c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/03/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PCGAMESTORRENTS.COM.url
Size 202B
Sample260313-czzycaay8k
SHA256 c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
MD5 420715a04de8367bb8d37d57ce1d6d41
SHA1 710369a636391e43be7149416d8e9b390863babb
SHA512 8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
TLSH
T1C1D0221D8705C2E5EA43A5473270FC48A84F7D5819D6C4689748CE8E0CD47C0C85CBE2
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_373334537\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_373334537\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_373334537\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1546661083\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1445003948\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_373334537\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2005386126\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1546661083\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2005386126\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1445003948\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3160	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134178426997294617"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{AECC1F39-06CF-4ADA-BE13-049CF9176F0C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1160	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4152	744	rundll32.exe	87
PID 4152 wrote to memory of 1160	4152	msedge.exe	89
PID 1160 wrote to memory of 644	1160	msedge.exe	91
PID 1160 wrote to memory of 3160	1160	msedge.exe	92
PID 1160 wrote to memory of 4516	1160	msedge.exe	93
PID 1160 wrote to memory of 4516	1160	msedge.exe	93
PID 1160 wrote to memory of 4516	1160	msedge.exe	93
PID 1160 wrote to memory of 2128	1160	msedge.exe	94
PID 1160 wrote to memory of 2128	1160	msedge.exe	94
PID 1160 wrote to memory of 6044	1160	msedge.exe	96
PID 1160 wrote to memory of 5104	1160	msedge.exe	97
PID 1160 wrote to memory of 6044	1160	msedge.exe	96
PID 1160 wrote to memory of 6044	1160	msedge.exe	96
PID 1160 wrote to memory of 5104	1160	msedge.exe	97
PID 1160 wrote to memory of 5104	1160	msedge.exe	97
PID 1160 wrote to memory of 4584	1160	msedge.exe	100
PID 1160 wrote to memory of 4584	1160	msedge.exe	100
PID 1160 wrote to memory of 4584	1160	msedge.exe	100
PID 1160 wrote to memory of 3436	1160	msedge.exe	102
PID 1160 wrote to memory of 3436	1160	msedge.exe	102
PID 1160 wrote to memory of 3436	1160	msedge.exe	102
PID 1160 wrote to memory of 4304	1160	msedge.exe	103
PID 1160 wrote to memory of 1516	1160	msedge.exe	104
PID 1160 wrote to memory of 4304	1160	msedge.exe	103
PID 1160 wrote to memory of 1516	1160	msedge.exe	104
PID 1160 wrote to memory of 3740	1160	msedge.exe	108
PID 1160 wrote to memory of 3724	1160	msedge.exe	124
PID 1160 wrote to memory of 4664	1160	msedge.exe	125
PID 1160 wrote to memory of 4396	1160	msedge.exe	126
PID 1160 wrote to memory of 1820	1160	msedge.exe	128
PID 1160 wrote to memory of 1820	1160	msedge.exe	128
