d074855ae4e2bc35a6127e421d53787d30a3d9c8bcfa16dcca622a2b195bb923

Analysis

max time kernel
148s
max time network
122s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 23KB
Sample260418-wv4khset3l
SHA256 d074855ae4e2bc35a6127e421d53787d30a3d9c8bcfa16dcca622a2b195bb923
MD5 2f43cbe2559df7502ed8b161dffad47d
SHA1 68fe514e640dc02af427372591b639cefc12cb25
SHA512 de1c2ff3569a3f98649f2145571d78ee1440b80b21e3dd38360d8b08bdddc0586a5f0fde8fb858f6248e0f08b27dd7a123ae969ae8f488761a177e6450ab7cba
SSDEEP 384:hzyliqDLwG8cIviDo6z4cim8rRT3ub/ZaKSaBYI67HjEKZtNq72mULa:BeqRbBcaRTuFCaBrsgKZtN0lULa
TLSH
T1ECB29FA1CF062F819B74850B71DE1CC946DEA78DB8D2A2CEA50BD68F5D5F50241C82DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_391325695\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_391325695\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4448_1787438500\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_391325695\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_1461513543\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210101946925374"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{47865E0C-F5C0-470F-80B3-1760CC744B52}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5888	4448	msedge.exe	79
PID 4448 wrote to memory of 3356	4448	msedge.exe	81
PID 4448 wrote to memory of 4020	4448	msedge.exe	82
PID 4448 wrote to memory of 4020	4448	msedge.exe	82
PID 4448 wrote to memory of 4020	4448	msedge.exe	82
PID 4448 wrote to memory of 3980	4448	msedge.exe	83
PID 4448 wrote to memory of 3980	4448	msedge.exe	83
PID 4448 wrote to memory of 4680	4448	msedge.exe	84
PID 4448 wrote to memory of 4680	4448	msedge.exe	84
PID 4448 wrote to memory of 4680	4448	msedge.exe	84
PID 4448 wrote to memory of 6028	4448	msedge.exe	85
PID 4448 wrote to memory of 6028	4448	msedge.exe	85
PID 4448 wrote to memory of 6028	4448	msedge.exe	85
PID 4448 wrote to memory of 2076	4448	msedge.exe	87
PID 4448 wrote to memory of 2236	4448	msedge.exe	88
PID 4448 wrote to memory of 5280	4448	msedge.exe	89
PID 4448 wrote to memory of 5092	4448	msedge.exe	90
PID 4448 wrote to memory of 5084	4448	msedge.exe	91
PID 4448 wrote to memory of 4920	4448	msedge.exe	92
PID 4448 wrote to memory of 5092	4448	msedge.exe	90
PID 4448 wrote to memory of 5084	4448	msedge.exe	91
PID 4448 wrote to memory of 4920	4448	msedge.exe	92
PID 4448 wrote to memory of 4688	4448	msedge.exe	94
PID 4448 wrote to memory of 240	4448	msedge.exe	96
PID 4688 wrote to memory of 4104	4688	msedge.exe	97
PID 4448 wrote to memory of 2816	4448	msedge.exe	101
PID 4448 wrote to memory of 2816	4448	msedge.exe	101
PID 4448 wrote to memory of 4728	4448	msedge.exe	102
PID 4448 wrote to memory of 4728	4448	msedge.exe	102
PID 4448 wrote to memory of 5708	4448	msedge.exe	103
PID 4448 wrote to memory of 5708	4448	msedge.exe	103
PID 4448 wrote to memory of 1912	4448	msedge.exe	104
PID 4448 wrote to memory of 1912	4448	msedge.exe	104
PID 4448 wrote to memory of 804	4448	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffde5afc188,0x7ffde5afc194,0x7ffde5afc1a0
