hxxps://claude[.]ai

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://claude.ai
Sample260421-knrrlaet91

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
217	4492	msedge.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_173818958\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_173818958\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_173818958\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4680_173818958\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212347207876831"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{84A7C4E4-DC18-452A-9A4F-5A19FA2D369F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{810029F1-664B-4913-A797-EF2080252C38}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4812	4680	msedge.exe	84
PID 4680 wrote to memory of 4492	4680	msedge.exe	87
PID 4680 wrote to memory of 5236	4680	msedge.exe	88
PID 4680 wrote to memory of 5236	4680	msedge.exe	88
PID 4680 wrote to memory of 5236	4680	msedge.exe	88
PID 4680 wrote to memory of 4236	4680	msedge.exe	89
PID 4680 wrote to memory of 4236	4680	msedge.exe	89
PID 4680 wrote to memory of 2120	4680	msedge.exe	90
PID 4680 wrote to memory of 2120	4680	msedge.exe	90
PID 4680 wrote to memory of 2120	4680	msedge.exe	90
PID 4680 wrote to memory of 5608	4680	msedge.exe	91
PID 4680 wrote to memory of 5608	4680	msedge.exe	91
PID 4680 wrote to memory of 5608	4680	msedge.exe	91
PID 4680 wrote to memory of 4788	4680	msedge.exe	94
PID 4680 wrote to memory of 4788	4680	msedge.exe	94
PID 4680 wrote to memory of 4788	4680	msedge.exe	94
PID 4680 wrote to memory of 1676	4680	msedge.exe	95
PID 4680 wrote to memory of 1676	4680	msedge.exe	95
PID 4680 wrote to memory of 2432	4680	msedge.exe	96
PID 4680 wrote to memory of 5552	4680	msedge.exe	97
PID 4680 wrote to memory of 5552	4680	msedge.exe	97
PID 4680 wrote to memory of 3668	4680	msedge.exe	98
PID 4680 wrote to memory of 3668	4680	msedge.exe	98
PID 4680 wrote to memory of 116	4680	msedge.exe	100
PID 4680 wrote to memory of 4056	4680	msedge.exe	111
PID 4680 wrote to memory of 3840	4680	msedge.exe	112
PID 4680 wrote to memory of 5752	4680	msedge.exe	113
PID 4680 wrote to memory of 2272	4680	msedge.exe	115
PID 4680 wrote to memory of 2272	4680	msedge.exe	115
PID 4680 wrote to memory of 2272	4680	msedge.exe	115
PID 4680 wrote to memory of 4508	4680	msedge.exe	116
PID 4680 wrote to memory of 4508	4680	msedge.exe	116
PID 4680 wrote to memory of 4508	4680	msedge.exe	116
PID 4680 wrote to memory of 4344	4680	msedge.exe	117
PID 4680 wrote to memory of 4344	4680	msedge.exe	117
PID 4680 wrote to memory of 2868	4680	msedge.exe	118
PID 4680 wrote to memory of 2868	4680	msedge.exe	118
PID 4680 wrote to memory of 2868	4680	msedge.exe	118
PID 4680 wrote to memory of 3776	4680	msedge.exe	119
PID 4680 wrote to memory of 5064	4680	msedge.exe	120
PID 4680 wrote to memory of 5064	4680	msedge.exe	120
PID 4680 wrote to memory of 3432	4680	msedge.exe	122
PID 4680 wrote to memory of 3432	4680	msedge.exe	122
PID 4680 wrote to memory of 4176	4680	msedge.exe	123
PID 4680 wrote to memory of 4428	4680	msedge.exe	124
PID 4680 wrote to memory of 4428	4680	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://claude.ai
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdad0ec188,0x7ffdad0ec194,0x7ffdad0ec1a0