PID 1160 wrote to memory of 884	1160	msedge.exe	129
PID 1160 wrote to memory of 884	1160	msedge.exe	129
PID 1160 wrote to memory of 4280	1160	msedge.exe	130
PID 1160 wrote to memory of 4280	1160	msedge.exe	130
PID 1160 wrote to memory of 3768	1160	msedge.exe	131
PID 1160 wrote to memory of 3768	1160	msedge.exe	131
PID 1160 wrote to memory of 3504	1160	msedge.exe	132
PID 1160 wrote to memory of 3504	1160	msedge.exe	132
PID 1160 wrote to memory of 1344	1160	msedge.exe	133
PID 1160 wrote to memory of 3724	1160	msedge.exe	134
PID 1160 wrote to memory of 3724	1160	msedge.exe	134
PID 1160 wrote to memory of 1848	1160	msedge.exe	135
PID 1160 wrote to memory of 1848	1160	msedge.exe	135

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\PCGAMESTORRENTS.COM.url
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pcgamestorrents.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://pcgamestorrents.com/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7fff0685c188,0x7fff0685c194,0x7fff0685c1a0
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8821677233218082076,12246929611063719628,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
      4⤵
      System Time Discovery
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12603432183837251889,2665203763536379151,262144 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,3539470849410411959,9621389537312365160,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,9435484879065973160,9420828283044362785,2097152 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,2343419626706594818,10892949944301416666,2097152 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,15346815850321832813,8044964416372479053,2097152 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5056,i,11684401311755630281,17321578715138096658,2097152 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,15474708607796416534,3229126498836190779,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,9302182081675988852,12115437276118598689,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3772200142064406441,10486222739943808190,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3772200142064406441,10486222739943808190,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12329151511281855840,17756706626418246246,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,5269688741113583379,15587412718173362875,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7652884365754905710,6519686307200811592,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3008,i,8450732306645110301,14821647722514248707,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3076691209355432147,16297671235050795075,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14909926024692998229,9480164362876058708,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,6801679670547218714,310313103520644936,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,18358562049002842029,2082258407118370734,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5604,i,18087277590780138517,8302452807282358554,262144 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,565318558713745147,4347513446056111117,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,15983613463905234155,17377465234867703741,524288 --field-trial-handle=2296,i,17234206903376170107,7894589363944175696,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