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,11826288988715379496,15188851180952690050,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,16070335585476318852,10030076579156595757,262144 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,17469999064034887320,8196604338426037835,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6425719037607270683,15704100188473584636,2097152 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13808839265920466550,8920445696348101917,2097152 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16116227079619213007,14350145514954120877,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,3260049689231804747,18165792368941093829,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4815706901751057109,3904605139862619011,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,1470377259037827977,7054867756095918799,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,15334445702837179599,6161002082455643665,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17047621828138353049,14713273227535047021,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11521348174057352535,17568890541928187593,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4829960408382862667,13404204986698777342,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4829960408382862667,13404204986698777342,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9300648952690748846,7089101426025417774,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1597658456204241215,12828640068697442491,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10866065536546697426,3592525316583354311,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,1530848773940876556,9262178529850586483,524288 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5724,i,14276784460132985672,10652304113607174905,262144 --field-trial-handle=2164,i,7881678878577632584,12489516525611618534,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:10
  2⤵
  PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c5f69b4bbb39f992267355b1cabf33cc4b41394dafe4e4fb6824dcb900e40702
MD5 ba07465b7489c94bcfd3c363d949c3b5
SHA1 2b2a53b71f45910705195b915ac0cd5b38a91267
SHA512 09777e232f72ab28fb16f6d9c3b9407c0627bf19275b3e1839883186836882864462195bd2226a23861098c8f04aeecaa72b09960aa8c8ad6a63c9d8ae71f895
TLSH
T1BBE02B6ECC259C3708FD071965104786F66513272E40550F3E3C921C9F7167A05D5C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6c864cc237023a2b50d94d1716f2aad3ddb1241b22b47c6377d584eb1fade6d6
MD5 f589c3930dbe3aa3b2f6ea35379e6328
SHA1 14f73f293f80d2c172aacf42566556e3f321d500
SHA512 c868f06768092ab7309a2cbe9549728a6736942f5f0abedd6ff135a9ac4e37f89b9d65e7d3fe85a761a2db62ca54c3b9949f9cee6f7025d8b1c7525f846de872
TLSH
T1F951EFF7C3E4866E991156F0AA287E2BCE5D0515436C3C5A89F4AF1BA3E2470E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 10f65b039787ab2b97f8e3030b95a492057a2ad2731ff3d93c43b50eff56c331
MD5 008f077c7e63694a42ccf02d6276b2ae
SHA1 e2515d02fdd681ac709fa74bc5870265cf771408
SHA512 46ab1783133d580537ee8543b75d9d2308563d66379d9905a126c59943bd9e289275882051fc5e1c474dbc112affdb4478bdc35d97842492eb7fc4535622f24f
TLSH
T18251DCF7C3E8866D891156F4AA287F2BCE1D0559836C3C5A89F4AF1BA3E2470E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 95e831913a1891db987ec3b53adb1e291297bc1a39936737d2f6149619acd346
MD5 b00b544ba0d94eaa6069027b920b0657
SHA1 c26bafbbd2f1c1c9a72764046d9eb05a0a7b0b74
SHA512 0d3d796ea0f4ce04cd399424f8fb0edb6ebc6e7a249ec4e230054839bb49154aecf18323588cfd2b79d6676b0ed37c9bbcd08f2426cf10b48243eaf8c8ae43d0
SSDEEP 384:sxZi2Rdu/fyscqajFrLTUB/bGeGIyiDjD:sxTu/fGqEFrA/bGeGIyir
TLSH
T10A62E9156A389977CCC7D619FA45BF53D6F51563A1904E48AAFCCB0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f866a16d15e2fc7fbc5ecbe9612dc4b29f239c22d5e8046b11099151206e32aa
MD5 a99bb0f33c22978784091d1afc279a09
SHA1 867a115529fde5b54140b13ec8e66e2d669ca107
