cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264

Analysis

max time kernel
148s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seb2chat (1).html
Size 355B
Sample260508-pgdzdab14q
SHA256 cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264
MD5 4525b2d648f7c457a689fd96421783a5
SHA1 11bfe30ce44585a15a38e86bc094224ddfe2c08e
SHA512 94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979
TLSH
T171E0C04F4057B3474011A2907DC01291E505236B38A152F93AC09467500897DC4AA2DD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\mk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_664210777\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_967949056\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1684_429620673\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_664210777\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_967949056\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_664210777\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_967949056\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1694672055\_locales\tr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227177368476666"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{49EB9BC7-B54C-47CB-9BDC-4908F7DB729C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3836	1684	msedge.exe	78
PID 1684 wrote to memory of 1524	1684	msedge.exe	79
PID 1684 wrote to memory of 5616	1684	msedge.exe	80
PID 1684 wrote to memory of 5616	1684	msedge.exe	80
PID 1684 wrote to memory of 5616	1684	msedge.exe	80
PID 1684 wrote to memory of 2280	1684	msedge.exe	81
PID 1684 wrote to memory of 2280	1684	msedge.exe	81
PID 1684 wrote to memory of 4328	1684	msedge.exe	84
PID 1684 wrote to memory of 1352	1684	msedge.exe	85
PID 1684 wrote to memory of 4328	1684	msedge.exe	84
PID 1684 wrote to memory of 4328	1684	msedge.exe	84
PID 1684 wrote to memory of 1352	1684	msedge.exe	85
PID 1684 wrote to memory of 1352	1684	msedge.exe	85
PID 1684 wrote to memory of 5280	1684	msedge.exe	86
PID 1684 wrote to memory of 5280	1684	msedge.exe	86
PID 1684 wrote to memory of 3716	1684	msedge.exe	87
PID 1684 wrote to memory of 2884	1684	msedge.exe	88
PID 1684 wrote to memory of 3716	1684	msedge.exe	87
PID 1684 wrote to memory of 2884	1684	msedge.exe	88
PID 1684 wrote to memory of 5888	1684	msedge.exe	89
PID 5888 wrote to memory of 2164	5888	msedge.exe	90
PID 1684 wrote to memory of 5652	1684	msedge.exe	92
PID 1684 wrote to memory of 2848	1684	msedge.exe	95
PID 1684 wrote to memory of 2848	1684	msedge.exe	95
PID 1684 wrote to memory of 2988	1684	msedge.exe	96
PID 1684 wrote to memory of 2988	1684	msedge.exe	96
PID 1684 wrote to memory of 4404	1684	msedge.exe	97
PID 1684 wrote to memory of 3316	1684	msedge.exe	98
PID 1684 wrote to memory of 428	1684	msedge.exe	99
PID 1684 wrote to memory of 3496	1684	msedge.exe	100
PID 1684 wrote to memory of 3496	1684	msedge.exe	100
PID 1684 wrote to memory of 1372	1684	msedge.exe	103
PID 1684 wrote to memory of 1372	1684	msedge.exe	103
PID 1684 wrote to memory of 1148	1684	msedge.exe	104
PID 1684 wrote to memory of 1148	1684	msedge.exe	104
PID 1684 wrote to memory of 5604	1684	msedge.exe	105
PID 1684 wrote to memory of 5604	1684	msedge.exe	105
PID 1684 wrote to memory of 2600	1684	msedge.exe	106
PID 1684 wrote to memory of 4680	1684	msedge.exe	107
PID 1684 wrote to memory of 4680	1684	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\seb2chat (1).html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b8,0x7ffb0b08f208,0x7ffb0b08f214,0x7ffb0b08f220