      4⤵
      PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1445003948\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1453085036\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_1546661083\manifest.json
Size 117B
SHA256 39150ae100dd2eb2db8b0fa5a088e914110d872e36c959401ed0c490e72160b8
MD5 ac57313a478dbf89884edd1a33b99fdb
SHA1 a042b69993424222daa8f5a81c7411d54d295209
SHA512 28f508868e6ec2e93ab99950b3aeab51cc50ac54ba8b4d49296eec9066a5e30b90e29b4be539e5e16c8c8b405b7467f342c990155f569fb83546d84b5452dd0b
TLSH
T147B092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A491F8827881363B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2005386126\manifest.json
Size 52B
SHA256 06e5abe50177836b7b929390b260ce06a3d26ef79f0b4cb7873eb354ca26d6f9
MD5 475ec9a4e5c674add6cf767f5c7d4169
SHA1 f013a3715c408287043b3d6e743ea81b529531e0
SHA512 fcfad595263fc60d219f360774e6f6c9ebf7baecfe21483ef0cb40c02896e3d936fb1916b05e27422d91374896ae4addda7443a632ce158dab96eb3abd9ebb57
TLSH
T1DF900260042495171AC10E506570F8859391661995850D1D04451548029556CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\keys.json
Size 8KB
SHA256 722047d2502aaec9c2c80b0f7d3b60b29d3f6aee27d656f489e4fbca9a7c1a00
MD5 48cb5a96ba70f0dfcca0a2185a9a0c79
SHA1 efdbdf44f7cfea2e3b34c6b2fc0dc37a1b5cef3e
SHA512 77eb7bc1bdea2b121b8d95fd8b5d14603d5e105dbf8c8e777b44109b1eb2ba65785ee3a094e18ffb591f81fe140ff83af1618d82680a5bb3a29144c58895dd2e
SSDEEP 192:uNtGbRgDMYPyR9Pm4lOvMwkoR9PuGMXcy:Ol4BKjA
TLSH
T10912B2BF14A01541CEBBC16E4F0B38B78FB038065BCA3983578BFA4958428AD173B4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_2042420775\manifest.json
Size 79B
SHA256 8f8dae05e2623c591dc44dc5a91385b4355da91492a770f0ca99b509db6533e2
MD5 44791df1f32899ba8f0fd1f235cd4711
SHA1 e5ab30e8b7610e92c81c99adb110e3a429fc3174
SHA512 729578ec403ba1410c5826f622d4db774d68e243112351f50cb5fcf231ebdf7fd9759bb5e2bd4a7bd6433c147ede44b78f4eef2eb08c456d4a430b55a149edd2
TLSH
T18EA0126018019673148807600170878643501C012029380005521040258413611A312A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1160_373334537\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

4a60261d-6225-420c-95ac-f6b242628274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a60261d-6225-420c-95ac-f6b242628274.tmp
Size 27KB
SHA256 79ed72333439d978cc4879bc05ba596ef6afeb32f0d27d8961efdf28337395c8
MD5 03795fc790c91c5a9644347f8cd22b85
SHA1 8e0f4b438b9efa88196baa708e238ac68b1443dd
SHA512 794fe8a2e4390496f308a569fbc75efd7b6e9d9b79c2dae5a03bf1abdf0cedc91e3bf81e7a8af51e229f179f384cc09074db021092d7010897de5d778e57731b
SSDEEP 384:nAiFJjczSyLNy3sNG8TUNTUlI4xN9Jh2B3vfEPrZA7Zuox5tctXt2obf6l7+MrFh:bFJczSO431wgxqPCZzAtZGgm5hr
TLSH
T184C24B76EC94D97BADE68FD9E35A3603EEF04167898C6AC8D9CC1D0D009B1AD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