SHA512 2ef0b93b17ae89199f7d7c9b29acb3ec5512786051bdda6716da6a23df1908c01a6767197e1f1b6dd57c3974ccbfd4e7e8e7f4be584205daea879817a2a28476
SSDEEP 192:sxZiSRCyMqZ/K1Ml8UQWFu/fysqyaWWsJTP6eLzodpE0/W6+WNGe32g00rsM7ijl:sxZiSRqku/fysqytJJTCB/bGeGI/iLW0
TLSH
T1DE72E81AAA385977CCCBD619F645BF53D7F91123A1900E44AAFCCB1C04DAAED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ecff9939756d44ffe07d95c3a666e8b9d19f22731e2f601462eb549d520bc7b7
MD5 26484cd0924555cbb09d67ea7fb55745
SHA1 2a04cb72aafcb0a001458ab262aafcd34411b373
SHA512 736c641f0ca122dc9d1f82a9aba8c9885402d4d195878160d2746ca4dea11ab8f98e8a80297e4b526b75960fb6c175dda659128208e28a73a27e5c8b5a1d1340
SSDEEP 192:sxZiSRCyMqZ/K1Ml8MFu/fysqyaWWsJTP6eLzodpE0/W6+WNGe32g00rsMxijHIg:sxZiSRdu/fysqytJJTCB/bGeGINiLW0
TLSH
T12972E919AA385977CCCBD619F645BF53D7F9112391900E44AAFCCB1C04DAAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 d87d3101f57ebabbe5ec85c53bcd04025df6d982aaf03a17fb4de82804c343a4
MD5 1f31bdaa16d0c2b38aea17b349549dc0
SHA1 b6490c3b1d9debb24291470da7a01333e4dfa27b
SHA512 0b601fd436cd389a4c9a8af7d76cb9196938d7c65493310f6c988ae8ab81c5d7149b88bbf5b8ef892babc2a95720e3ff2a1ea1cef0b548c4615f58c537490867
SSDEEP 768:kD4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31U3SLll:kD4so86s2+CE/HzWRmH9QYRu1jaK1U30
TLSH
T1BA031D3B680CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 91822d29243b228204acffc8a0cafc72fadcfbe2f2d8437bc21d202874812b19
MD5 d043a745deb774c78314c466f7005d38
SHA1 763833e19f9d0aa9eb0e29edb1b25c9b8e01d4da
SHA512 37a2058f94ef5991c5befbbe0540c7d49abd3d39212fe7d6cc466d14a36caf7700e461570b4e8830c76e074086339dca4e2e625ad797fc90630d857b35c5e18a
SSDEEP 768:kA4so86s2w67pLuLn4zWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3LU3SLlm:kA4so86s2wSEn4zWRmH9QYRu1jaKLU37
TLSH
T1D4031D3B680CCB7F4F844E9CEC2ABE8A6DE8018F96988D5447FA444C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 595db39e00e6c2153746101a748fc901957d633300121a7f719fa20804c7e541
MD5 50cdb7952807b606d78b7d9cee263683
SHA1 19d6ad616bd3f906b8f2b706c943cfe9f55d11a2
SHA512 89d1c2c26c3b9ea45079b2f992d67ba3e636624da666071a4a2646fbc974473b88ebf4add57d0c7d96bed2d85ef6e5da383896ff9bf960d58bc70ffdf4b69bf9
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSK:ubB91NPhfYXHkvl7X3S9r4dFjPvQ
TLSH
T133B25891757A13903A7E258A8595B87E52C231737118E86B3BF900B60F6BE20DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9e659cfa62a6672b50abb85a110e7fa3f5f50dda43cc995825fb31c490d1cb0b
MD5 9958e3109094ead5aef4393488576228
SHA1 5acbd38f9cb84d0ffb00cd7ecc1400a4b4d6906d
SHA512 1d2108bbb8bfd325ce2aa1c692467fd7d1a30a4b05aeae48335393c68ddb10cac4d71b4e022d8d6b5d8332ffe75c949f3afd59bcf82880a3a80780fdd427af17
SSDEEP 384:nKniFavqMg38NF8TUNTUlIxBgPSY5o9kOTGfHYlYm3fE+F+RYV/Vw1mRaCe0trNx:PFayv36wgG0kxYjE+F+RYk1mE/0Jn
TLSH
T11BC24B36EC54DEABEDE64FC9D70A7A03EEE00267D59C4AD4C9D81D1E009719E270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f83a4a760f746615c9620c89355525659dbf7de79d64dd74bbb41a191170644b
MD5 1bf87a666363706e666a151bf965e7b7
SHA1 684895b329f739afb88f198c77591847ee5286d5
SHA512 8479f53340f6e23c7618b392959f3afa37447ddb93582eb2a4f83028ddcacb12c218eaddb12cc920be095db676f64c1a21f02c40574c2cd27b8632d1d27e7f6c
SSDEEP 384:n1niFavqMg38N38TUNTUlIxBgPSY5BhgKTGfHYlYm3fE+dm+Y0RYV/Vw1mRaCe0l:IFayv3AwgG5gNYjE+d5Y0RYk1mE/0Jn
TLSH
T139C25C76E864DEA7EDE68FC9E70A7A03DEE00267D58C4AD4CAD81D1E00971DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 de3e13c0202308e3dcdba9af5e2dbdfaa26a80be16e166e367490a2fc687acda