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2116,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4660,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4796,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=4896,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5548,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5676,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5676,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6056,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=5812,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=568,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6152,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6096,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5444,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5752,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5336,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5604,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5608,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5348,i,18380463169790859455,5232775701361627390,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
  2⤵
  PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1db9209bc374a2f86cd95b7346b358838349df213bbf2e5a06533baaa399d8b
MD5 abed9e3e2618edc08b0b4a9bf347482b
SHA1 4b8e21f266a1b3861e89185599ab6b265e0c308b
SHA512 11ac46f03cb60b91cc665ca07d95cef83b62e58ef3e2c0e57aad330a2f44ddffcc94b6bc031f690502171ae756869ec4b1c8cfd689529ed13915f42ea2cc1bc5
TLSH
T1B6D0A7D9FB951306D147203912A2DE66375950AC24DB3240645F11BC8A56D91605C5CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb2e67b058af52eb79335c62b961b8b367ad03bf4245e88a2b18e707fb126922
MD5 f650e3a58f84437412874582c04e1817
SHA1 dfaa2484e578cfce01b3fde0a55f88cff71a193e
SHA512 73c9b39def9b49521a94451669987877cc30a9ff1c7cc11491229be2a09c52eb323b418d7c029dbe62d581f6b93559d61333135f5e36b44f85c6621acff12395
TLSH
T161510DF783E8456ECA4195F46A28BE1FCE2C0614432C7E5A84D0EF5793E2470E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c94c25e01ebd006f2974f4d79385aa25c329363b92ac8c965b6ee2f677c5b75b
MD5 4528f96d3090989a387986dd1581cee7
SHA1 645206ed35595eb7a993a721c9c0a0f2498c44f1
SHA512 7fac4514bd09b722a4811839fd1b19f5c378767bde71fed510446c25719250a321609263b32846f64e1f61a7ca33f5898ff23d00b5b35869033d67b8be9192ef
SSDEEP 192:sVbRByMqv/Ky0Ml8UQh3Pw/sJZoAmBQUeoZ8pax/Y+WNrY0JYkieCjEIgCM0ZJ:sVbALqBPwsJZo0Vs/Sr5cnoO
TLSH
T1E572C719AA28497B8CDBD618FA927B53DBFD5573A1405E44A9FCCE0C01E7ADD210282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8857b5c1a2a80f3f24b939a403b3f916e69506e5c51300ecb653469188f6d5c3
MD5 62f250a95a0e865c3bce28788f69a0e9
SHA1 2d0b302f161db0423156ae828b2581db1af3c302
SHA512 ef89b22efb4a42cfbd52f3d25872f985fb662f1457f7bc267cf3b25cc91986296503586be96c46afec05ae9ffcf804ec3660f453f11e59ea44562d47d0a94a97
SSDEEP 192:sVbRByMqv/Ky0Ml8M3Pw/sJZOAmBQUeoZ8pax/Y+WNrY0JqJyCjEIgy0ZJ:sVbALPPwsJZO0Vs/Sr5Cop
TLSH
T17072C7156A28597F8CDBD618FA46BF53DBFD6573A1405E44AAFC8E0C00E7ADD210282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 290fd6504eaf82d91f37f2099b2e654ce6008e085530aee847cf3237fd88024e
MD5 aaf8ad010d17af078db4493c79a7d6f2
SHA1 79875d9cf19a5976c9a2132ff64a0a012981c803
SHA512 3b08f7e19181a6708c00bf05e4be5447514a5c42ae525196982a91f2321efea9e684b3d94835e2b07403826028247272b08a33a732b840f1beb97487272b9450
SSDEEP 768:+e8dM8jQ23c7pL/Ln1/WRWDpQ3V8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gOpuLlv:+e8dM8jQ23ADn1/WRWDpQ3Vu1jaKgOpk
TLSH
T1C9031C7B2C0CCB7F4FC44E9CED2A6F9A5DE8028B9698895447FE440C03C66EB451A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 238413ff38b6e576f38137a5d25714575e50e163f697f47aed496e26ce6181d2
MD5 3c46d9343b71843d93cd8879e0d96d52
SHA1 c94110f76cbebfd28f741bf2496d8e7bde41555c
SHA512 04d7276dce25fa32dffc374e6ff760eba5e45a14ff373e68421144a128edc8fda911dd8e3789ca9d5117783a20326205ef5fa0cb287494ed08fb8c40e62531dc
SSDEEP 192:2CM1L7oH7NtNmFSbLz5BDKparjwv8TP5xBSxmPP/ddvutuFJd1Enb13XQ7mnjJrk:X
TLSH
T196A27E7D753B1281383E255EA5A8911FC94220F22031BF7F79A510A68E6BE309DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 467B
SHA256 177ce745d0f29e0d1f496a84e54e30bbda67e19d90a89da36ba2dafd13db28ab
MD5 ab44d06ccada009ab51042f37b7adb43
SHA1 68389ae1dab3528bff11ee89f28bcca3c1656178
SHA512 cd4f28810b5f57c7617ab1d9f680c832dd48cf081de0664a0ae6ead14abfd0304a7c1dcfc3d1916eec347ae08983bae6e85ef093dcb9bb5b9138a98910d70e1f
TLSH
T132F02BA3881A7DBB0A71337895623BA1FE55130F8547608F7ABC104C1F7E87A05DBA66
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 5KB