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,16249612217705535319,145245864539126770,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,3525488874072767056,17328192060084405282,262144 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,4761250742685443139,17633058733837605887,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,6360066145333904741,5425450356334111466,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,15687200197243426424,11252842039331432707,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,12209760536058284978,6022903998380592948,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10014561747544218277,13866273078845861531,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10451753409540588221,17752752866952235764,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,17927724844869918319,2881969538411407176,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,11147767715832744107,5252665910298428179,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8611723755799733529,7054819236619638377,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8611723755799733529,7054819236619638377,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,12766591702316737862,7748117590645556074,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5068548110971075262,11998139980956289114,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,7610740855506361433,17241384039572281941,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6680,i,10620228022240837078,3005888427169523768,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5452,i,14706522651719549221,10416981953174462371,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,12986310510838825086,1711915068014953188,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5456,i,15236468547044714931,17484711963072808134,2097152 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,16885489014034846698,5164947511487049256,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,14080153349352861441,6959327594195606438,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,2119420699586548113,13323515724532197520,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,3364618313724034988,16990464592359594636,262144 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,14846479717251865959,14009816665091401856,524288 --field-trial-handle=2304,i,16357664329759372333,5964149874428877098,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4680_1247126439\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4680_173818958\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 610a9e1580d1839fe492c55d97a669829beab503f54e7ab4ae901af505ab0da9
MD5 bb78940927729d5631512ab52720bf58
SHA1 eb5cec7ae1e57803d37dd523d399a21d7600d41d
SHA512 84df17e6b26ee77c8c1402f66a9bccf26a14c93c038398e8cb43070fd17df8bdb191c22ff082530d22fb6c20e111a6d4e3e42ca959305cee589f4f6645384f7a
TLSH
T124E02BBAC972EC2B08FD1B1854540786E744139B37D1898B7E3D830C8FB5A3B45C689C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e3152aeb0a942ff62820fa0e1a54486306713527c43134698091738fcc5b5f20
MD5 aa3df4bd7512ebd7bf1915e89fea4fb5
SHA1 50bb84bf7104f4827c93706c6d1f0420a88fae32
SHA512 b8f2f48ba2aada31bff55ad2460d01fc46117d3431e368a6d932aef9f65c41a4c7b607ef3ebd41dd89e25d1eb1b1b3441d2404c434e3b4c5b5a5bf00b6674c35
SSDEEP 96:q+doWDKSjWS4j44ggoAggV7KdIUFUqtqvIQDTxYTmgismmiWm1nm71VuIUPtT8Wr:9RD+z44gHAL7wIUFFiIQDTAMpmitnmLw
TLSH
T1EBB1C5903246E298FBE081B059F4090732B207FA75871EEA32F79C7F69F6BC5518B904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0b043c28091178e25bf72f6db7c275b718185e4809f963fe3d3b846fe6cd5f38
MD5 afdc2710a36de0c46b3af330304fd86f
SHA1 7b7cb39c8a3f4095485a450fe836a796248857e8
SHA512 13408998dfe6501a901b424d5c3a0c6fd7eb4f0c204e20843c6f0fdea30388244c97c4164c51cae28e9ddf021adc733e9fb9c1c58268e5c2f195d71a560bfd01
SSDEEP 96:jlrpf7wYYZPmgLSGMCdfPBX1CjVCLeIUiMwotLUnYE:hlTwtPpVJPnCueFiM9L2r
TLSH
T14E9170107242E658F7E052B459F8184732B447FA7A8B1ED876FB8C7FA9F6BC44187501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0b88642a66c3c8314812902d8655d5010a415e7b44f8dcee4b5b6ef40c7b9601
MD5 ad70753fcdfd66119d7cb6ecadcdaa0b
SHA1 0e546b7b1ff508682161877e5df30466e8465529
SHA512 032f356dca79104ceb7d1cb31ee75effc42b43559ca24bc515e16a0b680393ebb7daeaf8ebd90b0a4fc7414e8cbbaa1be691ef8c8c47830a1069b29078b168df
SSDEEP 96:Alx/J50U/+wT8YZPmgLSJMCz8jbuEBX1CjFulBxBDah87aIUij1wtldtLUB5KMlI:sBJ50k+wTZPmVUbuEnCeBxBDah87aFiO
TLSH
T11DB1B5407696E254FBE082B089F80A0732B007FAB9871EE632F79C7F65F6BC5414B505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58aec9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aec9.TMP
Size 3KB
SHA256 6353d13d2ccdebe3cb3a12ff74d83808d4acbfbbdcafc7427473bba46c14f0c4
MD5 723f61f54ac5a5b354263c6058845531
SHA1 183fedf61819260766a5fa12524e2a5afe79c8e8
SHA512 73c711ca89b34272bc937f09d23260ab78ad308cea3311690b5a63fb4ed213425363fa3999c2950253bdf4062423d991fc288680efa465228d005477188eb71a
TLSH
T1F661FA20725595A8F7F052B08AF50C4737B047F95A471FE936F68DBF8ADAFC14186A00
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 263bcf7638e84601b913975190bde9914dd336946584fc9ad76be313a0df7fb6
MD5 3c87cfeb1eaa260a94c1a93f1ed7e5c3
SHA1 883f21e6ae5ceb9a31e708aee312cd2297246462
SHA512 987472d2163b712e212c244bb9017085a8261e7b1716fb02dc95ad5b096fdd33f2570173d88d746ee93b0b43edbf9339bbc26d3c7b14e1a2383cb9d371380b8d
SSDEEP 192:D1a/i3yldZCuj0zOEa8a/JJJS1bwNXnqaQiPj6OI6ixTaeIemdulRxHepmezsK/:D1a/i3odZCuj0zOEa8a/JJJS1sRnqaQO
TLSH
T16822AFB7C3E5822ECA2161F8B7187E2BCF59051483183D2AC9D49F4BDBE2471E61275E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 34b391b3e4596b9f3683168de83abd476e1377271d6e80364a14c5bc5c5421c6
MD5 ef5f67c0fbb53d77fdaa8955a07469f4
SHA1 e2bfea55b74c63ce0a65ac5122cb44be174aeb20
SHA512 2504d839ed1d386e3f4ac5cabf8171d370602529c20df536bfd51a3e0acc8b34696a52e46d829dfc4eb8ffffca49d800c757a85a5af512c39f5ea48b5f602013
SSDEEP 192:sxZhRfyMqZ/K1Ml8UQW9y/fEscIhOVNqrjrdzodpTAJyHW6+WNHDBeusIlB2ZO3y:sxZhcqwy/fEscIAziWhHbsmlEA/amaDb
TLSH
T14B82E756A938897BCCDBD219F545BB57D7F9152391904E48AFFC8B0C00D7AED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 57e2b9172f4712e0a3919d5331291ef7f3ee494768374a68ea515f3ce18de2a0
MD5 8a10726fc1f8a603e4f8e5c781559d21
SHA1 cde99355d85a7cd0821622dba2bee3157dbf4949
SHA512 17fd88327e7b9d7cbedb6b35f04e1833b4f6c5646b6800044cdaee5306b9b74a85c1813695ecf6b3e292aca81bc259026d223a86205bf1118dea84e891bba67a
SSDEEP 192:sxZhRfyMqZ/K1Ml8Mky/fEsj8hOVNqrjjdzodpTAWHW6+WN+Lg/B0OHxKdVNmyXz:sxZhcMy/fEsj8AzimTHb5/kmajbz
TLSH