MD5 a64e90594ab5a672c80e39cbc460e0a1
SHA1 bd531e3c6fd150a53c070fdef3afaa627138ee72
SHA512 c3e5296ff20e6e030fe67b5a43178a24d5f1b8b4a2fbc408e246a89305d8ebf56edde85fba3376eb8dd3fcfe8553babab86f2afb88fc4daba3a8ab8f0cbd2eeb
SSDEEP 384:nRniFavqMZ38Nr8TUNTUlIRSgPSY5GC6ZTGfHYlYm3fE+dm+60tMrN1k+5vI+l:EFayK3wwgLx6QYjE+d560top
TLSH
T156B23A76E864DAA7EDE78FC6A70A7643DEE00267D68C4ED4C9D81D1E00971DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e47571cfb570af4dcccbd0e80be52e77a024d21606080a9df64753ab415570ab
MD5 12ea4bcc8e5dc505cd1e489cc58c546f
SHA1 98a97201aad4a9ab0036e0493a8b25c602f10025
SHA512 d888621f7dab9f36b934b44bcac8a2c9b1b57bcc990a086796f019f23df86aa88873f12f27be98286864d36d1dbaac43c7989e467bf2d4541b861c70f6fe068c
SSDEEP 384:nXniFavqMJ38Nr8TUNTUlIRSgPSY5dC6ZTGfHYlYm3fE+dm+60tMrN1k+5vI+l:SFayu3wwgL66QYjE+d560top
TLSH
T1FCB23976E864DAA7EDE78FCAA71A7643DEE00257D68C4ED4CAD80D1E00971DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b9c506c8e910ac61d8bd8791b699d1524b25d5b311349370839e566e1879460
MD5 b1911b644c0bb4e9cdbe0067f1a179a6
SHA1 a8e60cc92a785c269b1304b3de65d0f5c5e2b603
SHA512 91a2ee7d2b567470d6c4710df6ac09a3d9311a2e2992a13c59d756057cc459cf17fbfc4bb209d883ec0aafdfa8d94e7adb66297ece4c321f5cd551f2701e07e6
SSDEEP 384:nXXiFJjccCs+Bt0S3B38Nr8TUNTUlIRFgPSY5LC6ZTGfHYlYm3fE+dm+60SBFLz+:CFJccQh3wwgKE6QYjE+d560SjWIT6
TLSH
T155C24B32A8A4DEB7EDF78FDAA31A7643DEE0016396884ED4C9D84E5D00871DD134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 30d6cbc8d72ce26234d752451cb36506bf76981b5dd9b8e2f9b1a9fa92b1d01a
MD5 42a36253cbe600c7669b86975cac2c58
SHA1 988379114df8fe16c71a9897a324fc8f7901fe2e
SHA512 a17168b9fcb8dd0aadd20c3fe4b691f276c513b652756a38408722584d75ea1545701ccbd0a7e4ca217576e61bbdbb7510a3346ac95331db91472d3f21c4200a
SSDEEP 384:nRniFavqMe38Nr8TUNTUlIRSgPSY5kC6ZTGfHYlYm3fE+dm+60tMrN1k+5vI+l:EFay13wwgL36QYjE+d560top
TLSH
T1F5B23A76E864DAA7EDE78FCAA70A7643DEE00257D68C4ED4CAD80D1E00971DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ea5d069115411899acf304bdaba45ebd88c27f0e268423159192e03c6e4b8f90
MD5 deb37aea1bb50eceae4b250ec913fbd8
SHA1 d1f163dbc08663da322a06f8822a9d74eca6bed9
SHA512 eae13440e7c8f7efc7ba5785ec2b296fcce02072bf1f9d48268da50be9ef46fa96c67dd9033cf3520511aa4266c1bc44ddeb18f106a1f7bf5072653161ae9c5d
SSDEEP 384:nXniFavqMH38Nr8TUNTUlIRSgPSY5MC6ZTGfHYlYm3fE+dm+60tMrN1k+5vI+l:SFayA3wwgL36QYjE+d560top
TLSH
T156B23976E864DAA7EDE78FCAA71A7643DEE00257D68C4ED4CAD80D1E00971DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 09e7dca7ae8442ac033a67fbd75a1c65c9f7abeaefa3ada39624f316f1ade63e
MD5 88c7e15393cd8df5e4c3766a9ae0b53c
SHA1 11e1a30d6fd5d6de2d1bdf7e1c84a13d2175a3a7
SHA512 2c3b825f538e39222a8b4e7e7b4adbcffc806cf401784182d48f068330eb52d3a879a39a545403fa9c19bdf16738100f6e878c3dda77fbe80d582f815b94f6c3
TLSH
T126412FE1597E1AD1D0BE0A6FA49738FC90D8C62AF4B8307D2864ED984B3A50D244083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dd5d85f85dfc263b809ade32dfb4c532ca5ffd9b7b001c40dc8989b76edba0a6
MD5 775e992e5d2fe810d9a4d2b64ceaf014
SHA1 fb1e3480e75246a0354c20d41327c52212b0ca0c
SHA512 ef022fed3d7ff235a4236fbd463983e675af0fdd54620c6aec2d16266b1e44c49dbca456460139bd1625f436ffbc564dd220de6deb1ae361a3accf94a90494b1
TLSH
T18B4153E1993D2AD1D4BD0E6EB09778FC80D8C226F0B8307D2868ED98473A90E644083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_391325695\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4448_391325695\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads