13d4c70efc151d0fbb54e35290c480a182406999de31ec922b296f2202b91304

Analysis

max time kernel
148s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/img/down-arrow-dark.svg
Size 1KB
Sample260508-pgcfjsb13r
SHA256 13d4c70efc151d0fbb54e35290c480a182406999de31ec922b296f2202b91304
MD5 1bf60cafd50eecfb52ec74361e2c6a8d
SHA1 620ea73042ab8bd21e4595c22c01b46f94d60873
SHA512 58e83e79e29e482b3b4598a2dc7322768117977807479f3a2f7b046b06bd3dbb8df6881483c024ac504ffb138d4ce1e5ed5d3002eb2e707f814fd79ba48353ab
TLSH
T1D41112D8427D46A8E10D5321E7BAB61EBC6A30D7E8C40954B08D2815EB748F7097F3DB
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_826846668\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_2099937825\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\lv\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_826846668\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_2099937825\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1874000433\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_2099937825\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1874000433\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1874000433\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_57623791\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31252280"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2022159551"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227176411835849"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{0C9A0A2A-5375-43D2-8ADA-2E8BC3852586}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
564	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 564	776	iexplore.exe	78
PID 564 wrote to memory of 3024	564	msedge.exe	79
PID 564 wrote to memory of 1136	564	msedge.exe	80
PID 564 wrote to memory of 4900	564	msedge.exe	81
PID 564 wrote to memory of 4900	564	msedge.exe	81
PID 564 wrote to memory of 4900	564	msedge.exe	81
PID 564 wrote to memory of 4864	564	msedge.exe	83
PID 564 wrote to memory of 4864	564	msedge.exe	83
PID 564 wrote to memory of 4972	564	msedge.exe	84
PID 564 wrote to memory of 4972	564	msedge.exe	84
PID 564 wrote to memory of 4972	564	msedge.exe	84
PID 564 wrote to memory of 6024	564	msedge.exe	85
PID 564 wrote to memory of 6024	564	msedge.exe	85
PID 564 wrote to memory of 6024	564	msedge.exe	85
PID 564 wrote to memory of 5484	564	msedge.exe	87
PID 564 wrote to memory of 5248	564	msedge.exe	88
PID 564 wrote to memory of 5484	564	msedge.exe	87
PID 564 wrote to memory of 5248	564	msedge.exe	88
PID 564 wrote to memory of 4640	564	msedge.exe	89
PID 564 wrote to memory of 2172	564	msedge.exe	91
PID 4640 wrote to memory of 6056	4640	msedge.exe	92
PID 564 wrote to memory of 5772	564	msedge.exe	93
PID 564 wrote to memory of 5772	564	msedge.exe	93
PID 564 wrote to memory of 2276	564	msedge.exe	94
PID 564 wrote to memory of 2276	564	msedge.exe	94
PID 564 wrote to memory of 5384	564	msedge.exe	97
PID 564 wrote to memory of 5384	564	msedge.exe	97
PID 564 wrote to memory of 224	564	msedge.exe	98
PID 564 wrote to memory of 4840	564	msedge.exe	99
PID 564 wrote to memory of 1528	564	msedge.exe	100
PID 564 wrote to memory of 1388	564	msedge.exe	101
PID 564 wrote to memory of 1388	564	msedge.exe	101
PID 564 wrote to memory of 1684	564	msedge.exe	104
PID 564 wrote to memory of 1684	564	msedge.exe	104
PID 564 wrote to memory of 3752	564	msedge.exe	105
PID 564 wrote to memory of 3752	564	msedge.exe	105
PID 564 wrote to memory of 2152	564	msedge.exe	106
PID 564 wrote to memory of 2152	564	msedge.exe	106
PID 564 wrote to memory of 3740	564	msedge.exe	107
PID 564 wrote to memory of 792	564	msedge.exe	108
PID 564 wrote to memory of 792	564	msedge.exe	108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assets\img\down-arrow-dark.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/assets/img/down-arrow-dark.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2c4,0x7ff9d9cdf208,0x7ff9d9cdf214,0x7ff9d9cdf220
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2536,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3388,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4760,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4876,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5636,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5648,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5648,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5724,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5932,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6112,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=736,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5668,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6180,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5016,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6332,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4956,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5844,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6448,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5284,i,10611366287196562770,3472454559493006158,262144 --variations-seed-version --mojo-platform-channel-handle=1172 /prefetch:14
    3⤵
    PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d42af73b53ac9ac969b2a7847dd50295d23541efbe3e7a201d570995913f736f
MD5 b0d76937840f1bf3341ad1a83cd7935a
SHA1 5eea9891f9df35b3b3aa69f1366b7c5b0def5f2b
SHA512 9021c5e31c1ec851307517c747c7f33c132c434fc1c18369c6bba2cee4993e2fe2635023f6f80f03a9f22bd3c4f7ed71548282f877baf476a6f52c215281702e
TLSH
T1C2D099A33F28A282E08A08B0A3320AC8AB008080300002E8CA020808280B2C22EF80EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f5a3ad45691bdb5f89eceb8a75624ade552ae741536f54d67dd825849b12c83
MD5 9a31c61ddd4b382aec38a55e211f4764
SHA1 dd252d87a290cb4ea8e190bf20d69ff3551e2edd
SHA512 c06893232ba671ef6a60a79973bc434856a82be4b38fc6992867bc2081e8a8260899a538a89b29d74e6656300535b0c64f97025775834871490583295e9e33a7
TLSH
T12841B0F383E4456DCA4195F42A247E2FCE1D0614432C7E5A85D4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a42ba9e4b4a0e9a658fa893ae485d47d763691fbf4e16f077143e9cf1089a505
MD5 d3bec4e13ba5cef5682c17fdc05bec0b
SHA1 4902f8bd66df3a80e56848cbd9757ea4dd3dbf1a
SHA512 94f77ab0a431bf467d1721a859226dc467ca5291cf2e8be92c77184f76eb401b2aa82ee8e2d7c52ee4c04c99fc3d5a98cfb927ca1ca58c6e0f597dbf20181119
SSDEEP 192:sVLRKyMh/Ky0Ml8UQV3pjQsc9wGYzhKmzoZ8pMe/Y+WNrY0H682eIIImtUIIgCMQ:sVLCLqVpjQsc9qssx/Sr5seIIIRE0b
TLSH
T1D172E9196A68597B8CDBD218F9527F53D7F9252352405E48A9FCCF1C01E7AEC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1742830ddacc9147d54aeb04262bd7a67145812755314473ca91a898836116b3
MD5 63cf59c7dbc51aeff86453f1a926544a
SHA1 1dbb1aa7706ba065e1d109786f0bccb4dabb7fdf
SHA512 ab9d064529b423063623419b1d6334dd10903893d6d0d6daf02550dc908076cf6d73be3457dd557ba53a2ad546e38a27712b2b9ac273e51c79ad22a43f7caddf
SSDEEP 192:sVLRKyMh/Ky0Ml8M3pjQscxwGYzhKmzoZ8pMe/Y+WNrY0H6SBheeIIImtUIIgyOb:sVLCLPpjQscxqssx/Sr5azeIIIRE5b
TLSH
T16262D8196A68597B8CC7D208F9527F53D7F9252392805E48A9FCCF1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 caca6f8935b3fd0eb9489c5f6f600375ef4bd1cae815cb43c6c9581ccc2766c9
MD5 ba778211dedc27e8e8d69d21195b1740
SHA1 78f3ceaa385546b3b45caccab500fe3567face22
SHA512 b2f7e9db154c7ab2d7ff57ac09c0ce422d2c4221669ed821cdae56a6c8f9c548b41ff3a174673d5dc9988c77c2985fdc249c2eb0235d013d55254c0b093a79a8
SSDEEP 768:sgnrwBw8rE22k7pL/Ln3LWRWLFQn58F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VK1qP:sgnrwBw8rE22oDn3LWRWLFQn5u1jaKV3
TLSH
T114031D3F284CCB7E4F805E9CDC2ABE9A5DD8028B5698895447FE844C03D66EF411B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 5b3f16d884920f74dc5e746e7b514e2819243689aedd04b8add2dd02bb331b7c
MD5 e4d9cc2fe8f0bf9a77f80e5a23c2b547
SHA1 b8de213c132af255669deb2bf58ad8ad1d24162c
SHA512 2eba601ce24e6065fbc72b6e260d22efbfaa48e862b33fcdcc0a2765116a2598f3373f440f9a7900ffc7c9ce8b1de1ba73d94225808fd86d373776323563b734
SSDEEP 96:NNKL26KmxKDG+K6rKvuIKfQKNS9mZdTbL2lb8dd2Kjff90P04RAv7ZLvzwf+LTzf:kg6iS9mZdTbLQb8ddtff90P0ihShBr
TLSH
T1DFA26A31743E221D387D299871B8916F965260A37050A8AB7A6834E6CF67E304DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 7814265f62d41f0846823f16f38e311eb7a3ac2e969993d0ff3f72730c33fe2e
MD5 2534be18a1396ce519ea0cabbff4d83e
SHA1 339ee29accddde7b0771c501978b706b8bff191a
SHA512 d457bbee206e122cd558ae39eec987876fe2907af7efdd865d6a09fb969cd555a59778331b5c04cdb227cde7b0416311c59bafa69dedcdcaa57abf99128d9fc3
TLSH
T139F0AB53DC0A3D6B0972312448221690FE14330F4546B09E3ABC104C1F7E83B05CBA66
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 96843a3a46ae606e971a8278bf8bcd6d55b58837c1456d06a77bad0d008122aa
MD5 667eaca446912d54f8998ebb7c17d275
SHA1 9f60b6631799bc25521107cb326405e8b4a095d7
SHA512 b3445343a319b57fbf5fd6eac53457ecfa6c6570b2e837facbbf6841a34c510ce2a86fa7bfb1602d022420c6707b8ee0093380e62b1be5066adaef6dd11859c8
SSDEEP 768:sF60raxyp4sQe6WGfv83/CgK7QlUiQu5zudV+AJE1covGqsW7iIKu8fqGodZ:Ob0e8fU3G7QlXne4AJE1cWGeiAhGo
TLSH
T16413A03A5894CE676CE98E86E7477617BEE010A39ECC0BC4E5C45E0F018758D274FC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8213f5046d4751054583b6ead9c5b5fa72731540d11b6568593cb549cc4779fb
MD5 8ed476a94e3d69165e4c70eed1ba0d5f
SHA1 d79ca2e4c647796d7a161c3782060648cd8c8946
SHA512 0066abe258827f619801ad8a3d06596f512fca5a5622775bf1db4b498f03829d3e83b32033d63bff31d9a94965a07c0d2edf8c978772f7ba5963b355fd3b191a
SSDEEP 768:aFiE6esE8lDldUGz3UCg6lRGAQu5zugG6JCgEoiovGqsW7iIKu8fqGotE184r:7eB85d73nlRFnQ68gRiWGeiAhGiE1L
TLSH
T128037C3DDC84CD7B28DE9B48930E3667AEE011B7D5684BC8E7C84F0E10A6059F74B969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d492f8792a3733439db3ef5f447a1df22cba723bb5cf4c5c830784778582bbe3
MD5 3e8e5b01aa138fe0298e15313adf3f27
SHA1 cc17c48f9cf56ca6d54f56b96f9acec01318dbd5
SHA512 46ecf8db963263fb2c7ad1a1c0e5f185b4e0209ce1e7860052bc2cd6e074fefc1895a05eb248591b5e1d5c386bb02e7b3c2c72947cc373e3a5feaf2810cf0d14
SSDEEP 768:NF90raxyp4sQe6WGfvd3/CgK7QlYiQu5zudm+AJE1covGqsW7iIKu8fqGodZ:ab0e8fV3G7Qlbne9AJE1cWGeiAhGo
TLSH
T15413A03A5894CE676CE98E86E74B7617BEE010A39ECC0BC4E5C45E0F018759D1B4FC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8b0b2cb918f99bb8abef1345de33288cd62256d132aa1b8df543b2509de2a793
MD5 d50d1d1cd1b80db8fe71d374a34d2c46
SHA1 c566f3af905e4666931815adb86b763ec42ee1e6
SHA512 4a736a330d7752bcc680292189570fda4894499ac63f1b5a3584639a7bf33c5c2b672920a46103dd48cd01a129fb202c23f016beb9a3d72d426f8f62d5257a34
SSDEEP 768:wFiE6esE8lDldUGz3UCg6l4dQu5zudm+ZovGqsW7iIKu8fqGotE184r:BeB85d73nlane9ZWGeiAhGiE1L
TLSH
T163039E3AD884CEA76CDA8B89E34A36576EE021A3D98C4BC4D9C98D0E10C705D774FD69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 bdec21b598ec8157fe743997de8ac16198f2bb70d44a8a2eee3243985e45e86c
MD5 9194131fa49e4a2307f11eae77119bd8
SHA1 1333c2d34547189a6138673d3f93c1837ef05552
SHA512 a828dd97e76ea50e95f85ff5f71561c6e6fc08a35e1cddd91581e2bab4f50bd9ce245d3609982a8dd48e0ce62167ee79022d8fe7aaa6ac34030b72bf36cce21f
SSDEEP 768:NF60raxyp4sQe6WGfvp3/CgK7QlUiQu5zudm+AJE1covGqsW7iIKu8fqGodZ:rb0e8fR3G7QlXne9AJE1cWGeiAhGo
TLSH
T1A713A03A5894CE676CE98E86E74B7617BEE010A39ECC0BC4E5C45E0F018758D1B4FC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1545078763\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_1874000433\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_2099937825\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_826846668\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping564_826846668\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download