ecfc0d516e6c1dbe7
SHA512 7d83d95e5348f301acb66c5840e916dfdf5c6c0ba4318c7cdf1d7dd286ece857ca7cfa159dc5b03ddfe23565775c9df31e66011e2e1682936853f6b6acb2e137
SSDEEP 384:nKziFavqMg38Nhm8TUNTUlIxBgPSY5oq9OVFfLY+1WxqjfRYV/Vw1mRVrN1k+5vK:rFayv3KmwgG79EY+1WYfRYk1m/a
TLSH
T17CC25C36EC54CEA7EDEA4FD9EB0A7A03EEE00267D99C49D4DAD41D0D009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 205a0254fb9f0b72696fdfd13a20c2cf51172d59e036881e2e3dc9737e5a1e7e
MD5 2de0760c771ed1009d6404bc6ae02d94
SHA1 d24dfc7497d3068063a021a68d922160d0e0a68a
SHA512 3776055e6f4393e6203e60ef444b25af47f4b1764b25d0582523cf9dc0e46df266fd3f028a638b7567a80c1f127ffdc126b69aea47dad7b3e07e83c97faaf1a7
SSDEEP 384:nXziFavqM838NZ8TUNTUlIRAgPSY5VD1uVFfLY+1WxqbvX7Or/OQHTrN1k+5vI+7:OFay33ewgBz6Y+1W2P0/Ognf
TLSH
T13DC24C36EC64CEA7ECEA4F99A75E7643DEE011A3C88C8AD4D5D81D0D00975CE270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.2.16.1\manifest.json
Size 118B
SHA256 de2e13e2c7701829d3105d7ae5cb9ffabadc02df8786ad4b845e824d8e5e426e
MD5 6ef45beafb4cd7bf481da7f1e6855173
SHA1 51048b712e66afc1bcd88d10830b914a4f59df79
SHA512 e29877037aaaaa378ec90edb42892e4145d8ccd1750821c2088bdf40c6e8d1e61dac909f3b2e58288bde1fe679be25584d87c899be379bff405e0440bcf118cd
TLSH
T11DB092B00C0AA43B22C49320ECB0AA8293F80218F8022B1A08C036881F8817884362B3
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.2.16.1\typosquatting_list.pb
Size 1.4MB
SHA256 3df135a99beaed45d4af7580718c709fdde53c0c589b93d383e95d778ae6b19b
MD5 3a4ed8705e8e19e2d1da6df3a397345a
SHA1 acfe46ab64ef5194bfd5ce15dd8e0c80a58e964e
SHA512 d4c2c1f9c28c6e5317edc7e0eb67973c573c6af847bfe995a8050ce2567364591a94656a197bbf68fa90a9a597a39d6edb2cb3dab7e8b2b9c3a89d15b7bd4f4a
SSDEEP 12288:kKQP6XuBXFDT0d3kpQTjGwAT8cwagWNRbuvWJIRXLZ9+:uPdASQTjGscwa9TSvWz
TLSH
T17C65A4B9DFC00185DBB8112D20BF71D8181412A180E9DFEAFE7C85DF2B8598977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 940e837931ea27cc2ed019d103ef0fff02bae6605ef37b229879b46b617aad66
MD5 b495a1ff5e972026a5932534287e1267
SHA1 797cd60dfc462ec3b3760d13238d3758504a0ad4
SHA512 e527385b36227943a1edabeef5a655b1a7a7f63d70756365798ed9c3dc98eaec92cbb2859063e1974e27142cc54b5f5a2e6a1102212a4036f8cac40cc96c2cd5
TLSH
T11A5175D04C7D6AD1D4BD0E3EA05B78FCC1ECD625F4A4347D2868E9984A7EA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bd825df851c7ca1752c028520544b40713a1fd4429a0fe9ca0aad4c011c084b4
MD5 faa839c794cad3f93e12d68b4f110789
SHA1 805941f7f532c77584f005ee84e455efc7f3dfe5
SHA512 933d9982589ed08e6a569127813a048a2e9efe35245ce2d3017afb899a98c553d5e2eb605ecb6dcde86e2a3905fe990621d999c7f39cd8bffb910da0ceea9e72
TLSH
T1C95163D04C3D56E1D4BD0E7EA05B38FCC1ECD626F4A8347D2868E9984A7EA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 942ba0229b228ce96976b9eed673d153723a17cc1ae47cdb679f7547995164b1
MD5 02c5d96d68d15ffae62aa03d0f4d32b6
SHA1 484e14f53e46ff1ce5b4ac4b56b5cc273b2f4a25
SHA512 462ed363658c3a9bd4d357446a0ec22db04170053a858448ce5582d0061a66800b6eec58f84bcfdc90571bb5ba20d6b6731f72c5e1a4eadb596d67c4fb1644a4
TLSH
T10A5152D04C7D6AD1D4BD0E7EA05B78FC81ECD625F4A4347D2C68EA984A3EA1D648043F
MD5 SHA1 SHA512 TLSH

Submit Download

InternationalPayment_20230321_1353.pdf

Path C:\Users\Admin\AppData\Local\Temp\InternationalPayment_20230321_1353.pdf
Size 82KB
SHA256 cac74437e19c8bef83ddd2488acb700094ab47229159ce1f15569078d1c43788
MD5 a6bd852d4a88fb9c290816f6c738466f
SHA1 2951a4ecc6d910e509bf9fcd7e3868d893ecfb61
SHA512 08703f42c989f8cbe2adea45dd18b4980c9984194eba617553bfc14e2abaf6b35de4dedf74dbd6bc70da79dc867df2fd48c53b2c85d9fd22ec6599978844c41a
SSDEEP 1536:jKiz1OJf20KO3gJXMWEEBdYMAkdEQVHMd/6UskPmZaRZZqRHZXQ3QR4v5hKd:+i3e3sXMWEEBWMAkfHMdyURmERZARhQi
TLSH
T1A5830131CBCA796DDE13978E13A639190B8DF2E272C5AA021DCD1B16C940FE6ED67113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_1901647009\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_558071098\edge_checkout_page_validator.js
Size 983KB
SHA256 24e61bd2cd840f1d0c31b656fda800ad032e71850768d77b04fc45c65ac1b3ce
MD5 11d46bdcb9f1d19a351b2ff865b9b0f2
SHA1 2b498365ca6530fe83eb376740a2c0849e08bcb1
SHA512 2a1acca19f93be135db3a81aa55c64e44f7f080f91d8d32ef8e8ec6eebc8e7dda7bcd064cb2e5ca16d5960b47bb4a204ff88e0ea71e8dca11cfa24dc6b06cd78
SSDEEP 24576:cs41mRAps6vGNkrQAQHAQUwzEB4hWQtDBLIfIeBCs6oam5dXKLRzMEiJsfasHPZ1:cs41mRAq6vGNkrQAQHAQUwzEB4hrtDBt
TLSH
T135253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E8FA6C588ADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4256_558071098\manifest.json
Size 145B
SHA256 fa91adfcc12fafa93d2574ce2ff6a08825701d997d63a0081500d219cd0bc488
MD5 5f3528bbef6e8324bd313a94c0c4f4ed
SHA1 afbca5c2f2693b5a82e7c03d07213a6436981dcc
SHA512 c2d020c7f46176e954d7ca81f493b711ca4353bbc2bdce1ec52dce6f2ea277669b3350444b8efc08a6d5a45ea664505cbe142353cf35149598499d1595f9c274
TLSH
T126C02B33C831AC30043007E40CF18601EB34634BF500B0163730008E0F3C47040206E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3756-1-0x0000000004FE0000-0x0000000006D2D000-memory.dmp

Download