T13D72F8166A38997BCCCBD219FA457B57D7F90523D1904E48AAFC8B0C04D6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1d4c6520f5c04d44f94bc8c3a7af0517f2c79bd035eed1da841d7545cac72aad
MD5 a15fb9af8b2f32c83009c27bf0864793
SHA1 bf318b33b753fbdce778a71c055dd5869b9801f1
SHA512 80282f7ba7f28124c9c794d4fee42d7a0b47077611d8fa158d00136728eb5f70f143bad28cfd20be6bd82f974cb0c484a4f5718890576f3312e71951dc77c52c
SSDEEP 768:DcgLiAo7pLuL/aeWvaSXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbMKJLlhzCpUroT:DcgLiAUE/aeWvaSXqu1jayMKJLDOp/T
TLSH
T169F20C3B6C0CCB7E4F844A9CEC2ABE8E6DE402CB9698C95447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7b212e5eb65aa64953379f32fc6ef95eeb2654c75f5aab73b2d2c81d6dddbcfb
MD5 cc11d0c119613a747fece497f306cb16
SHA1 9d9ce9e790e2fc6f3ee71a99fb5d7b883825303a
SHA512 0142dc1b2bbb41827552bb7b4d2d33d7f15db43729c5e6cd29719b64a536e6cb88a0cc63727045f5604850f64dc335c96995cefd0823c2906a831ee3d676d276
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BL+xw/E7fB5p:krN/INhx+kcxKBzxLaf
TLSH
T163B25C11727A02813A7E399A8594B41F76C270633098F93B7BB954A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b4368590-6d3b-4b43-a5d4-b0f86485a420.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4368590-6d3b-4b43-a5d4-b0f86485a420.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e89c7a91d10f62357c899b1670353b73c3edd7e17e0193a22130499d842dcbda
MD5 d76e2edb71b9778995f46bc26940733b
SHA1 0f35dc8b9e56256e81cf7381a2b908a02c596486
SHA512 d82dd7e7911168cbd9eac4392a3f6cd59dcba3b798045724291c5996b6aa24ca61dc2c35c2532fc9ec9a85761bc10ea931128f6940e6300de6a63f88d24dcd65
SSDEEP 384:nviFavqMg3sNQ8TUNTUlIm2ZTPENj6OEfjYAibQs30zRYV/Vw1mR6dU5rN1k+5vx:6Fayv39wgHoyYl8s3kRYk1m8sB
TLSH
T11CC23A36EC94DAABEEE68FD9A7097A02EFF0116BC59C49D4DAD81E0D00D719E1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8eb5e765d29bd1001021c0d85294b68790c42f7edc676f1fa3c9200bdae59334
MD5 7729cf0f14cf631fad31d75fa448d938
SHA1 8c5cd6761fd67b82b81d7fae03f87cfd39d74b41
SHA512 eeb09e0fdf1f7f4839771c119621c8203ca84b1cb03b08ee80b1a106f7a13e34965f6909c5c3211db001f141dbfd2f5189c918b0f95afdfa6b031a5d40e37ea6
SSDEEP 384:n+iFavqMg3sNo8TUNTUlIm2ZTP9lTOEfjYAibQsClXxRYV/Vw1mR6dU5rN1k+5vx:VFayv3VwgHPJYl8sqxRYk1m8sB
TLSH
T17DC24A76D894DEABEEE68FDAE7097602EFE0016B858C49D4DAD81E1D00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d0a2ce72979fcc1e821aa4de16f065b29e3d2d6f50104bfadee1ffb534afdfff
MD5 fd71aeddae30f8644270c2d7a93f09e0
SHA1 eeede2c066edbfdadde7650a109e6abed974104f
SHA512 8794a6ef59bc0c16a2ee9ab92ede9902af5d3db3a134a566c8b4570ef86835d2e5874de8b516aab3dbf30cdd0ad38dab542eee84180ac75d2e0c82c25542adaa
SSDEEP 384:nSiFJjccCs+Bt0S3MtsNE8TUNTUlI4nZTP0b5iOEfjYAibQsClHxSBFNVrN1k+5s:ZFJccQEFwgcK6Yl8swxSn8F
TLSH
T1BEC24B3698A0DE7BEDE78FDAA70A7647DEE01167859C5AD4DAD85E0C00C71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 063fe2d39e8c7c4af3a012d5638a9b0a498851d55244d1a1dc8ab9c5fecb4f0b
MD5 ec961a390afcb9ddb0bd7fe0b493fff6
SHA1 345f631e9685e9ccda967f0c37becf2bf9cec8fa
SHA512 36f044b30ed9213f6d59722a84fb23e85fd451a2527bc99e87cde41b4121a017368d56cd5c0878c2094d084acec6c417f2f77a88db194e2a891c1c3703c802fd
SSDEEP 384:n3iFJjccCs+Bt0S3MD3sNE8TUNTUlI4nZTP75iOEfjYAibQsClHxSBFNVrN1k+5s:yFJccQ43FwgcR6Yl8swxSn8F
TLSH