6ddba7ed-69ef-4bc4-bf41-9fa9d01d67c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ddba7ed-69ef-4bc4-bf41-9fa9d01d67c1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d0b67358caeec63e2d4980499a43f8ce65167f1068a2a914389c5e1f084154cc
MD5 ceb41f9987c1967c519f535f0ec52cd6
SHA1 f3654eb7fdf630572ddc96d8047f20140e1782b2
SHA512 27d8252d0817ca5ba6c7d3f651897e5b398bf58bb149b401e85ea09fb882dfa158857f5db85869cf4d9f2ecee9077fba05769c8d20f5e2f912df3ecd87bf77ee
TLSH
T182E02BE9CC25AC371CFD0B58A4A04749E74513473A815A0F3E3C84098FB4A3B819685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bdd7ae50e0f02ac942975cbf295caf3fca06c6b7460c13ee759a439ca3748115
MD5 52827e9c2af2d5955fd469145363104b
SHA1 ec6acd8001067ec4d0656e7dee7bccc1040174de
SHA512 d32ac87c1dbb710eb3aef5692725d7d43ef123b3a8debb0bb9beb7bd374046af4f0941d4b06411e5cd54154a91ac1e5a9c5b4ae80f25e7cc97ba60adb376e51d
TLSH
T12851088343A1942EE7E0103059DDF19133B4D7BD3D568E6677FB2AAD668670E4088CCA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587903.TMP
Size 2KB
SHA256 74da01a859100280cabb05054f7e79a9bbfc787437a3c143699d0c3db3c8b122
MD5 56157d5968d30bc12d09899007e8fc38
SHA1 a7cc5739b8b63db3d90fe17fba9caf9fd964ce21
SHA512 cedc0eb7b6e6f4efad34f70bb4923411618aafa92cff8cd816ae2ce014f30f4e70ac80104ae7685ccf8d7b42106361cd4b0e63778ed7830ccb58447a64d029a8
TLSH
T1D5514CC340A1891AE7E010309EEDF1957370A75C3D6A8E9637FB06BD764670C90C8CD9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 88940afa46a0e8376d8f0b143dec4f90d78a7548c256e4f66d8fdd2f5490a48d
MD5 cd29b5fe6d9bf171e54c110bb8986abc
SHA1 f0c99098a89b694ffe1e32306ea0e7607f7ae1bf
SHA512 bf0a51dc8b9672922e396ab888184caed851f6a39a011f90355e50dadde0eaf71c8a17a315dabb2d231628cdb13c3e578172a5358aa1c73e853ceadd080c550e
SSDEEP 192:Dfo/8YreaV1Nr78rvGVBCMBRxewtCa1HEuq0Gj6gilK:Dfo/8YreaV1Nr78rvGVBCMBRxewtCa1w
TLSH
T159E19AE7C3A48AADD92266F0AA147D27DE5C0B3453AC3C4AC5E86F0F63F2461D20575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 99e63fba9ca2f6aeaabcdbff6f9af9a8242f41f04521ca2d05346b0f9bf6979b
MD5 15cc06c18dd46ff12671e21b6b4c293a
SHA1 9f1ab9522738f001d680a850e15718ca66f7622c
SHA512 fbf43268af8eccf6f034e8d4eac8ee25dfa7a9e1e679a777ccb625087e7ae82eccd9a57ee6174ff4c0003dddd5d2843fc36283945e021105c95a64bcabdbf766
SSDEEP 192:sxZaR1yMqZ/K1Ml8UQvjM/fYsWfowep4sJnzodpFhHW6+WNwmg/Bh4Rli8xVtM/z:sxZa6qrM/fYsQo9pHJsjHbm/aN3eC8
TLSH
T1CF72E8166A78997B8CD7D219F645BB93D7F91423D1904E8899FCCE0C00EAEED611382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 47931dc972b3615c27e3aa13be2ded41a1349706df13151dca8b23e3f920a388
MD5 245ab1407e9dca7969077d7706025da9
SHA1 5d9c7558a6532143f8ea62ea4791d08c1c2560eb
SHA512 29776c173b9fb3c0e234b52c1e07cc4135fc2240300a49d593e839ef62272e84bcea346731eefea759cab0969537cf7e85050bba9c4979f3df48e46f4707dac7
SSDEEP 192:sxZaR1yMqZ/K1Ml8MjM/fYsbf/wep4sJnzodpFhHW6+WNwmg/Bh4Rli8xktM2eIh:sxZa67M/fYsT/9pHJsjHbm/a6iejp
TLSH
T1FA72FA166A78993B8CD7D219F645BB93D7F91533D1904E489AFCCA0C00E6EED611382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fc9f09c2264fbdca9416a5f6884b203a35f8853cc7e4b11d3e4baf2de25915ab