SHA256 7c4c26c496fe63ef979e00889addf080f0758ae9623f17347a925c1d4ff36fc1
MD5 05f15f4f7484cc027ce9b3ed5d7d409c
SHA1 bf9c7b2d8dfff66e043ac4f8c4886b6891d11ee4
SHA512 3cc0faf45bef5b761e9768b539fccfb6220eaba16df3b73be869ba6606673d22842d3809772aa5dc75286c6b2ae34ea5e5b55c89d60f8ceebbb40e94068c4445
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUynTxe7eyN7n1jo:K5XST+STktWejy1eqyN71jo
TLSH
T194B11E0FCC0DBE771BB766709A35A6F1FA9131DB945249977F9C004EE71A0EE0282E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 900B
SHA256 5119728413088584a263ea79a90dddfaa97c2d82c7419ccf8b73795a4c702064
MD5 74ee5a23a8313b0b3df7c371d096550b
SHA1 e2c2c850773564179778998c9a10675dd64e3ecf
SHA512 7762f36294f9c3a648ca46aac27d69acdad17dfc5fa949f21775c88d1fb6895b3c4b3f9be3d87f23fdaa97039aebc1c9d0e6a8e6b3e30fc324f6442053a3da62
TLSH
T1331189A3D82E7D7B0A312278555536E1FE54134F8546608F7ABC118C1F7EC7A08CBA6A
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
TLSH
T1B2A2B81DC81C7E3257DA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b2ea3ed7293a682f9191e395a8cfdc3860d8bd3dadf6f3901c605296f39a1d65
MD5 767b485ee0efca7c6c93fa7a0200d979
SHA1 5871437c28fb6ec37c59f26595aef2d651b25d66
SHA512 2d9a9376b24ac8579f913359225010fac03b557a881ae0d074b0793f7b1ce50084772dd25dc1f5961fef2d77f9f2e1516394f240f520d79291540e9d4da4fde7
SSDEEP 768:EFf0raxyp4sQe6WGfv63/Cg0RLQC4LQ9jmRsA9RXIjs03IY6NDK9wPLJJ4tVQQ1U:Bb0e8fS3AR6QsAYY6Nm9ELz43QV
TLSH
T1DB13AF3898A4CDA36CE6CE85E70A7B0BBEF056979A8C4AC0D5C46D0F01C71DD270F866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 739618095279d9ea6449c2051d8cc91c0a428bcc538d43d5c2e87295869ce91f
MD5 006fb0c55ec8d399a4854f4cdf78d0cf
SHA1 4f14c693453a3d05c2e78f18078eb046bc36b719
SHA512 eef4648166e54e322e58e4a50560423870f93b5f53d6c264adbea911b88241d061a0642da8d375dec11a8c830b79850a526a25b0279b06216491c77d6cb1f9cf
SSDEEP 768:/Qf0raxyp4sQe6WGfvy3/wgXRLQC4LQ9jmRsA9RXIjR03IY6NDK9wPLJJ4tVQQ1U:nb0e8fK3pR6QsZYY6Nm9ELz43QV
TLSH
T18813AF389864CDA36CE6CE86E70A7B0BBEF156979A8C4AC0D5C46D0F01C71DD270F866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b26ffe0e337a21f6b45e24cabfb98fa5ed8ac2e0f6fc6321a010a7a9d8c3c0c9
MD5 ac09e7974a02c0dacd0dceb85ebaab86
SHA1 a1d4afc86fe5e93a9bb953c82f2c80c560458f7d
SHA512 c195b96514dbcc6f080028b15e43ae618d4b9afb6949b48c8bd2fa3d23f9857e3f7159a4aa5bd8378d40004791d8186ac937917ea0437eb7a46de1e830e2a3ab
SSDEEP 768:EQiE6esE8lDldUGz3UwgkQCU7QQ9jmRsA9wly5wv8kDK9wPLJJ4tVQQ9IY6gp:weB85d73EsQswawUkm9ELz43QPY6gp
TLSH
T10C037C3DDC88C9BB18DEDB44A30D361A6DE046B7D5684B84DBC85E0E81E60ACF34B865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 160b7380180360e62b1fbfd668a6163e3f58c3cc3f528a9ec8f871d27e073b99
MD5 699f959a8420bf2c9ae8bc18197398b8
SHA1 dcca495c5965c881113c8cc78f01ef989fa7886b
SHA512 77d92ce380ddff9a744024b50adc982cf8da4ac22f24ce3bf8ba3eca0ea6791aa8d18e9b7658912144259fb0bfb6319082e6dd46e05066ed5ef97a624f83dca0
SSDEEP 768:4QiE6esE8lDldUGz3UwgkQCQ2Q9jmRsA9RXIjR07DK9wPLJJ4tVQQ9IY6gp:MeB85d73FQsZ7m9ELz43QPY6gp
TLSH
T197039D39D848CDA368E6CA85E70A3B1BBEF15697964C5BC0D9C89C1E12C70AD334FC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 bcb9a021e22479ce0ab5e416cdde80afa4e698ed9c89c54fa1660408e68a388e
MD5 a67a9528c95e73112cc3d5a569e34339
SHA1 5d4afa7bf940d35116196913244504536739b276
SHA512 f24bba4aaaf2c70bf4991132e40eb383bd7d3dd1238eaec4a76ac8722fb65f71d3b68addf5cf6d3e51e40807b45f8ebaf8a4526963a056e883f1f918adce2c06
SSDEEP 768:/Q90raxyp4sQe6WGfvq3/wgXRLQCPLQ9jmRsA9RXIjR03IY6NDK9wPLJJ4tVQQ1U:jb0e8fi3pRnQsZYY6Nm9ELz43QV
TLSH
T17F13AF389864CDA36CE6CE86E70A7B0BBEF156979A8C5AC0D5C46D0F01C71DD270F866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1292177883\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1788762223\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_1788762223\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_664210777\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_664210777\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1684_967949056\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download