T1C6C24B3698A0DE7BEDE78FDAA70A7647DEE01167859C5AD4DAD85E0C00C71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 83a81343c6c846cfe81daeceb57b646bbd9e42ab36ef76b9a42b8d08689e8c3b
MD5 2490d28cae46141e1b002c5033d7eeb2
SHA1 1a90467ff82b5197e7388549c2826a87a5fa6d40
SHA512 9b3192f46d16a7093131a35dae984031a5730952fdb97efa0416cc3fd064a7f3a673304a8504e2b6ccea846d333731f0eefd82fde0abe35d69d3cacb5bfe9754
SSDEEP 384:n0hiFJjccCs+Bt0S3dYtsNE8TUNTUlI4nZTP0bgiOEfjYAibQsClaxSBFNVrN1kr:0IFJccQCFwgc76Yl8sbxSn8F
TLSH
T1D2E2B2F598D38977E9AE4B97A33D2E429AFCC157B5481994BBC44D0CCC861BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7c1f2b1bd53c4fe6032ede67240ce6fed29828faa8d98cf91d5496fb61d21e39
MD5 bf5ec03d6c54423388968c6494a2c0ce
SHA1 0cad34d784bad35d94cb2aa8a0b99b11fa6b4051
SHA512 a4417ff7897634415829d2c2354b7f6aaaadfc44493d974e68d902799b41ca06ae973e4da1e425e3cda2290b13df3bdea46560e7b462e82f7c0de5276483e156
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5983fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5983fb.TMP
Size 392B
SHA256 90a258f0a0a21d972e6763298443a0b3cbd5a319e00aae9fdb1f23519ee15cbe
MD5 401e4a540998db10015972d68057e650
SHA1 a1cf002f1a31933320ac322d3702f1322a5122e7
SHA512 4d74d4aa9a637ec6f115458accae74a41002840bd6f77da09424e1ed441a223048ea526a0f6324376fcf3548f4a27d0d533d465c412de736a9e8ec8faaa7f183
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0855bcd6d9fc320672291f357dc3b46b5042304ee7d349c12ef68c5c5c143464
MD5 f5fa4fef28a470b0653600ebbc6cbec7
SHA1 234a832741c2378550e71e06e3bee25e8aaa6300
SHA512 aacab8ca38159b0eb5f211413d8a09972bc871403e2857d110fefbbe95e3fb595ba23a3ee303d93f3f4941045e10ebc9a104a526b9fb83e00ab7c7a55e57b338
TLSH
T1C83121D19C3D2AD1D4FD0E6EA04B79FC44C8D226F1A8757D5868ED98463E91E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8693597a3e334a616eed7d01c2afa93e59e537df1f53d0cd18003e97841e0d9a
MD5 27de1439b3dc8c623177520eeceae49c
SHA1 d8f69b6f823d1a9927668e6ca3097b70ca740f1d
SHA512 6e85fcd4d54ab5e008f3edb4ce08985349713b7f9591d53d02f2bbe1565e83760cb1a2ef796b5a935bee232be27298168f198fbe874770d7b5b6949e53fb8a2e
TLSH
T11A312FD19C7D1AD1D4BE0A6FA08B38FC84C8D326F5A8747D5868EE98463D95E284143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 62ecb231696f7e9d5e13b25c0b24d21c6075a30a5e772e0d1f6e81d0124a75df
MD5 e9046117fb6d8748c2975f70af8cb403
SHA1 562e5bcdd7fd8b784ffab60b0ad593272c14cce9
SHA512 15590fc4d7f344917116342ee6024a27f7c8d5c3e998d15482f37e9b68b9c0209adc3e09e9e4e112236fb28adf238edc304e1c115fc2d4a47f76cd081ed1ddb9
TLSH
T1C0411858A6FA2104F3B76F5A9BF6A86E487B79772E16D45E10110D0F0A22F40CD71733
MD5 SHA1 SHA512 TLSH

Submit Download

Claude Setup.exe.crdownload

Path C:\Users\Admin\Downloads\Claude Setup.exe.crdownload
Size 6.6MB
SHA256 9a4a6467268f25a086e715f56e70c9b5c2be7590d80256ad645c9f7842c1db38
MD5 8189af2412a64aa2e3cd0f7eec92353c
SHA1 a43ae10491ae0260ee044b9edb16bc3fd9b4dcbc
SHA512 19f4e07052676340340c36403d02e87bec92a7410a1de8c54b445264f71f00dda8f03bd334f65047d50ff8af8fecfff51749f2ef29cb01113503ec0ab802dbe9
SSDEEP 49152:c5B+cwmBHCswnhpQakbgLVnAknxMYt8HGQCVvj2+oOAr5j1MsqTemwAje4eBszwf:chBipH75JxggvC+e6b+mM1Ec
TLSH
T10B665A07E8A515E5C0AEE1358A62A293BB717C485F3127D72F90F7382F76BD06AB5310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-306-0x0000025059360000-0x00000250593CB000-memory.dmp

Download