MD5 d9056eed7e15e0bec15db458a2ce061d
SHA1 6c1950d6545dc982c1bc18ddd7d56c077025884f
SHA512 a151a5cedd3a84ddfd966b5cb61a3705bb06e2ff610f4cfdc3fb563ca9bb7306d5e87a72031e108010963ec27286d98c8d37739269f82082440ff37b2083d217
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OViDFkLlMeNtFrox:Jdc+txWE/VRWvV/qHu1ja/DFkLO6t+jd
TLSH
T138F20B3B6C0CCB7E4F840E9CEC2A7E5E6EE801CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 cdc4451e77445b3ec3423951fd5371eb30ad2022f57798ab4f617ee1e2dbc3e1
MD5 3d12b7cb646775d407e28f6ce8947ef8
SHA1 9b1a517dee35e4d3817f00f6602d4092ac14d306
SHA512 1ee2fd1050cfa0d9f7291b6218490d819ef5b16032143f0b789bbbeae93ec3deae501e4d9a6f91a6345a5be393d8909b27b73b760e4e6011804970d62a073c09
SSDEEP 768:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xful97:SXEpUTaFlz0LK4xful97
TLSH
T154C23D10313B03813A7E698E9595B46E62C270B33058A53B7BB840A64F7BE14DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.1\data.txt
Size 144KB
SHA256 a2982a165c36b8f3624762f10749be694c8282f9b28c7e35965491794efe9591
MD5 868418ae9c5d2cb6622da65faf86702b
SHA1 1d7923eeef3d6b584513d6db8880d26c52f3aa5f
SHA512 8935a3cd42725cbd2f331e97b25bc823867698f8128a628a05b03ed1ff040e083f17e790f278e66651b92ef6fb5cabfa4c0d8fc400e2ccf3f1a3866a2ed0571f
SSDEEP 3072:nPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEp6+DC3gY3w3U:PX1aI5aZoKzMJ07N4fwY3wk
TLSH
T1D0E3F120CAC45FDD9FA82A1C60BE0F1973D1C7AEC8166686E773FD0B6F97908411719A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8c608de418a3618dfc108969f4f1b59fe1f4ab9fb042ec4deab44fa8458f56c3
MD5 89304b8f9a11cff4bc041c20cfe5100f
SHA1 85fe9abf56563f19e0b1c258a7ab8249ae796368
SHA512 5489687e86994e53c444cee507ecfdd158e5bd596aefec61c61adc2009476e1aadb5d128490b5695a0a9e6cba5a96979c63f8936b6fbef753ff21e63cb4af0fc
SSDEEP 384:nYiFavqMg3sNq8TUNTUlIm29Jyjgi3vfEPrZA7Zuox5tXtdnS4mtmE+qrNlk+5vm:jFayv3Fwg0gZPCZzrtdS4smnK2
TLSH
T1DEC24B75E898C9ABADE68FD9E7497A03DEF04197D98C5AC8C9CC2D0E00D75AD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 58d3c18df8ed79a294f59427c9ae30f45a3345d4c61f18bebc5b35e1c1b8ab6c
MD5 1bb36a7dfea5eca21b957d9aa78f6092
SHA1 b43f4aa2434d6f3cd6f561b2cb535085a04f37d3
SHA512 68cececce43ce219f88b747d217071d2315449bf00fdf9244a2a9d4cdd8b52ce581505050576720357e7fe8c58379de413aeaa5d55c673b5529cd00ac3167fbc
SSDEEP 384:nviFJjczSyLNy3sNG8TUNTUlI4xN9J32B3vfEPrZA7Zuox5tctXt2obf6l7+MrFh:6FJczSO431wg/qPCZzAtZGgm5hr
TLSH
T1FBC24B76EC94D97BADE68FD9E35A3603EEF04167898C6AC8D9CC1D0D009B1AD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 09c1f1615e814d9b8c63f904402c477170f5d0870a6cff8c7d86a956fb84a2e5
MD5 d2965caf3fb22b1e120a50a8f7cc6255
SHA1 df0cba4fd8214cd833d80c68faf5f93a8f876d68
SHA512 e4530f65449c101ed5a26a9c3f7500b57688377e47f2c2cce9a56450006236df65a43ec83aa5cb7837e6407848083e69f893b3a275f5b7f869dda7bc06430b1c
SSDEEP 384:nQiFJjczSyLNSH3sNG8TUNTUlI4xN9J3dB31fEPrZA7Zuox5tbtXt2obf6l7+Mrr:rFJczSOG31wgY4PCZz/tZGgm5hr
TLSH
T1A8E2D5F598D78977D8AD8B87933D2E029AFCC153B8885988B7C81D0DCC961BFD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e157c624800e49a58a736c8abe2c3c6b581f81d8bce6d1fbfc8f001f46c16ad6
