72ad78d2ee3f66ad993b68798b32b740a8d826b1980805eeee8f18c05bd9a077

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenTRANS-OrderV1.0.xml
Size 2KB
Sample260506-pg778aet4j
SHA256 72ad78d2ee3f66ad993b68798b32b740a8d826b1980805eeee8f18c05bd9a077
MD5 b9981da8c6086f205ce6ac27009a118f
SHA1 f5611062a2fa990205e674a373e546a5b2630b37
SHA512 d9989f40f9234d00c36178add9b0526178ba5c6e97c6f213ffa159d29d5ecd0f3f3f96b95ab23753f842d7453d32e2f57845426b3f48648186ccbe66f4e06114
TLSH
T1295133D2C52F6FCA8F2264F9536C10AA526DB0E8856408473DAD3B1B47918F6C6F8F14
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_60725304\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_60725304\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1479173798\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1073165214\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_60725304\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1479173798\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1479173798\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4392_432019169\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1208307627\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_60725304\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1200152687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251828"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225435838533539"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{CA80AB69-249B-4505-9DD1-9C413F284BDB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4392	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 396	3524	MSOXMLED.EXE	79
PID 396 wrote to memory of 4392	396	iexplore.exe	80
PID 4392 wrote to memory of 3920	4392	msedge.exe	81
PID 4392 wrote to memory of 5000	4392	msedge.exe	82
PID 4392 wrote to memory of 5012	4392	msedge.exe	83
PID 4392 wrote to memory of 4880	4392	msedge.exe	84
PID 4392 wrote to memory of 5012	4392	msedge.exe	83
PID 4392 wrote to memory of 5012	4392	msedge.exe	83
PID 4392 wrote to memory of 4880	4392	msedge.exe	84
PID 4392 wrote to memory of 2292	4392	msedge.exe	86
PID 4392 wrote to memory of 2292	4392	msedge.exe	86
PID 4392 wrote to memory of 2292	4392	msedge.exe	86
PID 4392 wrote to memory of 1612	4392	msedge.exe	87
PID 4392 wrote to memory of 1612	4392	msedge.exe	87
PID 4392 wrote to memory of 1612	4392	msedge.exe	87
PID 4392 wrote to memory of 2444	4392	msedge.exe	90
PID 4392 wrote to memory of 5156	4392	msedge.exe	89
PID 4392 wrote to memory of 2444	4392	msedge.exe	90
PID 4392 wrote to memory of 5156	4392	msedge.exe	89
PID 4392 wrote to memory of 2672	4392	msedge.exe	91
PID 4392 wrote to memory of 2672	4392	msedge.exe	91
PID 4392 wrote to memory of 1764	4392	msedge.exe	92
PID 1764 wrote to memory of 4548	1764	msedge.exe	94
PID 4392 wrote to memory of 5172	4392	msedge.exe	95
PID 4392 wrote to memory of 6064	4392	msedge.exe	96
PID 4392 wrote to memory of 6064	4392	msedge.exe	96
PID 4392 wrote to memory of 1488	4392	msedge.exe	98
PID 4392 wrote to memory of 1488	4392	msedge.exe	98
PID 4392 wrote to memory of 4688	4392	msedge.exe	100
PID 4392 wrote to memory of 4776	4392	msedge.exe	101
PID 4392 wrote to memory of 5932	4392	msedge.exe	102
PID 4392 wrote to memory of 5864	4392	msedge.exe	103
PID 4392 wrote to memory of 5864	4392	msedge.exe	103
PID 4392 wrote to memory of 3508	4392	msedge.exe	105
PID 4392 wrote to memory of 3508	4392	msedge.exe	105
PID 4392 wrote to memory of 5968	4392	msedge.exe	106
PID 4392 wrote to memory of 5968	4392	msedge.exe	106
PID 4392 wrote to memory of 5824	4392	msedge.exe	107
PID 4392 wrote to memory of 1976	4392	msedge.exe	108
PID 4392 wrote to memory of 1976	4392	msedge.exe	108

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\OpenTRANS-OrderV1.0.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OpenTRANS-OrderV1.0.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/OpenTRANS-OrderV1.0.xml"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ffced32f208,0x7ffced32f214,0x7ffced32f220
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2236,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3316,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3324,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4796,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4812,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5296,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5700,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5704,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5704,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5976,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5524,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=732,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5876,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5880,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5140,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5812,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5896,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5080,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5776,i,15748584764561188902,9155112372791297862,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d42af73b53ac9ac969b2a7847dd50295d23541efbe3e7a201d570995913f736f
MD5 b0d76937840f1bf3341ad1a83cd7935a
SHA1 5eea9891f9df35b3b3aa69f1366b7c5b0def5f2b
SHA512 9021c5e31c1ec851307517c747c7f33c132c434fc1c18369c6bba2cee4993e2fe2635023f6f80f03a9f22bd3c4f7ed71548282f877baf476a6f52c215281702e
TLSH
T1C2D099A33F28A282E08A08B0A3320AC8AB008080300002E8CA020808280B2C22EF80EC
MD5 SHA1 SHA512 TLSH

Submit Download

61790c78-d8b3-416a-bdba-3d904d3598b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61790c78-d8b3-416a-bdba-3d904d3598b0.tmp
Size 15KB
SHA256 d7efc998cdddfa2f90d31fb53a545e716e233d780abe351fd4de396284b259bb
MD5 4cec42692bf39d6bf2433e960eef794f
SHA1 c420401de3e96e4a2a70fddb9912da034a0caa93
SHA512 b60cb6b6737fce9bb1cb4532afdf0011e19fd5da5cc899ed28e2146a5f7850b40d95bdf9e64762565400a9d073a96853d9c71d63dcca3a38676af229d904a392
SSDEEP 192:sVRRCyMqv/Ky0Ml8M3pnIsle+Ch/HGSzhKKzoZ8pqY/Y+WNrY0H6SBDeeIIImBwq:sVRtLPpnIslenNHzs4d/Sr5aZeIIIpWP
TLSH
T1F672F9195A68597B8CCBD618FA427F53D7F8156392815E48A9FCCF1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94853bd8-c280-4659-94f0-8f98ca71772f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\94853bd8-c280-4659-94f0-8f98ca71772f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ace2960bece44c429ce38d014cf2822cfbfc7f073ded06cd392a7e8b9201db21
MD5 91d116d8cb78553f452b5fd1ebf7c455
SHA1 f798dc1fc67b47673af1d247b9db9f7dec48d3ee
SHA512 8cc646ee212ccacf53ecf34233602583244365f3dca10bc04f82f50fdfe843488050c12f534001e66a6a5e8eacc9f956e7f9c86cf5a88d3b38f4c6cb9f9b251e
TLSH
T11941EDF3C3E8856ECA5195F42A28BE2FCE1D0614432C3D5A84D4EF5B93E2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d1a839e4df78493cab7f2ed6e3fb8e2430535dd0be142766adf51092b619fc4d
MD5 e8f0eedfe7d37a1df60d0a76c30b5d8c
SHA1 b4f8aadae316a0e4abc8bb6a44e2f1ca1b1d936d
SHA512 fb2b9fe5796206d4e44d3f6f74bf8d15ed356983912d52ef7d67f9260b0503352b033b371a7e2e0163eb487cf2c3ce4d940d188b82243e595b420f3bc8ea496f
SSDEEP 192:sVRRCyMqv/Ky0Ml8UQi3pnIsle+Rh/HGSzhKKzoZ8pqY/Y+WNrY0Hb3OeIIImBwR:sVRtLqSpnIslekNHzs4d/Sr5ieIIIpWA
TLSH
T17172FA195A68597B8CDBD618FA427B53D7FC1563A2415E48A9FCCF0C00E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 5e5adcb664f4cb1793a124bedf80e65ed2173ab81a21d84137b4fa484adf5a89
MD5 4fb3ec648c318fc61f37000797dd52b8
SHA1 203c99b480113c280efa99b54081b56889926f5b
SHA512 8a31419981eb8166238d9788fb52f38a152357679b80c89fd9f41c6eb65137fd01655fee958b90e7f2e2146d11c12a6c3151449034d5b79943ddbdf17dbdc582
SSDEEP 768:sgnrwBw8rE2AW7pL/Ln3LWRWLFQn58F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/T1qx:sgnrwBw8rE2A2Dn3LWRWLFQn5u1jaK/q
TLSH
T10C031D3F284CCB7E4F805E9CDC2ABE9A5DE8018B5698895447FA840C03D66EF451A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8d49a1d67e5b834a7ede536f806c94140ad99055d8847ed89204f75857279ec9
MD5 ab97efd3f10fd3332bd4986b581b52dc
SHA1 92d23d2c05208a6e44ebdb70602c9ec2aee057ff
SHA512 97c390edc0a25fea050d1198a9caa89de705357d3503f30bd8658b3eb9268a4fc9f1dbbc5742a404ba59e0877f99410beacb2ea3178e30be84d9423e4afed497
SSDEEP 96:NNKL26KmxKDG+K6rKvuIKfQKNS9mZdTbL2lb8dd2Kjff90P04RAv7ZLvzwf+LTzN:kg6iS9mZdTbLQb8ddtff90P0ihShnz
TLSH
T1EDA23831707E221C387D2A9871B8916F965260A37050A4AB7A6934E6CF67E304DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 51926acf5744f91a39eb6a24fd6cd8309326121bf05bee92b44afa7c8b190de7
MD5 12c7ede7741e9911ab2c5f9573d53915
SHA1 acc9a5b97443bc134bb56f0821db2b21fb14ffe9
SHA512 42ad6545465ba7637c26fbccf41f2ee1624cbac9e0fa98730d5eeab6a203508cce22ed2460239e03d27c88bfae1074e0e8962483d5ffeea44687bf62686bc774
TLSH
T17DF0ABA3C41B3D6B0872313849261690FE25630F428A50DE3ABC004C2FBA9390ACBA65
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60ee36449746c4666cfb5f2e5cf8ea3bfdfd735b33b4784e7b51c4b8bc124693
MD5 ed9621bc4f804a57f7859c579461bad6
SHA1 db9517cd3cd98204c10e080b921afcfe17efd2f9
SHA512 73c26e01c309302f825896dbd73c602137b81d11c851eea6bfb356da221e5d1fe2f6c8847a5e60eb83b1daed9d9dbd91bae2306bda148c259b5736b7d73d143d