MD5 5f21b75ba7c6c924ccea72531d0b80d2
SHA1 08861dce64a1ee5210357fff3c87afffc0f181e2
SHA512 675ea8d2e630dec60d048b290e0aba715189d29c6e1931900a029a39f23a830cc408498fdc3fefb3365e7e9d9c70d1098fafb99a9962501d4a393c99d503aa6c
SSDEEP 384:nviFavqMg3sNKD8TUNTUlIm29JCBgv3vfEPrZA7/6dnS4mtmE+qrNlk+5vI+S:6Fayv3xDwgqgcPC/6dS4smnK2
TLSH
T175C24B75EC98C9ABEDE68FC9A7497A17EFF001A7D58C4AC8CAC81D0E00D719D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.3.4.1\typosquatting_list.pb
Size 1.6MB
SHA256 72aa7742dbc03dc4fa7a0a6719aba9fcaf7dc3cb5f3250d14cd8dbc83d7b4aea
MD5 844528b3019b73b587a49542bd544a34
SHA1 f35b8ef5e9289e111ce699ea3e5b296124745d7c
SHA512 334329ccd92c7a2d27e5a49fa4e546632b0541f1d300c105b311d1a3b7707babf0590c4f2135cea37bfeaae1bfcec87fcd469ebb1458a67ae052a1da36b1def9
SSDEEP 12288:JPgRKbF63Ji3Qyd2DNBclST9kXYXHX0WEbENbtvBOJfWQV10ySzqnkl3Sm:JPxlAA2DNxT9kXYXHX0WiAt8JvSV
TLSH
T14585C6F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3c3f357bfed13990ccf9eb8b287179ae90bd05a52919b9321c0383407345d67b
MD5 51f041b86f65230ba9593cd35cb7777e
SHA1 ab3ecdec513ee37718560d016a72e204fc79bb5a
SHA512 4b5fefea0ba8eeb50ac82b69198d1e2ab41e72fa9c722c41fb1c38b2e5f3b20e1c9b06c455e56e2c36b48f40a1617e54520ca2aa1c874922880d58bccb584de9
TLSH
T1924130E15D7E5AC0D0BD0A6FB4A738FC91D8C626F4B4743D6894E998462AA09244443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d47860558c4f1e161d6f93b0a7bfd338d97ce1d2991e1f7353182d8c2e3d0a6
MD5 3baa219121ee00e0007b172b419031d7
SHA1 f166c51a9d14dd7d895b66dec122e86d656e7d91
SHA512 07f09605f6b081b2132657cddd76e2ab52538a2688408c2e8ac1c8c0576eb024d36892632bd12fd96c365b23b2986852cc6fc5cc16dce5f596fd88d3247d26e0
TLSH
T1BF411EE05D3E5AD1D0BD1A6FB4AB38FC91D8C726F8A4743D2854E998473A60D284447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2b196c1a2e8b5c9c297d848b09e7ecb591f21e7b004890bc5acf65d4cd9cebcd
MD5 2bab94d82332958104aa6ae1c6007378
SHA1 9809952a24af9abed52b7e54691d2c49fbef0b5d
SHA512 490756e7bd159a2f7b71bf3aaa9a1bac614d7b7f5c2449890e263baaacf47e7759e482668e42dad1b6d93aa6f90b3c733b6d11053d5502045caa1dfcdf49742d
TLSH
T1B94141E15D7D6AD0E0FD0A6FB49B38FC90D8C726F8A4743D6894DD98463AA0D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1ce5c6887cb2c57fa1420f4b54e68ec60eb456da3eb7f9e05ae46fa9113e5430
MD5 45cd1d75b121dfbbb8474e73ba96da55
SHA1 435c9dcf1428ad043f0b6f4478c4537e6e77f070
SHA512 b8740661aebc6fc8c0bc0b99bd2529e7865a51a2f6e4c085b88862038217531fb094991c830a38827999adb9768c1ba820c2bc0e978219932b41d4e8b782a8bf
TLSH
T1D6413ED15D7E5AD0D0FD0A6FA4A738FC91D8C72AF4B4343C6864E9980B3AA0D244443F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e15c9e28471fe61bd6fbbf6d9a03e1f8d2aa52162f57999a0ccd102df9b346c8
MD5 8471a56a8526e192574c36a8d8df8c99
SHA1 f4f450e0a58f1c26095209d8af44fe5a6396cef8
SHA512 0abe8b0a42715f9a5274f119218b36d5b9b89c6bdab379f30ede9ccbe67fa89b66827f417599e5b7ccac0707b7daa6bb91a160c9e55b83eb666b8679b2745f00
TLSH
T19B411858AAE91149B3B76F1A9BF2A86D483B7C772E06D45D00110E4E0626B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download