SSDEEP 768:UFiE6esE8lDldUGz3UCg6l7T/Qu5zugD6JCgEooovGqsW7iIKu8fqGotE184r:deB85d73nl77nR68gRoWGeiAhGiE1L
TLSH
T1A3036B3D9C84CD7B18DE9B48D30E366BAEE011B7D5684BC8D7C84F0E10A6099F74B969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e8425d98a722f6f327226e53a7cc56e40a67f45ade4b43b6c8edb422241024a6
MD5 dc482cc0293908fa0e50e2394b1febca
SHA1 d58d32301a98d2eebe2cdc22ffee9db6d3a1eeef
SHA512 bb9a457bb3f50ee779661f2c33f5f2a9c14ac955e50f88d638303a0a684675f2fa9c68ad92662d360a695041d90a10c47fa4d815c4256684d5bae157f92d703e
SSDEEP 768:pFiE6esE8lDldUGz3UCg6laHQu5zubBDiZovGqsW7iIKu8fqGotE184r:IeB85d73nlunywZWGeiAhGiE1L
TLSH
T197039E36E898CDA36CDA8A89E30A37576EE011B3D58C4FC4E9C98D0E10870AD774FD65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fee7016415ca0924051ce432d7f7e53ccab9ed31ddf8f4ae33b6f54a6996f42c
MD5 0b4b17ae94d73a920c14ee7907516b20
SHA1 958ea872921bc7cb7566a575b28dc75469b1562d
SHA512 263f662cbb376ed709c7de4a1323266f44718a0b98d23429fe5e258dd9eb93db850fb2e819a93766deaeed9389b2c9b183072349abbfa82a58bc86dd66a8e836
SSDEEP 768:9FxTRMUVai1SKqvA3/CgwtnElbSQu5zubBmiyJLUE1IIovGqsW7iIKu8fqGodb:1T3oSvqvA3stnEl2nyHQQE1fWGeiAhGe
TLSH
T1A713A075AC94CEA76CED8E9AE3063647AEF41193D6CC0F88D8C85E0E04865DD2B4FC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 eca4cb0235eeeca1e5bb8f488158f0cb2d6c4d8e8d497573665825b77f7c2642
MD5 66f7f4ad82dc2e1eaf1bd10b56b13ee9
SHA1 503ff24146fc83cde37360b4988ca59f781ef496
SHA512 4a4b2b1627b98212dac1904a59d889d23e9245906ebdf582ebe1d953400389eba0cf69cc7fb866b8b6c55da440ce83f876ffd919e40108a43634287ec5d801b9
SSDEEP 768:zFDTRMUVai1SKqvb3/CgwzBl1SQu5zubBDiyJLUE1IIovGqsW7iIKu8fqGodb:pT3oSvqvb3szBl8nywQQE1fWGeiAhGe
TLSH
T16F139F75A894DEA72CED8E9AE3063647AEF411A3D6CC0FC8D8C85E0E04865DD2B4FC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c3394aae69ef552067708e809b6da31546436ee5403ccc39eac407ff71baf98b
MD5 8c630168a4a8dc0d30cfb28f1f5cb44c
SHA1 34dafbf49830126f8ade507e119e310967707cd0
SHA512 2dda6770eabb8ec36300aed11ad1f42a49b369fc11542dbbd6b2cbe75320db26bf27f9bb5f7a57d99a6a763eec9a5ee7f9013f06927bc08f2a107b15e5ce782f
SSDEEP 768:zFxTRMUVai1SKqv/3/CgwzBlbSQu5zubBDiyJLUE1IIovGqsW7iIKu8fqGodb:/T3oSvqv/3szBl2nywQQE1fWGeiAhGe
TLSH
T1AB139075A894CEA76CED8E9AE3063647AEF41193D6CC0FC8D8C85E0E04865DD2B4FC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1073165214\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1073165214\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1479173798\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1479173798\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_60725304\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3524-13-0x00007FFCFC360000-0x00007FFCFC569000-memory.dmp

Download

memory/3524-5-0x00007FFCFC360000-0x00007FFCFC569000-memory.dmp

Download

memory/3524-7-0x00007FFCFC360000-0x00007FFCFC569000-memory.dmp

Download

memory/3524-0-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-6-0x00007FFCFC360000-0x00007FFCFC569000-memory.dmp

Download

memory/3524-4-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-1-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-8-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-12-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-2-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-11-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-3-0x00007FFCFC404000-0x00007FFCFC405000-memory.dmp

Download

memory/3524-10-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-9-0x00007FFCBC3F0000-0x00007FFCBC400000-memory.dmp

Download

memory/3524-14-0x0000018AEEC30000-0x0000018AEF09C000-memory.dmp

Download